Juanma Evaristo

Lock My Site is a lightweight plugin that enables remote management of your WordPress site through a secure REST API. Perfect for agencies, freelancers, and anyone managing multiple WordPress sites.
<h4>Features</h4>
<ul>
<li>Complete Health Check – Monitor site status, PHP version, memory usage, and more</li>
<li>Update Management – Manage plugins, themes, core, and translations updates remotely</li>
<li>Plugin Management – Activate, deactivate, and get detailed plugin information</li>
<li>Theme Management – Switch themes and manage theme updates</li>
<li>Database Optimization – Clean up and optimize database tables</li>
<li>Security Audit – Basic security checks and recommendations</li>
<li>Error Logs – Access PHP error logs remotely</li>
<li>User Management – List users and roles</li>
</ul>
<h4>Security</h4>
<ul>
<li>API Key authentication</li>
<li>Optional HMAC signature verification</li>
<li>Optional IP whitelist</li>
<li>Rate limiting protection</li>
<li>Automatic lockout after failed attempts</li>
<li>API key expiration (90 days)</li>
<li>Email alerts for suspicious activity</li>
<li>Activity logging</li>
</ul>
<h4>Available Endpoints</h4>
Status & Health 
* <code>GET /ping</code> – Connection check 
* <code>GET /health</code> – Complete site health status
Updates 
* <code>GET /updates</code> – Available updates (plugins, themes, core, translations) 
* <code>POST /update/plugin</code> – Update a specific plugin 
* <code>POST /update/theme</code> – Update a specific theme 
* <code>POST /update/core</code> – Update WordPress core 
* <code>POST /update/all-plugins</code> – Update all plugins 
* <code>POST /update/all-themes</code> – Update all themes 
* <code>POST /update/translations</code> – Update all translations
Plugins 
* <code>GET /plugins</code> – List all plugins 
* <code>GET /plugins/{plugin}</code> – Get plugin details 
* <code>POST /plugins/activate</code> – Activate a plugin 
* <code>POST /plugins/deactivate</code> – Deactivate a plugin 
* <code>GET /plugins/ignored</code> – List ignored plugins 
* <code>POST /plugins/ignore</code> – Ignore a plugin from bulk updates 
* <code>POST /plugins/unignore</code> – Remove plugin from ignored list
Themes 
* <code>GET /themes</code> – List all themes 
* <code>POST /themes/activate</code> – Activate a theme
Database 
* <code>GET /database/stats</code> – Database statistics 
* <code>POST /database/cleanup</code> – Clean database (revisions, drafts, spam, etc.) 
* <code>POST /database/optimize</code> – Optimize database tables
Logs 
* <code>GET /logs/php</code> – PHP error log 
* <code>GET /logs/activity</code> – Plugin activity log
Users 
* <code>GET /users</code> – List WordPress users
<h3>External services</h3>
This plugin connects to the following external services:
<h4>1. WordPress.org Checksums API</h4>
<ul>
<li>Service URL: <code>https://api.wordpress.org/core/checksums/1.0/</code></li>
<li>What it does: Retrieves the official MD5 checksums for all WordPress core files so the plugin can verify that no core file has been modified or tampered with.</li>
<li>When data is sent: Only when a core integrity check is explicitly triggered by the site administrator via the authenticated REST API endpoint <code>/security/core-integrity</code>.</li>
<li>What data is sent: The installed WordPress version number and the site locale (e.g. <code>en_US</code>). No personal data is sent.</li>
<li>Service provider: WordPress.org (Automattic Inc.)</li>
<li>Terms of use: <a href="https://wordpress.org/about/domains/" rel="ugc">WordPress.org Terms of Service</a></li>
<li>Privacy policy: <a href="https://wordpress.org/about/privacy/" rel="ugc">WordPress.org Privacy Policy</a></li>
</ul>
<h4>2. WordPress.org Translations API</h4>
<ul>
<li>Service URL: <code>https://api.wordpress.org/translations/plugins/1.0/</code>, <code>https://api.wordpress.org/translations/themes/1.0/</code>, and <code>https://api.wordpress.org/translations/core/1.0/</code></li>
<li>What it does: Returns the latest available translation package versions for plugins, themes, and WordPress core in the site’s locale, so the plugin can determine which translations need updating.</li>
<li>When data is sent: When translation updates are checked, either on demand or as part of a full updates check, explicitly triggered by the site administrator via the authenticated REST API.</li>
<li>What data is sent: Plugin/theme slugs, their version numbers, and the site locale. No personal data is sent.</li>
<li>Service provider: WordPress.org (Automattic Inc.)</li>
<li>Terms of use: <a href="https://wordpress.org/about/domains/" rel="ugc">WordPress.org Terms of Service</a></li>
<li>Privacy policy: <a href="https://wordpress.org/about/privacy/" rel="ugc">WordPress.org Privacy Policy</a></li>
</ul>
These are the only two external services this plugin connects to. No other HTTP requests are made to any third-party service.
<h4>Important note about domain name references in the source code</h4>
The plugin’s security scanner contains a hardcoded list of well-known, legitimate third-party domain names used as a local string-matching whitelist only. This list includes domains such as:
<ul>
<li>google-analytics.com, googletagmanager.com, googleapis.com</li>
<li>maps.google.com, maps.googleapis.com</li>
<li>tawk.to, crisp.chat, intercom.io, zendesk.com</li>
<li>cdn.jsdelivr.net, cdnjs.cloudflare.com, code.jquery.com, unpkg.com</li>
<li>recaptcha.net, gstatic.com</li>
</ul>
These domains are NOT contacted, called, or connected to in any way by this plugin. No HTTP requests, API calls, or any form of network communication is made to any of these domains.
The domain names appear as plain string constants in a PHP array. When the security scanner analyzes post and page content for potentially malicious script injections (e.g. <code><script src="..."></code> tags), it compares the <code>src</code> attribute against this whitelist using local string matching. Scripts referencing whitelisted domains are recognized as legitimate and excluded from the scan results, reducing false positives. The entire comparison happens locally in PHP memory — no data leaves the server.

