Keeps AudiScale Connector up to date automatically (this plugin only) and adds optional remote user management, off until enabled in AudiScale and approved change by change. Passwords are never seen or set.<\/p>","6.2.0":"
Reads the theme's design system (presets, patterns) so AudiScale writes contents in your theme's own style, and previews AudiScale drafts in your real theme through a short-lived signed link. Nothing is published.\nCrawl log of search and AI crawlers (no IP address, no visitor data, 30 days at most, can be switched off). Consider mentioning it in your privacy policy: a suggested paragraph is in Settings \u2192 Privacy.\nIndexNow support (key file and optional automatic ping on publish, off by default) and robots \/ canonical directives now written into Yoast SEO, Rank Math or SEOPress when one is active. Nothing changes until AudiScale applies a setting.<\/p>","6.1.0":"
Theme updates, performance settings with preview and one-click switch-off, page-builder editing, plugin rollback, read-only file integrity, malware signature, administrator account and backup checks, and an incident lockdown (sign everyone out, force an administrator password reset). On a paired site, the installed version of a plugin is archived before each plugin update so it can be restored, and each administrator's last login date is recorded; nothing else changes until AudiScale applies a setting.<\/p>","5.1.1":"
First public WordPress.org release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3633458,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3633458,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3601417,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3601417,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["5.1.1","5.2.0","5.3.0","5.3.1","5.4.0","5.5.0","5.6.0","5.7.0","5.7.1","5.8.0","5.9.0","6.0.0","6.1.0","6.2.0","6.3.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[5777,6487,726,1117,186],"plugin_category":[55],"plugin_contributors":[270706],"plugin_business_model":[],"class_list":["post-337142","plugin","type-plugin","status-publish","hentry","plugin_tags-meta-description","plugin_tags-open-graph","plugin_tags-redirects","plugin_tags-schema","plugin_tags-seo","plugin_category-seo-and-marketing","plugin_contributors-platinumwp","plugin_committers-platinumwp"],"banners":{"banner":"https:\/\/ps.w.org\/audiscale-connector\/assets\/banner-772x250.png?rev=3601417","banner_2x":"https:\/\/ps.w.org\/audiscale-connector\/assets\/banner-1544x500.png?rev=3601417","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/audiscale-connector\/assets\/icon-128x128.png?rev=3633458","icon_2x":"https:\/\/ps.w.org\/audiscale-connector\/assets\/icon-256x256.png?rev=3633458","generated":false},"screenshots":[],"raw_content":"\n
AudiScale Connector is the companion component for the hosted AudiScale service (https:\/\/audiscale.com). It unlocks the SEO actions that WordPress core and the standard REST API do not allow \u2014 most notably printing a This plugin communicates with the third-party AudiScale service. No data is\nsent until you have explicitly paired<\/strong> your site from your AudiScale dashboard.\nOnce paired, AudiScale can remotely apply a fixed catalog of operations<\/strong>\n(listed below), each of which is:<\/p>\n\n The plugin never executes arbitrary code<\/strong>: there is no code-evaluation\nendpoint and no remote code download. \"Almost everything\" means an enumerated,\nhand-coded, audited catalog.<\/p>\n\n The plugin detects Yoast, Rank Math and SEOPress and stands down<\/strong>\nautomatically if one of them already manages the Only when AudiScale asks for it through a signed operation, never while a visitor\nloads a page:<\/p>\n\n On a paired site, the plugin records the requests of known search and AI\ncrawlers (Googlebot, Bingbot, Applebot, Amazonbot, GPTBot, OAI-SearchBot,\nChatGPT-User, PerplexityBot, ClaudeBot, CCBot, Bytespider, meta-externalagent):\nthe crawler name, whether its identity was verified, the requested path\nwithout its query string, the HTTP status and the time. No IP address, no\nUser-Agent string and nothing about human visitors is stored<\/strong>; a request that\ndoes not come from a known crawler is never written.