About this plugin
io/), a remote website management and automation service. Its function is the connection itself: once paired, it relays authenticated, encrypted requests from your CtrlSite account so your site can be securely managed, monitored, and maintained, including AI-assisted automation, when you initiate or authorize it.
There is no local functionality independent of this connection. Without pairing, the plugin remains idle: it does not perform any actions and does not communicate with the CtrlSite service.
What CtrlSite Connector Does
After you pair your site with your CtrlSite account, this plugin exposes an authenticated, encrypted API that allows the CtrlSite service to carry out actions you initiate or authorize, such as:
- Reading and reporting site configuration, health, and update status
- Managing content, comments, and taxonomies
- Managing users and roles
- Installing, updating, activating, or removing plugins and themes
- Reading, writing, or managing files on the server, excluding writes to PHP and server-configuration files, and excluding reads of files containing site credentials or server configuration
- Inspecting database tables, running structured read-only queries, and performing database maintenance such as optimizing tables and removing orphaned or expired data
- Reading site logs
- Managing scheduled tasks (cron), hooks, and caches
- Managing media library items
- Managing WooCommerce data, if WooCommerce is installed
- Discovering and executing WordPress Abilities registered on your site
Some of these actions are privileged and can modify site code, files, the database, plugins, themes, or user accounts. These actions occur only when you have enabled and specifically requested them through your CtrlSite account; the plugin does not act on its own.
Local Controls
- Pairing / Unpairing — the connection is established through an explicit pairing step and can be revoked at any time from the plugin’s admin page, which immediately disables remote access.
- Abilities Exposure — you can choose whether registered WordPress Abilities are exposed to the CtrlSite service, and maintain a blocklist of specific abilities to exclude from discovery.
- Transport Security — communication with the CtrlSite service uses authenticated encryption, with replay protection to reject reused or expired requests.
Requirements
- An active CtrlSite account (see CtrlSite )
- A network connection between your site and the CtrlSite service
- PHP 8.2+ with the sodium and openssl extensions (bundled with PHP by default)
Multisite networks are not currently supported.
External services
io/), a remote website management and automation service, to provide its remote management and AI-assisted automation functionality.
When your site is paired with a CtrlSite account, and when you initiate or authorize an action from that account, this plugin exchanges authenticated, encrypted requests and responses with the CtrlSite service. Depending on which functions you enable and request, the data exchanged may include:
- Site configuration and health information
- Content, comments, and taxonomy data
- User and role information
- Plugin, theme, and update data
- File contents and file system data, excluding files containing site credentials or server configuration
- Database query results and table schema information
- Log file contents
- Cron, hook, and cache data
- Media library data
- WooCommerce data, if WooCommerce is installed
- Registered WordPress Abilities and their execution results
No data is sent to CtrlSite unless your site is paired and an action is initiated or authorized as described above.
This service is provided by CtrlSite:
- Terms of Service: https://ctrlsite.io/terms-and-conditions/
- Privacy Policy: https://ctrlsite.io/terms-and-conditions/
- Support: https://ctrlsite.io/