DecaRoy Site Helper

DecaRoy Site Helper is a minimal plugin that adds a single REST API

endpoint to read, write, and delete a Google Site Verification meta tag

that is then injected into the document <head> on every page.

The plugin is intended for sites managed programmatically by automation

tools that need to verify domain ownership in Google Search Console

without giving the automation tool FTP or filesystem access.

Features

• Single REST endpoint at /wp-json/decaroy/v1/head-meta

• GET — read current configuration

• POST — set the Google Site Verification token (validated against

Google’s expected format)

• DELETE — remove the configured token

• Token is rendered as &lt;meta name="google-site-verification"...&gt;

in the <head> via wp_head action

• No tracking, no phone-home, no remote calls

• No database tables, no cron jobs

How it works

When a token is set via POST, it is stored in a single WordPress option

( decaroy_gsc_verification_token ). On every page render, the plugin

hooks into wp_head and emits a meta tag with the token. Google can

then read that meta tag during the verification step, after which the

domain becomes available to the verifying account in Search Console.

Authentication uses standard WordPress capabilities: the requesting

user must have manage_options (typically administrators). Pair with

WordPress Application Passwords for headless authentication.