<\/p>\n\n Googlebot, Bingbot, Applebot and Amazonbot are verified the way their operators\ndocument it (reverse DNS, then forward confirmation), cached one day under a\nhashed key; a request that claims one of them and fails verification is dropped.\nThe other crawlers publish no such domain and are recorded as declared, not\nverified. The log keeps 30 days and 30,000 rows at most, can be switched off\n(and emptied) from \"AudiScale \u2192 Connection\", and AudiScale reads it once a day\nthrough the signed The plugin never downloads or executes code: archives are only ever reinstalled\nthrough the WordPress upgrader, from files the site itself produced.<\/p>\n\n Nothing here happens until the site owner explicitly turns on \"user management\"\nfor this site in AudiScale, and AudiScale then asks the owner to approve each\nchange before it sends it. What AudiScale can then do, on the current site only:<\/p>\n\n AudiScale never sees, sends or sets a password<\/strong>: a reset always goes through\nWordPress's own email and the user's own choice. User lists are fetched on\ndemand and not stored by AudiScale.<\/p>\n\n Each change is logged locally in the plugin's audit log: the operation, the\ntarget user id, the roles or flags before and after (for a deletion, the login,\nits roles and the user receiving the posts), the WordPress user AudiScale acts\nas, and the time. No email address and no password is ever logged.<\/p>\n\n Safeguards, enforced by the plugin whatever AudiScale asks:<\/p>\n\n The login block and the forced reset live in user meta\n( This plugin connects to two external services.<\/p>\n\n The hosted AudiScale service (https:\/\/audiscale.com), which this plugin is the\ncompanion of. Nothing is sent until an administrator pairs the site. Once paired,\nAudiScale sends signed operation requests to the site, and after an update the\nplugin sends the installed plugin version and the site URL back to AudiScale\n(one request per version).<\/p>\n\n Used only when AudiScale turns on Google Fonts self-hosting ( To revoke access at any time: \"Settings \u2192 AudiScale \u2192 Disconnect\", or disconnect\nthe site from AudiScale.<\/p>\n\n\n No. No communication happens until the site is paired, and pairing requires an\nadministrator ( AudiScale Connector detects Yoast \/ Rank Math \/ SEOPress and prints nothing in\nthe Unpairing erases the pairing secret: the command channel becomes inert\nimmediately. It also switches off every performance setting AudiScale applied.<\/p><\/dd>\n \"AudiScale \u2192 Connection \u2192 Switch off AudiScale optimizations\" removes them at\nonce, without AudiScale. Deactivating the plugin removes them too: they are\napplied while pages load, nothing is written into your theme or plugin files.<\/p><\/dd>\n The archives live in a folder with a random name and random file names, with an\n index.php in every folder, and an No. Remote user management is off until you enable it for the site in AudiScale,\nand every change needs your approval there. Even then AudiScale can only send\nWordPress's own password-reset email or require a new password at the next\nlogin: the password is always chosen by the user, and is never read, sent or\nlogged.<\/p><\/dd>\n The plugin's options, its pending proposals, its audit and crawl log tables, the self-hosted\nGoogle Fonts and the plugin archives, and any login block or forced password reset it set\non user accounts. Your content, media, users and plugins are left as they are.<\/p><\/dd>\n\n<\/dl>\n\n\n<meta name=\"description\"><\/code> tag in the <head><\/code> without forcing you to install another SEO plugin.<\/p>\n\nService disclosure (SaaS)<\/h4>\n\n
\n
manage_options<\/code>);<\/li>\n\n
Operation catalog<\/h4>\n\n
\n
