內容簡介
SiteSelf Connector 是一款專為 WordPress 網站設計的外掛，能夠協助更新內容、調整設計並監控網站狀況，並透過聊天回報給代理人。此外掛使代理人能夠直接在佈景主題和外掛檔案上工作，而不僅限於內容。
【主要功能】
• 讀取與寫入佈景主題及外掛資料夾內的檔案
• 提供網站架構資訊，如 WordPress 版本及啟用的佈景主題
• 測量網站資料庫大小及伺服器的 PHP 限制
• 在代理人變更網站前進行備份
• 清除快取
• 記錄所有操作歷程，方便查閱
外掛標籤
開發者團隊
原文外掛簡介
SiteSelf is a service that works on your WordPress site for you — updating
content, adjusting your design, keeping an eye on things — and reports back in
chat. This plugin is the part that lives on your site, and it exists so your
agent can work on your theme and plugin files rather than content alone.
What it can do
Read and write files inside your themes and plugins folders
Send SiteSelf a copy of your themes, plugins and must-use plugins, so it keeps
a history of your site’s code, and write a change from that history back to
them on your yes, all of it or none of it
Tell your agent how the site is built: WordPress and PHP versions, active
theme, installed plugins, and which company hosts the site
Measure the site: how big its database tables and folders are, how much disk
is free, and what limits the server’s PHP runs under
Make a backup on your own server before your agent changes your live site,
covering the database tables and theme or plugin files the change touches
Change a short, fixed list of settings: whether search engines may index the
site, and, when Yoast SEO is active, the separator in its page titles
Send SiteSelf a copy of your database and your site’s code when SiteSelf
builds a staging site from yours
Clear caches
Write and run PHP code inside WordPress. It does this only on a WordPress
site connected to SiteSelf, a SiteSelf customer’s, and only when SiteSelf
sends it, so that your agent can read what the requests above do not give
and make changes they cannot
Keep a log of everything it did, readable under Tools → SiteSelf
What it will not do, by design
It never gives your agent a setting that holds a credential: it refuses a
setting whose name looks like a key, token or password, and hides such an
entry inside any setting it reads. It writes a setting the way WordPress’s own
settings screens write it, and never changes your site’s address, who may
sign up, or what each role may do.
The files it writes for your agent are inside your themes, plugins and
must-use plugins folders only. Each folder is resolved before anything is
written, so ../ cannot climb out of them, and a file that turns out to be a shortcut to somewhere
else (a symlink) is refused rather than followed.
Its backups stay on your server, in a private folder outside the part of the
server your site is served from, and are never sent anywhere. If your server
has no such folder, it takes no backup and says why.
It cannot edit files that WordPress itself would not let you edit. Whether a
request is allowed is WordPress’s decision, using the same permissions as its
built-in editors — so DISALLOW_FILE_MODS, DISALLOW_FILE_EDIT, a managed
host that switches file changes off, and multisite’s rule that only a network
administrator may touch shared plugin files all apply here too.
Before replacing a file it keeps a copy of the previous version, and it
refuses to save PHP that has a syntax error.
Staging sites
When SiteSelf builds a staging site from yours — a private working copy on
SiteSelf’s servers, where a change is made and checked before it is applied to
your live site — SiteSelf’s own systems, never your agent, ask this plugin for
a copy of your database tables and your site’s code: WordPress itself, your
themes, your plugins, must-use plugins and translations. Your uploads are not
copied; the staging site shows your live site’s images. The plugin never sends
wp-config.php or a copy of it under another name, and it leaves out any file
whose name says it holds a credential (such as .env or an SSH key), any key
file that holds a private key, repositories, database dumps and logs, and tells
SiteSelf which it left out. The database copy holds every one of your site’s
tables — so it includes whatever other plugins store there — except the two
rows where this plugin keeps its own keys. Each copy is requested as a job that
shows in the log under Tools → SiteSelf, and is sent in small pieces, each
checksummed; no file is written on your server to make it.
