Unifyca Audit Connector

Unifyca Audit Connector is a WordPress audit and monitoring plugin that can optionally connect to Unifyca, a WordPress Website Management and Website Documentation platform for agencies and freelancers.

Works locally.
No account required.
Connect to Unifyca only if you want centralized WordPress management and website documentation.

The plugin is designed for:

• Freelancers who maintain WordPress sites for clients and want a fast, repeatable way to review them.
• Agencies who need a consistent maintenance and reporting workflow across many WordPress installations.
• Site owners who want a clearer picture of the operational health of their site without learning the WordPress internals.

The audit logic runs entirely on your own server. No site data leaves WordPress unless you explicitly connect the site to the Unifyca SaaS (described below). You can use the plugin for free, locally, without creating an account.

Complete documentation, setup guides and screenshots:
View the documentation

What the local audit checks

Security

• WordPress debug mode (WP_DEBUG) running on production
• WordPress file editor enabled
• XML-RPC endpoint enabled
• HTTPS not enabled for the site URL
• Directory listing on the site root
• PHP execution allowed inside the uploads folder
• Sensitive files publicly accessible (e.g. wp-config.php, .env, .git/)
• Default admin username with administrator role
• New administrator users detected since the last audit
• debug.log file present in wp-content/

Maintenance

• WordPress core version outdated
• Plugin updates pending
• Active theme update pending
• Inactive plugins / inactive themes accumulating on disk
• PHP runtime older than the version WordPress currently recommends
• No backup plugin detected
• No caching plugin detected
• Maintenance mode currently active
• Expired transients accumulated in wp_options

SEO

• Search engines discouraged (Settings → Reading)
• Homepage with no H1, multiple H1s or an empty H1

Privacy & compliance

• Detection of files in the uploads directory that may carry identifying metadata (EXIF / GPS in images, author or device data in PDFs) and publicly-accessible backup files. This check is intentionally separate from the standard audit because it can be slower on large installations.

What you get for free, locally

• On-demand local audit with one click from wp-admin
• Overall website health score plus per-category scores (Security / Maintenance / SEO / Privacy)
• Severity-aware issue cards with a human explanation, why it matters and the recommended action
• Counters by severity (Critical / High / Warning / Info)
• Clean, agency-friendly dashboard styling
• No account required to use the plugin locally

What is Unifyca?

Unifyca is a WordPress Website Management platform.

It centralizes:

• WordPress maintenance
• Website monitoring
• Backups
• Website documentation
• Hosting & domains
• Credentials
• Client reports

Everything around your websites in one place.

What Unifyca SaaS adds (optional)

Manage multiple WordPress websites from one dashboard.

You can connect the site to the Unifyca SaaS at unifyca.com for centralised WordPress maintenance:

• Apply safe fixes automatically from one dashboard
• Manage every WordPress site you operate from a single screen
• Schedule Autopilot fixes inside a configurable maintenance window
• Receive uptime alerts when a site goes down
• Generate white-label maintenance reports for clients
• Keep a complete history of every audit and fix that has been applied
• Keep hosting, domains, SSL certificates and credentials documented next to each website

Connecting is fully optional. The plugin will continue running local audits even if you never create a Unifyca account.

What this plugin is not

• It is not a “set it and forget it” security shield. It detects and explains issues; it does not patch your site automatically without your action.
• It does not add anything to your pages on its own. Structured data (JSON-LD) is printed on the homepage only after an authorised Unifyca user explicitly publishes it, and it can be stopped from wp-admin at any time.
• It does not guarantee security, GDPR compliance, or freedom from vulnerabilities. The local audit helps you spot common problems and review them — it does not certify any outcome.
• It does not send telemetry. There is no anonymous usage tracking and no analytics.

External services

This plugin can optionally connect to Unifyca, a Software-as-a-Service (SaaS) platform for WordPress website management and documentation. The connection is never automatic: it requires an explicit administrator action (pasting the connection token generated by the plugin into the Unifyca dashboard). Until you do that, the plugin runs entirely locally and contacts no external service.

Service and domains

When the site is connected, the plugin communicates with the Unifyca SaaS over these domains:

• Unifyca — Website, documentation and account area.
• Unifyca App — Application/API, including the optional disconnect-feedback endpoint described below.

What the service does

Unifyca lets agencies and freelancers manage many WordPress sites from one place: it runs remote audits, applies administrator-approved fixes, runs and stores backups, monitors uptime, publishes homepage structured data when explicitly asked to, and keeps maintenance history and documentation. The connector exposes a set of HMAC-authenticated REST endpoints that the Unifyca SaaS calls to provide these features.