<head><\/code>: meta description, SEO title, canonical, robots, Open Graph, Twitter cards, native sitemap exclusion<\/li>\nwp_footer<\/code> (badge install \/ removal)<\/li>\ndisplay=swap<\/code> and self-hosting, removal of emojis \/ oEmbed \/ jQuery Migrate \/ Dashicons for visitors, script defer \/ async \/ delay until interaction, per-page removal of unused scripts and styles, scripts and styles inventory, server environment report \u2014 each one reversible, previewable before it goes live, and switched off at once from the Connection tab<\/li>\n<head><\/code>, to avoid duplicate\ntags.<\/p>\n\nFiles downloaded to your site (performance features)<\/h4>\n\n
\n
perf.fonts.set<\/code> with selfHost<\/code>): the plugin\ndownloads the Google Fonts stylesheets the site already uses from\n fonts.googleapis.com and the font files they reference from\n fonts.gstatic.com, into wp-content\/uploads\/audiscale-fonts\/<\/code>. Visitors then\nload the fonts from your own domain, so their IP address is no longer sent to\nGoogle on each page view. No other host is contacted, and no request carries\nvisitor data.<\/li>\nwp-content\/uploads\/<\/code> (random folder and file\nnames, an index.php<\/code> in every folder, closed to web access on Apache) so it can\nbe restored. One archive per plugin, deleted after 90 days; its SHA-256 checksum\nis verified before any restore. Nothing is archived on a site that is not paired.<\/li>\n<\/ul>\n\nCrawl log<\/h4>\n\n
crawl.log.read<\/code> operation. A suggested paragraph is added\nto the WordPress privacy policy guide (Settings \u2192 Privacy).<\/p>\n\nRemote user management (optional, off by default)<\/h4>\n\n
\n
users.list<\/code>, list_users<\/code>);<\/li>\nusers.role.set<\/code>, promote_users<\/code>, limited to the roles\nthe connected account may itself assign);<\/li>\nusers.sessions.destroy<\/code>, edit_users<\/code>);<\/li>\nusers.app_passwords.revoke<\/code>,\n edit_users);<\/li>\nusers.password_reset.send<\/code>, edit_users<\/code>);<\/li>\nusers.password_reset.force<\/code>, edit_users<\/code>) \u2014 lifted once the user resets\ntheir password through \"Lost your password?\";<\/li>\nusers.disable<\/code>, users.enable<\/code>, edit_users<\/code>):\na disabled account can log in neither with its password nor with an\napplication password; its content is left untouched;<\/li>\nusers.delete<\/code>, delete_users<\/code>; on multisite, remove_users<\/code>\nand the user is only removed from this site), always reassigning their posts\nto another active user of the site. A deletion cannot be undone.<\/li>\n<\/ul>\n\n\n
audiscale_login_disabled<\/code>, audiscale_password_reset_required<\/code>); deactivating\nor uninstalling the plugin lifts them.<\/p>\n\nExternal services<\/h3>\n\n
AudiScale<\/h4>\n\n
\n
Google Fonts<\/h4>\n\n
perf.fonts.set<\/code> with\n selfHost), and only during that operation \u2014 never while a visitor loads a page.\nThe site's server requests, from fonts.googleapis.com<\/code>, the Google Fonts\nstylesheets the site already loads, then, from fonts.gstatic.com<\/code>, the font files\nthose stylesheets reference. The requests carry the server's IP address and a\nbrowser User-Agent string (Google only serves WOFF2 files to a browser it\nrecognizes); they carry no visitor data and no site data beyond the stylesheet URLs.\nAfterwards visitors load the fonts from the site itself, so their IP address is no\nlonger sent to Google.<\/p>\n\n\n
\n
POST \/wp-json\/audiscale\/v1\/pair<\/code> with a secret generated on the AudiScale side.<\/li>\n\n
Does the plugin send data without my consent?<\/h3><\/dt>\n
manage_options<\/code>).<\/p><\/dd>\nWhat happens if I already have an SEO plugin?<\/h3><\/dt>\n
<head><\/code> to avoid duplicates.<\/p><\/dd>\nHow do I revoke access?<\/h3><\/dt>\n
How do I switch off the performance optimizations?<\/h3><\/dt>\n
My server runs nginx: are the plugin archives protected?<\/h3><\/dt>\n
