AudiScale Connector

com). It unlocks the SEO actions that WordPress core and the standard REST API do not allow — most notably printing a <meta name="description"> tag in the <head> without forcing you to install another SEO plugin.

Service disclosure (SaaS)

This plugin communicates with the third-party AudiScale service. No data is

sent until you have explicitly paired your site from your AudiScale dashboard.

Once paired, AudiScale can remotely apply a fixed catalog of operations

(listed below), each of which is:

• signed with HMAC-SHA256 using a per-site secret (rotatable and revocable);

• subject to a WordPress capability check ( manage_options );

• logged (who, what, when, before/after value);

• reversible where possible (draft/revision, dry-run).

The plugin never executes arbitrary code: there is no code-evaluation

endpoint and no remote code download. “Almost everything” means an enumerated,

hand-coded, audited catalog.

• Terms of service: https://audiscale.com/en/terms

• Privacy policy: https://audiscale.com/en/privacy

Operation catalog

• SEO / <head>: meta description, SEO title, canonical, robots, Open Graph, Twitter cards, native sitemap exclusion, switching the XML sitemap back on (Yoast SEO, Rank Math, SEOPress or WordPress core)

• Redirects: create / update / delete (301, 302, 410)

• Structured data: per-content JSON-LD

• Content & media: field updates (via revision), draft creation, alternative text, status change (publish/draft only), move to trash and restore from it, listing of trashed contents, broken link fix (replace with another URL of the site, or remove the link and keep its text; block editor, classic editor, Elementor, Beaver Builder, Divi 4, WPBakery), main heading fix (add the missing h1, or demote the extra ones to h2; block and classic editor)

• Taxonomies: read the taxonomies and terms a post type declares, assign existing terms to a content (never creates a term)

• Site (read-only): robots.txt, public settings, content inventory, theme design system (global styles presets, theme supports, block patterns)

• Site (files served by WordPress, never written to disk): robots.txt, removal of a site-wide Disallow: / from it, /llms.txt

• Draft preview: short-lived signed link rendering one draft in the real theme (never published, noindex)

• Site (footer): marked HTML block printed on wp_footer (badge install / removal)

• Plugins: inventory with update availability, forced update check, update of an installed plugin (the installed version is archived first), rollback to the archived version

• Performance: preconnect / font preload hints, Google Fonts display=swap and self-hosting, removal of emojis / oEmbed / jQuery Migrate / Dashicons for visitors, script defer / async / delay until interaction, per-page removal of unused scripts and styles, scripts and styles inventory, server environment report — each one reversible, previewable before it goes live, and switched off at once from the Connection tab

• Page builders: read and update a page in the builder it is edited with (Elementor, Divi, WPBakery, Beaver Builder), and create a new page directly in that builder

• Crawl log (read-only): which pages search and AI crawlers request, with the HTTP status

• Users (optional, see below): list the site’s users, change a role, sign a user out, revoke application passwords, send WordPress’s password-reset email, require a new password at next login, disable / re-enable login, delete with post reassignment

• Connector: status, pairing, audit log

The plugin detects Yoast, Rank Math and SEOPress and stands down

automatically if one of them already manages the <head>, to avoid duplicate

tags.

Files downloaded to your site (performance features)

Only when AudiScale asks for it through a signed operation, never while a visitor

loads a page:

• Google Fonts self-hosting ( perf.fonts.set with selfHost ): the plugin

downloads the Google Fonts stylesheets the site already uses from

com and the font files they reference from

com, into wp-content/uploads/audiscale-fonts/. Visitors then

load the fonts from your own domain, so their IP address is no longer sent to

Google on each page view. No other host is contacted, and no request carries

visitor data.

• Plugin archives: once the site is paired, before any plugin update (from

AudiScale, from wp-admin or a WordPress auto-update), the installed version is

zipped into a private folder under wp-content/uploads/ (random folder and file

php in every folder, closed to web access on Apache) so it can

be restored. One archive per plugin, deleted after 90 days; its SHA-256 checksum

is verified before any restore. Nothing is archived on a site that is not paired.

