SiteSelf Connector

SiteSelf is a service that works on your WordPress site for you — updating
content, adjusting your design, keeping an eye on things — and reports back in
chat. This plugin is the part that lives on your site, and it exists so your
agent can work on your theme and plugin files rather than content alone.

What it can do

• Read and write files inside your themes and plugins folders
• Send SiteSelf a copy of your themes, plugins and must-use plugins, so it keeps
  a history of your site’s code, and write a change from that history back to
  them on your yes, all of it or none of it
• Tell your agent how the site is built: WordPress and PHP versions, active
  theme, installed plugins, and which company hosts the site
• Measure the site: how big its database tables and folders are, how much disk
  is free, and what limits the server’s PHP runs under
• Make a backup on your own server before your agent changes your live site,
  covering the database tables and theme or plugin files the change touches
• Change a short, fixed list of settings: whether search engines may index the
  site, and, when Yoast SEO is active, the separator in its page titles
• Send SiteSelf a copy of your database and your site’s code when SiteSelf
  builds a staging site from yours
• Clear caches
• Write and run PHP code inside WordPress. It does this only on a WordPress
  site connected to SiteSelf, a SiteSelf customer’s, and only when SiteSelf
  sends it, so that your agent can read what the requests above do not give
  and make changes they cannot
• Keep a log of everything it did, readable under Tools → SiteSelf

What it will not do, by design

• It never gives your agent a setting that holds a credential: it refuses a
  setting whose name looks like a key, token or password, and hides such an
  entry inside any setting it reads. It writes a setting the way WordPress’s own
  settings screens write it, and never changes your site’s address, who may
  sign up, or what each role may do.
• The files it writes for your agent are inside your themes, plugins and
  must-use plugins folders only. Each folder is resolved before anything is
  written, so ../ cannot climb out of them, and a file that turns out to be a shortcut to somewhere
  else (a symlink) is refused rather than followed.
• Its backups stay on your server, in a private folder outside the part of the
  server your site is served from, and are never sent anywhere. If your server
  has no such folder, it takes no backup and says why.
• It cannot edit files that WordPress itself would not let you edit. Whether a
  request is allowed is WordPress’s decision, using the same permissions as its
  built-in editors — so DISALLOW_FILE_MODS, DISALLOW_FILE_EDIT, a managed
  host that switches file changes off, and multisite’s rule that only a network
  administrator may touch shared plugin files all apply here too.
• Before replacing a file it keeps a copy of the previous version, and it
  refuses to save PHP that has a syntax error.

Staging sites

When SiteSelf builds a staging site from yours — a private working copy on
SiteSelf’s servers, where a change is made and checked before it is applied to
your live site — SiteSelf’s own systems, never your agent, ask this plugin for
a copy of your database tables and your site’s code: WordPress itself, your
themes, your plugins, must-use plugins and translations. Your uploads are not
copied; the staging site shows your live site’s images. The plugin never sends
wp-config.php or a copy of it under another name, and it leaves out any file
whose name says it holds a credential (such as .env or an SSH key), any key
file that holds a private key, repositories, database dumps and logs, and tells
SiteSelf which it left out. The database copy holds every one of your site’s
tables — so it includes whatever other plugins store there — except the two
rows where this plugin keeps its own keys. Each copy is requested as a job that
shows in the log under Tools → SiteSelf, and is sent in small pieces, each
checksummed; no file is written on your server to make it.

How access works

The plugin adds no new way into your site. Every request must come from a
signed-in WordPress user with the right permissions, using WordPress’s own
application passwords — which you create, and can revoke at any time under
Users → Profile → Application Passwords. Deleting this plugin disconnects
the site from SiteSelf and removes the application password it created.

External services

This plugin connects your site to SiteSelf, a service run by Refact at
https://siteself.com. The plugin is the site-side half of that service and is
not useful without it.

The plugin sends two kinds of request to SiteSelf at api.siteself.com, over
HTTPS, and only when an administrator acts. It sends nothing on a schedule.

• When you select Connect this site or Get a new key, it sends SiteSelf a
  new application password for your WordPress account (with Connect this site
  only), your username, this site’s addresses, the public half of its identity
  key, whether it uses Elementor, Divi or Beaver Builder, whether WooCommerce
  is active, whether your host marks it as a staging site, and the plugin’s
  version. SiteSelf answers with a one-time key.
• When you select Disconnect, or deactivate or delete the plugin, it sends
  this site’s id and addresses, why (disconnect, deactivate or uninstall) and
  the plugin’s version. Disconnecting or deleting ends the connection on
  SiteSelf’s side; deactivating tells SiteSelf the plugin is off. No credential
  is sent.

Both are signed with this site’s identity key, whose private half never leaves
your server. Otherwise the plugin answers requests that SiteSelf makes to your
site, and only when they carry a signed-in WordPress user with administrator
permissions — the application password, which you can revoke.

What leaves your site when SiteSelf asks. A status request returns a
description of how this site is built:

• your site’s name, home address, admin address and language
• your WordPress and PHP version numbers
• every plugin installed, with its version and whether it is active
• your active theme, its version, and whether it is a child theme
• which company hosts the site, any must-use plugins that identify them, and
  whether the host reports this as a staging copy
• the server software string and the file path WordPress is installed at
• how many published posts and pages you have
• whether this site permits file changes
• a public key this plugin creates for the site, so that moving to a new
  domain does not look like a different site. The matching private key never
  leaves your server — not to SiteSelf, not in any request.

A measurement request returns the size of each of your database tables and
how many rows it has, the size of your WordPress, theme, plugin, content and
uploads folders, the free space on your server’s disk, your PHP version and
limits, whether scheduled tasks run, which drop-in files replace parts of
WordPress (such as an object cache), and where a backup would be kept. It
returns sizes and counts, never what is in a table or a file.

SiteSelf’s copy of your site’s code. SiteSelf’s own systems, never your
agent, read your themes, plugins and must-use plugins, so that SiteSelf keeps a
history of your site’s code and can undo a change to it: each file’s name,
size and a fingerprint of its contents, and the files themselves. They leave
out the files the staging copy leaves out (any file that holds a credential,
repositories, logs, caches and backup archives) and say which. A change from
that history is written back to those folders on your yes, all of it or none
of it; if it stops your site from loading, every file is put back at once.

Other requests return the contents of a file inside your themes, plugins or
must-use plugins folders, a folder listing, or the value of one of your site’s
settings. Anything whose name looks like a key, token, secret or
password is refused.

A PHP request returns what the code SiteSelf sent printed and returned, which
can be anything WordPress can read: your content, your settings, and the
personal data of your users that your site stores. The values of the database
password and of the keys and salts in wp-config.php read as [hidden]; the
code itself can get around that.

The one exception is the staging site described above: when SiteSelf builds
one, it receives your database tables — which hold your content and whatever
personal data of your users your site stores, such as accounts and orders —
and your site’s code, excluding uploads, wp-config.php and the files listed
there. Apart from those copies and what PHP code SiteSelf sends returns, this
plugin sends no content, visitor data, analytics or personal data of your
users. Backups the plugin makes stay on your server.

Service terms: https://siteself.com/terms
Privacy policy: https://siteself.com/privacy