.htaccess<\/code> that Apache honors. nginx ignores\n .htaccess, so add this rule to the site's server block:<\/p>\n\nlocation ~* \/wp-content\/uploads\/audiscale-backup- { deny all; }\n<\/code><\/pre><\/dd>\nCan AudiScale see or change my users' passwords?<\/h3><\/dt>\n
What does uninstalling remove?<\/h3><\/dt>\n
6.3.0<\/h4>\n\n
\n
connector.self_auto_update.set<\/code> operation (update_plugins<\/code>): turns\nWordPress's own auto-update on or off for AudiScale Connector only, through\nthe standard per-plugin setting. The auto-update setting of your other plugins\nis never read for anything else nor changed. A constant or an\n auto_update_plugin filter set on the site keeps the last word.<\/li>\nconnector.self_update.run<\/code> operation (update_plugins<\/code>): updates AudiScale\nConnector itself to the latest release now, exactly like a plugin update\n(previous version archived first, reactivated after the update). Does nothing\nwhen it is already up to date.<\/li>\n\/status<\/code> now reports whether AudiScale Connector is auto-updated\n(selfAutoUpdate<\/code>).<\/li>\nusers.list<\/code> (list_users<\/code>),\n users.role.set (promote_users<\/code>), users.sessions.destroy<\/code>,\n users.app_passwords.revoke, users.password_reset.send<\/code>,\n users.password_reset.force, users.disable<\/code>, users.enable<\/code> (edit_users<\/code>)\nand users.delete<\/code> (delete_users<\/code>; remove_users<\/code> on multisite, where the user\nis only removed from the current site). Each also checks WordPress's per-user\ncapability, and each change is logged with roles, flags and counts only \u2014\nnever an email address or a password.<\/li>\n6.2.0<\/h4>\n\n
\n
site.design_system.get<\/code> operation (edit_posts<\/code>): the active\ntheme's global styles presets (color palette, font sizes, font families,\nspacing sizes, content and wide widths), its theme support flags, its block\npatterns (core patterns excluded) and the synced and unsynced patterns saved\non the site. AudiScale uses them to write contents with the theme's own preset\nclasses and components instead of fixed values. Nothing is written.<\/li>\ncontent.preview_link<\/code> operation (edit_posts<\/code>, plus the right to edit the\ncontent): a signed front URL, valid 30 minutes at most, that renders one draft\nor pending content in the real theme \u2014 uncached and noindex. Without a valid\ntoken the draft stays invisible to visitors; private and scheduled contents are\nnever revealed. Nothing is published.<\/li>\ncrawl.log.read<\/code> operation (cursor-paged, manage_options<\/code>).<\/li>\nsite.robots_txt.get<\/code> now also says whether a physical robots.txt file shadows\nthe value the plugin manages.<\/li>\nindexnow.key.set<\/code>,\n indexnow.state.get, indexnow.auto_ping.set<\/code>, indexnow.key.clear<\/code>, all\n manage_options). The key is served as plain text at \/<key>.txt<\/code> on your\nsite; nothing else is served. When automatic pings are on, publishing a\npublic content, or updating a published one, sends its URL to api.indexnow.org\n(Bing, Yandex, Seznam, Naver) in the background, at most once a minute per\nURL. Password-protected contents, revisions and non-public types are never\nsent. Off by default, and removed on uninstall.<\/li>\nseo.robots.set<\/code> and seo.canonical.set<\/code> now write into the active SEO\nplugin's own fields (Yoast SEO, Rank Math, SEOPress) so the directive really\nappears on the page. A change proposed in draft mode is still not applied\nuntil approved.<\/li>\n<\/ul>\n\n6.1.0<\/h4>\n\n
\n
