外掛標籤
開發者團隊
原文外掛簡介
Unstoppable Site Manager turns your own WordPress site into a dashboard for every client site you look after. Install it on your site, install the free Unstoppable Site Connector on each client site, and pair them with a one-time key.
Sites at a glance – a card for every site with pending updates, WordPress and PHP versions, SSL expiry, when it last reported and, if you turn screenshots on, a picture of its home page. Tiles at the top count plugin, theme and WordPress updates across all sites. Star your most important sites to pin them to the top.
Updates – update one plugin on one site, everything on one site, or everything everywhere. Opening a site checks it for updates straight away.
Plugins – one list of every plugin on every site. Activate, deactivate, update or delete across the sites you pick, or install new plugins from the WordPress.org directory, a URL or a ZIP you drop in.
Vulnerability checks (optional) – flags plugins, themes and WordPress versions with known security problems, using the free WPVulnerability database, with severity and the version that fixes each one.
Maintenance mode and Coming soon – from a site’s page, show visitors a Maintenance page (“back soon”, tells search engines it’s temporary) or a Coming soon page (for a site that hasn’t launched, kept out of search), with your own heading and message. Signed-in editors see the site as usual. Maintenance can switch off by itself after an hour or a day. Needs Unstoppable Site Connector 0.9.0.
One-click sign-in – open any client’s wp-admin already signed in. No passwords are stored; each sign-in link works once and expires after 60 seconds.
Client reports – a monthly Website Care Report for each site, with your logo and brand color: a plain-English health verdict, a health checklist, one tidy line per update, the month’s other changes, the other work you did for them and an optional personal note. Print it, save it as PDF, or email it to your client, by hand or automatically each month.
Clients – group sites under the client they belong to, then refresh, update and pick plugins for just that client’s sites. Give each client their own report branding (name, logo, colour, wording, sender) and, if you like, your name in the admin footer of their sites.
Move your dashboard – moving to a new WordPress install? Take every site, client, setting and report history with you. Each site hands over with a one-time code, and the old dashboard can no longer manage them.
Bulk connect – moving from MainWP or ManageWP? Make a connector that knows your dashboard, push it to all your sites with that tool’s bulk plugin install, and every site connects itself. Upload MainWP’s site export to see which ones are still missing.
Security you can check – a Security screen with a checklist for your dashboard, one-click locking of every client site to your dashboard’s address, and per-site permission switches. Details below.
Uptime monitoring – every 5, 15 or 30 minutes the dashboard checks that each site answers, emails you when one goes down and again when it’s back (with how long it was down), and shows uptime on each site page and in client reports.
SSL and domain expiry alerts – a daily check of each site’s SSL certificate, and (optional) its domain registration date, with emails before either runs out.
Background checks and a daily email – while you’re away, the dashboard checks every site for new updates, daily or every 6 hours, one site at a time. Optionally, a morning email lists only what needs you: known vulnerabilities, sites not answering, SSL certificates about to expire, sites left in maintenance mode, and pending updates.
Built not to time out – bulk jobs run one site at a time from your browser, and a site that fails is reported and skipped. Client sites push their own reports, so your dashboard isn’t polling all day.
How it differs from other site managers
Self-hosted, no outside service. The dashboard is a plugin on your own WordPress site. Your client list, keys and reports never pass through Unstoppable Solutions or any other company’s servers.
Complete and free. Every feature described here is in this plugin. There are no paid extensions, no add-on store and no license key.
Client reports included. Branded monthly Website Care Reports, built from each site’s own activity log, ready to print, save as PDF or email on a schedule.
Finds updates for paid plugins that hide them. Update checks run inside each client site’s admin area, so plugins that only look for updates there (such as Crocoblock’s Jet plugins) are found and updated too.
Client sites keep control. Each site’s own security settings can only be made stricter from the dashboard (see Security below).
Security
Your dashboard can update and sign in to every connected site, so it is built to be hard to abuse even if something goes wrong:
No client passwords are stored. Each site trusts your dashboard’s public key. Every request is signed, expires after 5 minutes and can only be used once.
Client sites have the last word. Each site’s connector has its own security settings: allowed dashboard addresses, what the dashboard may do, and alert emails. From the dashboard they can only be made stricter. Loosening them is only possible in that site’s own wp-admin. (One-click login and installing plugins from a ZIP each give the dashboard full control of a site, so switch them off where you don’t need them.)
Lock sites to your dashboard’s address. One click locks every site to the address your dashboard’s requests come from, so a stolen key is useless anywhere else. A site that refuses a correctly signed request tells you about it, by email and on your dashboard.
Keep the signing key out of the database. Move it to wp-config.php, so a leaked backup or an SQL injection in another plugin can’t be used to control your sites. If the key ever goes missing, the dashboard stops and says so; it never quietly makes a new one.
Choose who can use it. Limit the dashboard to chosen administrator accounts. Others don’t see it and can’t send anything to your sites.
A checklist for HTTPS, two-factor sign-in and file editing, with clear steps when something needs attention.
Previously released as FM Dashboard. Installing Unstoppable Site Manager on a site that has FM Dashboard carries over every site, key, screenshot and activity entry, so client sites stay connected; you can then deactivate and delete FM Dashboard.
External Services
This plugin connects to the following services.
Your client sites (Unstoppable Site Connector). To show status, run updates, manage plugins and sign you in, the dashboard sends signed requests to each client site you paired, and receives status reports from them. Nothing is sent to Unstoppable Solutions.
Your client sites, directly (uptime and SSL checks). Every few minutes (Settings > Uptime and expiry alerts; can be switched off) the dashboard loads each client site’s home page to see whether it answers, and once a day it reads the site’s SSL certificate. These requests go only to your own client sites.
RDAP domain lookups via rdap.org (optional, off until you turn on Domain expiry in Settings). To warn you before a client’s domain registration runs out, each domain name (only the name, for example example.com) is sent to https://rdap.org/, which forwards the request to that domain’s registry; the registry returns the public registration record. Once a week per domain, daily in the last 30 days. rdap.org, operated by Gavin Brown under the ICANN RDAP framework.
WordPress.com mShots (optional screenshot service, off by default; turn it on under Settings > Screenshots). Only when you turn it on, the public address of each client site is sent to https://s0.wp.com/mshots/v1/ to show a thumbnail of its home page (when a site is added and weekly). Provided by Automattic: Terms of Service, Privacy Policy.
A screenshot service of your choice (optional). If you enter your own screenshot API address in Settings, client site addresses are sent to it instead. That service’s own terms apply.
WPVulnerability (optional, off until you turn on Vulnerability checks in Settings). To flag plugins, themes and WordPress versions with known security problems, their names (slugs) and WordPress version numbers are sent to https://www.wpvulnerability.net/. Client site addresses are not sent. Each item is looked up at most every 12 hours. Website and terms.
WordPress.org Plugin Directory. When you search for plugins on Plugins > Add plugin, your search terms are sent to https://api.wordpress.org/plugins/info/ and plugin icons load from WordPress.org. Privacy Policy.
WordPress.org Plugin Directory downloads. The Add Site screen’s “Download the connector ZIP” button, and the bulk-connect connector, use the current Unstoppable Site Connector release from https://downloads.wordpress.org/. The bulk-connect copy is downloaded only when you click its download button.
Temporary plugin hosting on your own site. A ZIP you drop on Plugins > Add plugin, or one you install by web address (which this dashboard downloads from that address once), is kept in this plugin’s own database table for up to 6 hours at an unguessable address so your client sites can download it, then deleted. No plugin files are written to your uploads folder. Client sites only install plugin files from WordPress.org or from your dashboard.
