About this plugin
AI site builders produce a polished Vite/React + Tailwind site in minutes, exported as a ZIP. Esipher turns that export into a real, activatable theme. The core conversion – extraction, parsing, asset rewriting, theme generation and installation – runs entirely on your own server: no third-party upload service, no external API call.
Developed by Samuel Olaosebikan and Moses Adebayo.
Work from the admin screen (Esipher in wp-admin) or from WP-CLI ( wp esipher convert ).
Two optional features connect to third-party APIs, and only when you set them up (see “External services” below):
- Esipher > Connected Projects – connect your own GitHub account and repo. GitHub rebuilds on every push and Esipher shows an “Apply update” button; an administrator clicks it to update the theme. Nothing is installed or activated without that click.
- Esipher > Mobile App – Esipher generates a build project in a GitHub repo you own; GitHub Actions builds a native Android (and, optionally, iOS) app from your site.
This is an early development build; per-builder adapters beyond the generic fallback and a conversion history/rollback screen are still to come.
What does not convert
- Supabase-backed auth, database reads/writes, and live data – detected and reported, never silently dropped.
- Client-side routing beyond what exists in the built HTML.
- Custom component layouts (cards, nav bars, icons) – these display exactly as exported, but aren’t broken into individually editable pieces yet. Headings, paragraphs, and images within multi-page conversions are: they come through as real, native Block Editor blocks.
External services
The core “upload a ZIP and get a theme” flow makes no external requests. The features below
do, and only after you enable them and provide your own credentials. You can use the plugin
indefinitely without ever touching them.
GitHub (github.com, api.github.com)
Used by Connected Projects and Mobile App. When you connect a repo, sync, or build an
app, the plugin talks to the GitHub REST API as your own GitHub account, using an OAuth access
token you obtain by authorising your own GitHub OAuth App. It sends: that access token, the
repository owner and name you enter, the contents of the build workflow file it commits into
your repo, webhook configuration (including a random shared secret), Actions repository
secrets and variables it sets for the build, and, for the Mobile App feature, an
App-Store-Connect-signed certificate request routed to Apple (see below). It downloads the
build artifacts your workflow produces. The OAuth sign-in also redirects your browser to
com. For Connected Projects, GitHub also calls this site’s REST route
( /wp-json/esipher/v1/github-webhook ) when a build finishes; the request is verified with the
webhook’s shared secret and only records that an update is ready. Nothing is sent to GitHub
unless you have connected an account.
com/en/site-policy/github-terms/github-terms-of-service
com/en/site-policy/privacy-policies/github-general-privacy-statement
Apple App Store Connect (api.appstoreconnect.apple.com)
Used by the Mobile App feature only, and only if you fill in the iOS fields (Apple Team
p8 key). When you save those and start an
iOS build, the plugin calls the App Store Connect API, authenticating with a short-lived
p8 key. It sends: a certificate signing request
(to obtain an Apple Distribution certificate), your app’s bundle identifier (to register it
if needed), and a request to create an App Store provisioning profile. It receives the
certificate and provisioning profile, which are stored encrypted on your site and set as
GitHub Actions secrets for the build. No request is made to Apple unless you provide an App
Store Connect API key.
com/legal/internet-services/itunes/
com/legal/privacy/
Original project image hosting (on by default, can be switched off)
The multi-page conversion option “Try to recover cloud-hosted images from the original
project” (and the WP-CLI --recover-images flag, which stays opt-in) fetches image files from the URL your AI
com
address derived from a descriptor file inside your own export). The request sends only a normal
HTTP GET for each image path, so the host sees your site’s IP address. This happens only when that
setting is on, and only for images your export references but did not bundle. It is ticked by default on
the Convert and Connected Projects screens; untick it to make no request to that host. No other
request is made to that host. This service is provided by Lovable.
dev/terms
dev/privacy