manage_options<\/code>:\n security.files.scan walks plugins, themes, mu-plugins and uploads in short\nresumable slices (about 3 seconds, 400 files at most per call, resumed from a\ncursor) and reports each code file's md5, size and date, plus malware\nsignature matches with a short excerpt. Images and other media are never read.\n security.inside.audit reports administrator accounts (login, last login,\napplication password dates \u2014 never a password or its hash), the active backup\nplugin and its last backup date, and malware signatures in autoloaded options.<\/li>\nmanage_options<\/code>:\n security.sessions.destroy_all signs every user out (not reversible), and\n security.admins.password_reset.force signs administrators out and refuses\ntheir next login until they choose a new password through \"Lost your\npassword?\" (security.admins.password_reset.clear<\/code> lifts it). The flag is the\nuser meta audiscale_password_reset_required<\/code>, removed once the password is\nreset and on uninstall. wp-config.php is never written: regenerating the\nauthentication salts stays a manual step.<\/li>\nthemes.list<\/code> (update offered by the site's own index), themes.update<\/code>\n(Theme_Upgrader, logged) and themes.activate<\/code> (returns the previous theme, the\ncall that undoes it). WordPress core REST offers no theme write.<\/li>\nperf.*<\/code> operations, performance<\/code> capability token):\npreconnect and font preload hints, Google Fonts display=swap<\/code> and\nself-hosting, removal of emojis \/ oEmbed \/ jQuery Migrate \/ Dashicons for\nvisitors, script defer \/ async (WordPress script strategies when available) and\ndelay until the first interaction, per-page removal of unused scripts and\nstyles (keepOn<\/code> keeps them on some pages, onlyOn<\/code> removes them only there), scripts and styles inventory, server environment report. All of them\nare applied while pages load and stored in the plugin's own options \u2014 nothing is\nwritten into WordPress content or files, and the stock state hooks nothing.<\/li>\npublishMode<\/code> (draft by default), dryRun<\/code>, returns the\nexact call that undoes it, and is logged. A draft is only rendered for a\nrequest carrying a signed, 30-minute preview token (never cached, never\nindexed, identified by an X-AudiScale-Preview<\/code> header); a visitor never sees\nit. perf.promote<\/code> \/ perf.discard<\/code> \/ perf.reset<\/code> manage the lifecycle.<\/li>\nX-AudiScale-Preview-Assets<\/code> whether that generation worked.<\/li>\nunfiltered_html<\/code>), as Elementor itself requires \u2014 including when a pending\nchange is approved from the \"Pending\" screen.<\/li>\nbuilder.data.get<\/code>, builder.data.update<\/code>,\n builder.data.discard): read and update a page in the builder it is edited\nwith \u2014 Elementor, Divi, WPBakery, Beaver Builder \u2014 with each builder's own\nstorage, a draft\/approval cycle, and a refusal when the page changed since it\nwas read. Oxygen and Bricks are detected and refused. Beaver layouts are read\nwithout instantiating any class other than stdClass<\/code>.<\/li>\n_wpb_shortcodes_custom_css<\/code> exactly as\nWPBakery does when a page is saved in its editor, so design options apply\nwithout re-saving the page.<\/li>\nbuilder.data.get<\/code> and perf.environment.get<\/code> report whether the\nFlexbox Container feature is active; a document built with containers is\nrefused while it is not (Elementor would render nothing).<\/li>\ncontent.create_draft<\/code> accepts builder<\/code> + builderData<\/code> to create a new page\ndirectly in the site's builder (content.create_draft.builder<\/code> token).\nUnchanged without them.<\/li>\nplugins.update<\/code> archives the installed version first, and so does every\nplugin update WordPress runs (wp-admin, auto-updates). New plugins.rollback<\/code>\noperation reinstalls that archive and reactivates the plugin; a rollback can\nitself be rolled back. Archives live in a private folder, one per plugin,\npurged after 90 days, 1 GB cap.<\/li>\ncontent.update_fields<\/code> in draft mode returns pendingHash<\/code>, the fingerprint\nthe preview echoes.<\/li>\n<\/ul>\n\n5.9.0<\/h4>\n\n
\n
