About this plugin
Apaxon Core is the plugin the other Apaxon plugins sit on. Install it once and it handles licensing, a shared settings framework, granular permissions and the security helpers every Apaxon plugin uses — so no two of our plugins ship their own copy of the same code.
Encrypted secrets
API keys, SMTP passwords and webhook secrets are sealed with libsodium before they reach the database. Most plugins store them in plaintext, which means any database dump, stray backup file or SQL injection elsewhere on the site hands over a working set of credentials.
Email that actually sends
WordPress sends email through your server by default, which on shared hosting often means it is quietly discarded. Pick your provider — Gmail, Microsoft 365, Brevo, SendGrid and others are preset — enter an app password, and press the test button. Passwords are encrypted before they are stored.
If you already run WP Mail SMTP, FluentSMTP or Post SMTP, Apaxon leaves email alone entirely and tells you which plugin is in charge.
Granular permissions
Apaxon features use their own capabilities rather than manage_options. You can let a receptionist manage the booking calendar without making them an administrator who can install plugins and edit users.
Site checks
Core reports what it can see: licence state, whether scheduled tasks are actually running, PHP end-of-life, HTTPS, the file editor, debug mode. Findings appear in Apaxon Tools and in WordPress’s own Site Health screen.
Your site keeps working
If our platform is unreachable, Core keeps your last known entitlements and carries on. Nothing switches off because of an outage on our side, and nothing switches off the moment a subscription lapses — plugins fall back to their free capabilities instead.
No tracking
Core reports your WordPress version, PHP version and plugin versions so we can warn you about vulnerabilities affecting your site. It does not collect visitor data, page views, or anything about the people using your website.
External services
com. Nothing is sent automatically until you enter a licence key.
Automatically, once a licence key is present:
- Activating and validating your key, twice a day by default (sends: licence key, site address, and — unless you turn off version reporting in Settings — your WordPress, PHP and Apaxon Core versions)
- Checking for module updates (sends: licence key, site address, installed module versions)
Only when you press the button:
- Apaxon → Tools → Maintenance → “Test the connection to Apaxon” makes a single request to check whether your server can reach us. It works without a licence key, so you can tell a blocked host from an invalid key. Like every request this plugin makes, it identifies itself with your site address and the Apaxon Core version.
com/privacy