SiteSelf Connector

Description

SiteSelf is a service that works on your WordPress site for you — updating
content, adjusting your design, keeping an eye on things — and reports back in
chat. This plugin is the part that lives on your site, and it exists so your
agent can work on your theme and plugin files rather than content alone.

What it can do

• Read and write files inside your themes and plugins folders
• Tell your agent how the site is built: WordPress and PHP versions, active
  theme, installed plugins, and which company hosts the site
• Measure the site: how big its database tables and folders are, how much disk
  is free, and what limits the server’s PHP runs under
• Make a backup on your own server before your agent changes your live site,
  covering the database tables and theme or plugin files the change touches
• Change a short, fixed list of settings: whether search engines may index the
  site, and, when Yoast SEO is active, the separator in its page titles
• Send SiteSelf a copy of your database and your site’s code when SiteSelf
  builds a staging site from yours
• Clear caches
• Keep a log of everything it did, readable under Tools → SiteSelf

What it will not do, by design

• It never runs code that is sent to it. There is no remote code execution.
• It never gives your agent a setting that holds a credential. The settings it
  reads are a short, fixed list that describe how your site is built, and it
  refuses anything whose name looks like a key, token or password. The settings
  it changes are a fixed list too, each written the way WordPress’s own
  settings screens write it; it never takes a setting’s name, SQL or code from a
  request.
• The files it writes for your agent are inside your themes and plugins folders
  only. Both folders are resolved before anything is written, so ../ cannot
  climb out of them, and a file that turns out to be a shortcut to somewhere
  else (a symlink) is refused rather than followed.
• Its backups stay on your server, in a private folder outside the part of the
  server your site is served from, and are never sent anywhere. If your server
  has no such folder, it takes no backup and says why.
• It cannot edit files that WordPress itself would not let you edit. Whether a
  request is allowed is WordPress’s decision, using the same permissions as its
  built-in editors — so DISALLOW_FILE_MODS, DISALLOW_FILE_EDIT, a managed
  host that switches file changes off, and multisite’s rule that only a network
  administrator may touch shared plugin files all apply here too.
• Before replacing a file it keeps a copy of the previous version, and it
  refuses to save PHP that has a syntax error.

Staging sites

When SiteSelf builds a staging site from yours — a private working copy on
SiteSelf’s servers, where a change is made and checked before it is applied to
your live site — SiteSelf’s own systems, never your agent, ask this plugin for
a copy of your database tables and your site’s code: WordPress itself, your
themes, your plugins, must-use plugins and translations. Your uploads are not
copied; the staging site shows your live site’s images. The plugin never sends
wp-config.php or a copy of it under another name, and it leaves out any file
whose name says it holds a credential (such as .env or an SSH key), any key
file that holds a private key, repositories, database dumps and logs, and tells
SiteSelf which it left out. The database copy holds every one of your site’s
tables — so it includes whatever other plugins store there — except the two
rows where this plugin keeps its own keys. Each copy is requested as a job that
shows in the log under Tools → SiteSelf, and is sent in small pieces, each
checksummed; no file is written on your server to make it.

How access works

The plugin adds no new way into your site. Every request must come from a
signed-in WordPress user with the right permissions, using WordPress’s own
application passwords — which you create, and can revoke at any time under
Users → Profile → Application Passwords. Deactivating this plugin disconnects
the site from SiteSelf and removes the application password it created.

External services

This plugin connects your site to SiteSelf, a service run by Refact at
https://siteself.com. The plugin is the site-side half of that service and is
not useful without it.

The plugin sends two kinds of request to SiteSelf at api.siteself.com, over
HTTPS, and only when an administrator acts. It sends nothing on a schedule.

• When you select Connect this site or Get a new key, it sends SiteSelf a
  new application password for your WordPress account (with Connect this site
  only), your username, this site’s addresses, the public half of its identity
  key, whether it uses Elementor, Divi or Beaver Builder, whether WooCommerce
  is active, whether your host marks it as a staging site, and the plugin’s
  version. SiteSelf answers with a one-time key.
• When you select Disconnect or deactivate the plugin, it sends this site’s
  id and addresses, why (disconnect or deactivate) and the plugin’s version, so
  SiteSelf ends the connection on its side. No credential is sent.

Both are signed with this site’s identity key, whose private half never leaves
your server. Otherwise the plugin answers requests that SiteSelf makes to your
site, and only when they carry a signed-in WordPress user with administrator
permissions — the application password, which you can revoke.

What leaves your site when SiteSelf asks. A status request returns a
description of how this site is built:

• your site’s name, home address, admin address and language
• your WordPress and PHP version numbers
• every plugin installed, with its version and whether it is active
• your active theme, its version, and whether it is a child theme
• which company hosts the site, any must-use plugins that identify them, and
  whether the host reports this as a staging copy
• the server software string and the file path WordPress is installed at
• how many published posts and pages you have
• whether this site permits file changes
• a public key this plugin creates for the site, so that moving to a new
  domain does not look like a different site. The matching private key never
  leaves your server — not to SiteSelf, not in any request.

A measurement request returns the size of each of your database tables and
how many rows it has, the size of your WordPress, theme, plugin, content and
uploads folders, the free space on your server’s disk, your PHP version and
limits, whether scheduled tasks run, which drop-in files replace parts of
WordPress (such as an object cache), and where a backup would be kept. It
returns sizes and counts, never what is in a table or a file.

Other requests return the contents of a file inside your themes or plugins
folders, a folder listing, one of a short fixed list of WordPress settings
that describe how the site is built, or the current value of a setting the
plugin can change. Anything whose name looks like a key, token, secret or
password is refused.

The one exception is the staging site described above: when SiteSelf builds
one, it receives your database tables — which hold your content and whatever
personal data of your users your site stores, such as accounts and orders —
and your site’s code, excluding uploads, wp-config.php and the files listed
there. Apart from that copy, this plugin sends no content, visitor data,
analytics or personal data of your users. Backups the plugin makes stay on your
server.

Service terms: https://siteself.com/terms
Privacy policy: https://siteself.com/privacy