About this plugin
SiteSelf is a service that works on your WordPress site for you and reports
back in chat. This plugin is the part that lives on your site. It lets your
agent work on your theme and plugin files, settings and updates, not only on
your content.
What it can do
- Read and write files in your themes, plugins and must-use plugins folders
- Send SiteSelf a copy of those folders, so SiteSelf keeps a history of your
site’s code, and write a change from that history back on your yes
- Tell SiteSelf how the site is built: WordPress and PHP versions, theme,
plugins and host
- Read and change your site’s settings, except settings that hold a
credential and a few that are never changed (listed below)
- Update plugins, and install, update, switch and delete themes
- Make a backup of your database on your own server before a plugin or theme
is updated or deleted, and before PHP code that changes your site runs
- Clear caches
- Send SiteSelf a copy of your database and site code, and measure the
site’s size, when SiteSelf asks. SiteSelf does not use this yet.
- Run PHP code that SiteSelf sends, inside WordPress
- Keep a log of what it did, under Tools → SiteSelf
Limits
- It never sends or changes a setting whose name looks like a key, token or
password. It never changes your site’s address, who may sign up, or the
user roles.
- It writes files only inside your themes, plugins and must-use plugins
folders, and never follows a symlink out of them.
- It follows WordPress’s own file permissions, so DISALLOW_FILE_MODS,
DISALLOW_FILE_EDIT and a host that turns file changes off apply to it.
- Before it replaces a file, it keeps the previous version. It refuses PHP
files with a syntax error.
These limits apply to the plugin’s file and settings requests. PHP code that
SiteSelf sends runs as WordPress code, and these limits do not apply to it.
How access works
The plugin works only for a WordPress administrator signed in with an
application password. You create that password when you connect, and you can
revoke it at any time under Users → Profile → Application Passwords.
External services
This plugin connects your site to SiteSelf, a service run by Refact at
com. It does not work without that service.
com only when an administrator acts:
- Connect this site / Get a new key: a new application password (Connect
only), your username, the site’s addresses, its public identity key, whether
it uses Elementor, Divi, Beaver Builder or WooCommerce, whether your host
marks it as a staging copy, and the plugin version.
- Disconnect, deactivate or delete: the site’s id and addresses, the reason,
and the plugin version. No credential is sent.
Otherwise the plugin only answers requests from SiteSelf. What those requests
can return:
- How the site is built: site name, addresses, language, WordPress and PHP
versions, plugins, theme, host, server software, install path, post and page
counts, and whether file changes are allowed.
- Your themes, plugins and must-use plugins, file by file, without files that
hold credentials, repositories, logs, caches and backup archives.
- The contents of a file in those folders, a folder listing, or a setting’s
value, with credentials hidden.
- Before SiteSelf changes something, the database rows the change touches, so
SiteSelf can undo the change. These rows can hold your content and personal
data your site stores.
- Whatever PHP code SiteSelf sends prints or returns. This can be anything
WordPress can read, including your content and your users’ personal data.
- A copy of your database and site code, as described under “Site copy”
below. The database copy holds your content and the personal data your
site stores.
Site copy (not in use yet). The plugin can send SiteSelf a copy of your
php or
files that hold credentials. It can also report the size of your tables and
folders, and your free disk space. Only SiteSelf’s own systems can ask for
this. SiteSelf does not ask for it today. Each copy shows in the log under
Tools → SiteSelf.
Backups stay on your server and are never sent to SiteSelf.
com/terms
com/privacy