How access works
The plugin adds no new way into your site. Every request must come from a
signed-in WordPress user with the right permissions, using WordPress’s own
application passwords — which you create, and can revoke at any time under
Users → Profile → Application Passwords. Deleting this plugin disconnects
the site from SiteSelf and removes the application password it created.
External services
This plugin connects your site to SiteSelf, a service run by Refact at
https://siteself.com. The plugin is the site-side half of that service and is
not useful without it.
The plugin sends two kinds of request to SiteSelf at api.siteself.com, over
HTTPS, and only when an administrator acts. It sends nothing on a schedule.
When you select Connect this site or Get a new key, it sends SiteSelf a
new application password for your WordPress account (with Connect this site
only), your username, this site’s addresses, the public half of its identity
key, whether it uses Elementor, Divi or Beaver Builder, whether WooCommerce
is active, whether your host marks it as a staging site, and the plugin’s
version. SiteSelf answers with a one-time key.
When you select Disconnect, or deactivate or delete the plugin, it sends
this site’s id and addresses, why (disconnect, deactivate or uninstall) and
the plugin’s version. Disconnecting or deleting ends the connection on
SiteSelf’s side; deactivating tells SiteSelf the plugin is off. No credential
is sent.
Both are signed with this site’s identity key, whose private half never leaves
your server. Otherwise the plugin answers requests that SiteSelf makes to your
site, and only when they carry a signed-in WordPress user with administrator
permissions — the application password, which you can revoke.
What leaves your site when SiteSelf asks. A status request returns a
description of how this site is built:
your site’s name, home address, admin address and language
your WordPress and PHP version numbers
every plugin installed, with its version and whether it is active
your active theme, its version, and whether it is a child theme
which company hosts the site, any must-use plugins that identify them, and
whether the host reports this as a staging copy
the server software string and the file path WordPress is installed at
how many published posts and pages you have
whether this site permits file changes
a public key this plugin creates for the site, so that moving to a new
domain does not look like a different site. The matching private key never
leaves your server — not to SiteSelf, not in any request.
A measurement request returns the size of each of your database tables and
how many rows it has, the size of your WordPress, theme, plugin, content and
uploads folders, the free space on your server’s disk, your PHP version and
limits, whether scheduled tasks run, which drop-in files replace parts of
WordPress (such as an object cache), and where a backup would be kept. It
returns sizes and counts, never what is in a table or a file.
SiteSelf’s copy of your site’s code. SiteSelf’s own systems, never your
agent, read your themes, plugins and must-use plugins, so that SiteSelf keeps a
history of your site’s code and can undo a change to it: each file’s name,
size and a fingerprint of its contents, and the files themselves. They leave
out the files the staging copy leaves out (any file that holds a credential,
repositories, logs, caches and backup archives) and say which. A change from
that history is written back to those folders on your yes, all of it or none
of it; if it stops your site from loading, every file is put back at once.
Other requests return the contents of a file inside your themes, plugins or
must-use plugins folders, a folder listing, or the value of one of your site’s
settings. Anything whose name looks like a key, token, secret or
password is refused.
A PHP request returns what the code SiteSelf sent printed and returned, which
can be anything WordPress can read: your content, your settings, and the
personal data of your users that your site stores. The values of the database
password and of the keys and salts in wp-config.php read as [hidden]; the
code itself can get around that.
The one exception is the staging site described above: when SiteSelf builds
one, it receives your database tables — which hold your content and whatever
personal data of your users your site stores, such as accounts and orders —
and your site’s code, excluding uploads, wp-config.php and the files listed
there. Apart from those copies and what PHP code SiteSelf sends returns, this
plugin sends no content, visitor data, analytics or personal data of your
users. Backups the plugin makes stay on your server.
Service terms: https://siteself.com/terms
Privacy policy: https://siteself.com/privacy