Crawl log

On a paired site, the plugin records the requests of known search and AI

crawlers (Googlebot, Bingbot, Applebot, Amazonbot, GPTBot, OAI-SearchBot,

ChatGPT-User, PerplexityBot, ClaudeBot, CCBot, Bytespider, meta-externalagent):

the crawler name, whether its identity was verified, the requested path

without its query string, the HTTP status and the time. No IP address, no

User-Agent string and nothing about human visitors is stored; a request that

does not come from a known crawler is never written.

Googlebot, Bingbot, Applebot and Amazonbot are verified the way their operators

document it (reverse DNS, then forward confirmation), cached one day under a

hashed key; a request that claims one of them and fails verification is dropped.

The other crawlers publish no such domain and are recorded as declared, not

verified. The log keeps 30 days and 30,000 rows at most, can be switched off

(and emptied) from “AudiScale → Connection”, and AudiScale reads it once a day

read operation. A suggested paragraph is added

to the WordPress privacy policy guide (Settings → Privacy).

The plugin never downloads or executes code: archives are only ever reinstalled

through the WordPress upgrader, from files the site itself produced.

Remote user management (optional, off by default)

Nothing here happens until the site owner explicitly turns on “user management”

for this site in AudiScale, and AudiScale then asks the owner to approve each

change before it sends it. What AudiScale can then do, on the current site only:

• list the users: id, login, display name, email address, roles, registration

date, last login, two-factor status (Two Factor, Solid Security, WP 2FA or

Wordfence Login Security, when one of them is active), number of application

passwords, and whether the account is disabled or must choose a new password

list, list_users );

• change a user’s role ( users.role.set, promote_users, limited to the roles

the connected account may itself assign);

• sign a user out everywhere ( users.sessions.destroy, edit_users );

• revoke all of a user’s application passwords ( users.app_passwords.revoke,

edit_users);

• send WordPress’s own password-reset email to the user

send, edit_users );

• require a new password at the next login, and sign the user out

force, edit_users ) — lifted once the user resets

”;

• disable and re-enable login ( users.disable, users.enable, edit_users ):

a disabled account can log in neither with its password nor with an

application password; its content is left untouched;

• delete a user ( users.delete, delete_users; on multisite, remove_users

and the user is only removed from this site), always reassigning their posts

to another active user of the site. A deletion cannot be undone.

AudiScale never sees, sends or sets a password: a reset always goes through

WordPress’s own email and the user’s own choice. User lists are fetched on

demand and not stored by AudiScale.

Each change is logged locally in the plugin’s audit log: the operation, the

target user id, the roles or flags before and after (for a deletion, the login,

its roles and the user receiving the posts), the WordPress user AudiScale acts

as, and the time. No email address and no password is ever logged.

Safeguards, enforced by the plugin whatever AudiScale asks:

• the last administrator able to log in can be neither demoted, disabled nor

deleted;

• the account AudiScale is connected with cannot have its role changed, be

disabled, be deleted or lose its application passwords;

• on multisite, only a super admin can act on a super admin, and WordPress’s own

per-user capability checks always apply.

The login block and the forced reset live in user meta

( audiscale_login_disabled, audiscale_password_reset_required ); deactivating

or uninstalling the plugin lifts them.

External services

This plugin connects to two external services.

AudiScale

com), which this plugin is the

companion of. Nothing is sent until an administrator pairs the site. Once paired,

AudiScale sends signed operation requests to the site, and after an update the

plugin sends the installed plugin version and the site URL back to AudiScale

(one request per version).

• Terms of service: https://audiscale.com/en/terms

• Privacy policy: https://audiscale.com/en/privacy

Google Fonts

set with

selfHost), and only during that operation — never while a visitor loads a page.

com, the Google Fonts

com, the font files

those stylesheets reference. The requests carry the server’s IP address and a

browser User-Agent string (Google only serves WOFF2 files to a browser it

recognizes); they carry no visitor data and no site data beyond the stylesheet URLs.

Afterwards visitors load the fonts from the site itself, so their IP address is no

longer sent to Google.

• Google Terms of Service: https://policies.google.com/terms

• Google Privacy Policy: https://policies.google.com/privacy

• Google Fonts FAQ (privacy): https://developers.google.com/fonts/faq/privacy