Lock My Site

Lightweight worker plugin for remote WordPress maintenance and management via secure REST API.

HuangYe WuDeng

This plugin can save remote images in the posts to local server automatically and 
add it as an attachment to the post.
<ul>
<li>capabile with Hacklog Remote Attachment plugin and Watermark Reloaded plugin</li>
<li>admin_icon.png was modified from runescapeautotyper.com ‘s donwload icon </li>
</ul>
此插件的作用是自动保存日志中的远程图片到本地服务器并将保存后的文件作为日志的附件。
<ul>
<li>与Hacklog Remote Attachment 插件兼容性良好　</li>
<li>与Watermark Reloaded 插件兼容性良好　</li>
</ul>
@TODO 
自定义img标签图片提取正则（情景描述：有些网页的 img 的图片地址不是用src属性标注的，比如微信网页版用 data-src 来标注图片地址。） 
感谢 @守心斋 提出建议。
@待测试 
1.随机数参数url形如http://xxxx.jpg?123。导致插件不能正常下载图片 (@walkskyer) 
2.前台HTTP，HTTPS后台出现问题。无法正常显示插件页面。 (@Jakes)
@待定功能 
1.自定义img标签图片提取正则 (@守心斋) 
2.兼容SAE版WORDPRESS （@苏洋 ） 
3.自定义路径 （@mapleaf）
<ul>
<li>
2.1.0 
修复：下载类似于http://mmbiz.qpic.cn/mmbiz/xxxxxx/640?wx_fmt=jpeg&tp=webp&wxfrom=5&wx_lazy=1 
这种url的图片的时候，当文章中有多个图片，底部（后下载的）的图片会将前面的图片覆盖的bug.
</li>
<li>
2.0.9
</li>
<li>修复：远程图片url没有文件名后缀时，自动添加后缀。这样在WP文章里单独点击图片文件链接时，可避免某些服务器把没有后缀的图片文件当二进制文件下载的问题。</li>
<li>修复:Error:SyntaxError: Unexpected token {. Check your HTTP Server error log or PHP error log to see what happend. (thanks to @守心斋)</li>
<li>修复: 远程服务器图片有空格到本地 LAMP 服务器显示不出来的问题 (thanks to @再袭面包屋)</li>
<li>
修复: Notice: Undefined offset: 1 in /PATH-TO-WP-ROOT-DIR/wp-includes/vars.php on line 31 (thanks to @YYK)
</li>
<li>
2.0.0 版完全重写。相比于原来1.0.2版的插件，有非常大的改进。
</li>
<li>原来的插件是在文章更新时自动下载远程图片，如果图片非常多的话，这样容易导致执行超时或只有部分图片被下载了。</li>
<li>这次的新版采用的是ajax异步请求的方式让多个文件同时下载。效率和易用性都得到很大改善。</li>
</ul>
<h3>Arbitrary section</h3>
<pre><code>if remote server is　 unreachable OR remote server Set against hotlinking，then the image url will remain as what it is in the post.
also ,this plugin will not handel with the situation when the remote server returns 302 http status.
the ssl verify has been set to FALSE due to some reasons.
</code></pre>

Hacklog Remote Image Autosave

save remote images in the posts to local server and add it as an attachment to the post.

Lock My Site vs Hacklog Remote Image Autosave