content.untrash<\/code> operation (edit_posts<\/code> capability): restores a page or a\npost from the WordPress trash. Until now AudiScale could move a content to the\ntrash but never take it back out, so a content it had trashed had to be restored\nby hand in wp-admin. It calls wp_untrash_post()<\/code> and nothing else, and replaying\nit on a content that is not in the trash reports \"nothing to do\" instead of an\nerror, exactly as content.trash<\/code> does on a content already trashed.<\/li>\ndraft<\/code> \u2014 not to the status it had\nbefore it was trashed \u2014 unless the site filters wp_untrash_post_status<\/code>. So the\noutcome cannot be deduced from the WordPress version, and the plugin reads it\nback after the write: after<\/code> is the observed status, previousStatus<\/code> the one\nthe content had when it was trashed, and restoredToPreviousStatus<\/code> says whether\na page that was published is readable again or is now a draft.<\/li>\ncontent.trashed.list<\/code> operation (edit_posts<\/code> capability, read-only): lists\nthe trashed contents with their id, title, type, trash date and previous status.\nA trashed content answers no URL any more, so this is the only way to name the\ncontent to restore. Media are out of scope, like everywhere else: WordPress does\nnot trash an attachment, it deletes it and its files for good.<\/li>\n<\/ul>\n\n5.8.0<\/h4>\n\n
\n
taxonomy.list<\/code> operation (edit_posts<\/code> capability, read-only): lists the\ntaxonomies that apply to a post type \u2014 categories, tags, and any custom one the\nsite declares \u2014 and, on request, one bounded page of their terms. AudiScale\nreads it so it can only ever propose a term that exists.<\/li>\ncontent.terms.assign<\/code> operation (manage_options<\/code> capability): files a page\nor a post under existing terms. It adds<\/strong> by default: assigning one category\nno longer removes the others, and clearing the existing terms requires spelling\nout mode: \"replace\"<\/code>. It never creates a term<\/strong>: an unknown one is refused and\nreported, so a near-duplicate (\"Actualit\u00e9s\" on a site holding \"Actualit\u00e9\") is\nnever silently created. The complete previous set of terms is written to the\naudit log, and the recorded result is re-read after the write, so it shows the\ndefault category WordPress reassigns to a post left without one.<\/li>\ncontent.trash<\/code> operation (delete_posts<\/code> capability): moves a page or a post\nto the WordPress trash, from where you can restore it. Until now a draft created\nfrom AudiScale could not be removed from AudiScale. Nothing is ever deleted\npermanently: if the trash is disabled on your site the operation is refused\ninstead of destroying the content, and media are out of scope \u2014 WordPress does\nnot trash an attachment, it deletes it and its files for good.<\/li>\npromote<\/code> operation now also approves a page body prepared in draft mode\n(field: \"content\"<\/code>). It previously handled SEO fields only, so a body drafted by\nAudiScale could be approved from WordPress and nowhere else.<\/li>\ncontent.set_page_template<\/code> now honours publishMode<\/code> like every other content\noperation: by default the new template waits on the \"Pending\" screen instead of\nbeing applied to the live site immediately.<\/li>\ncontent.status.set<\/code> and content.trash<\/code> now refuse to unpublish or trash the\npage used as the front page or as the posts page, which would leave the site\nwithout an entry point.<\/li>\n?p=<\/code>,\n ?page_id=, ?attachment_id=<\/code> \u2014 the three WordPress itself honours), then the\nsite's own rewrite rules, then the site root, and refuses otherwise with\n audiscale_url_needs_post_id (404). The slug fallback that used to search the\npath against every content type is removed<\/strong>: a slug read off a crawled URL\nnames the right content only by luck, and every way it named a wrong one ended in\na success on content nobody aimed at \u2014 on a shop holding both a page and a product\nnamed \"contact\", the write landed on whichever the database returned last. A URL\nwhose path WordPress does not resolve now needs an explicit content id; AudiScale\nresolves the target on its side and sends it.<\/li>\nsite_url()<\/code> and the audiscale_trusted_hosts<\/code> filter, and\ninternationalized domains, punycode and a trailing dot compare equal.<\/li>\n