What data is sent, and when

• Local audits do not transmit any data externally. Running an audit from wp-admin keeps all results on your server.
• Data is sent to Unifyca only after the site is explicitly connected, and only when the SaaS initiates an authenticated (HMAC-SHA256 signed) request — there is no scheduled or background “phone home”.
• When connected, the data sent is the standard audit payload: WordPress core version, site URL, locale, timezone and multisite flag; installed plugins/themes metadata (name, slug, version, status, on-disk size, and where WordPress gets their updates from: WordPress.org slug or the host name of a declared Update URI — never code); server metadata (PHP version, memory limit, HTTPS state, WP_DEBUG and XML-RPC state, locally-resolved server IP); the WordPress Site Health diagnostic report (the same information WordPress exposes under Tools → Site Health → Info: configuration constants, database charset, directory sizes and file-system writability — with absolute server paths such as ABSPATH and WP_CONTENT_DIR removed); administrator account metadata (ID, login, email, display name, registration date and a one-way SHA-256 fingerprint of the password hash — never the hash itself); pending comment counts; and audit findings. Administrator login metadata (timestamp and IP of the last login) may be transmitted only when required for the security-monitoring features.
• Structured data publishing sends nothing from your site except a short status (whether Unifyca’s JSON-LD is being printed, its publication number and a content hash) and the homepage URL. The JSON-LD itself travels the other way, from Unifyca to your site, and only when an authorised user presses Publish. See Structured data publishing under Privacy below.
• Storage analysis (disk usage) results are sent only when an administrator runs a storage analysis from Unifyca: directory totals and a bounded list of the largest files, identified by paths relative to the WordPress folder. See Storage analysis under Privacy below for the exact data.
• Clean core replacement sends only the progress of the operation (step names and states, the WordPress version, counts of checked files, relative names of the backup copies and the recovery instructions). It downloads the official package of the installed WordPress version from https://downloads.wordpress.org and its checksums from https://api.wordpress.org — the same WordPress.org services WordPress itself uses for updates — and only when an authorised Unifyca user starts it.
• Core integrity check (read-only) sends only counts and a short list of file names relative to the WordPress folder (missing, modified or unexpected core files). It compares the installed core with the official checksums from https://api.wordpress.org (through WordPress’s own get_core_checksums()) and only runs when an authorised Unifyca user requests the final verification of a security incident. Nothing is changed, downloaded or deleted.
• Recovery point status (read-only) sends only, for each backup copy left by a clean core replacement, its relative name and whether it still exists on the server. Nothing is changed, deleted or followed through symbolic links.
• The plugin never sends database contents, post or page content, user passwords, or hosting/FTP/SSH/database credentials.

Optional disconnect feedback

When you disconnect the site from Unifyca through the Connect to Unifyca tab, the confirmation modal exposes an optional “what made you disconnect?” reason selector with a short comment field. Submitting it is never required to disconnect.

No personal user data is sent automatically. The connected site URL and the optional feedback reason/comment may be shared with Unifyca only when you explicitly submit the disconnect feedback form. The site URL is included because, in some setups, it can identify a business or organisation; we are upfront about this so you can decide whether to submit feedback at all.

If — and only if — you fill in one of those fields, the plugin sends a single non-blocking HTTPS POST to https://app.unifyca.com/ajax/wp-disconnect-feedback.php containing: the selected reason code, the optional comment (up to 500 characters), the site URL, the connection token (so Unifyca can match the entry to the correct tenant), and the plugin version.
The connection token is transformed into a non-reversible representation before storage. The connection token is never stored in its original form.

The connection token is the only stable identifier the plugin holds for the connected tenant — the handshake does not store a separate Unifyca tenant/project/site ID. The shared secret is deliberately never included in this payload.

The request is fire-and-forget: if it fails, the disconnect still completes normally. Nothing else is transmitted at this step.

Terms and privacy

• Terms of Service
• Privacy Policy= Privacy =

This plugin performs a local WordPress audit. Connecting the site to the Unifyca SaaS at unifyca.com is entirely optional and requires explicit administrator action. Local audits do not contact any external service; external communication only occurs after the administrator explicitly connects the site to Unifyca.

Data the plugin stores locally

The plugin writes a small set of options and user metas inside your WordPress database:

• unifyca_connection_token, unifyca_token_status, unifyca_shared_secret, unifyca_connection_status, unifyca_connected_at — connection state, only populated when the site is connected to Unifyca.
• unifyca_prev_admin_ids — list of administrator user IDs at the time of the last audit; used internally to detect newly added administrators between audits.
• unifyca_disable_xmlrpc — set to 1 when an administrator chose to disable XML-RPC through a connector fix action.
• unifyca_last_local_audit_at — ISO timestamp of the last local audit.
• unifyca_last_privacy_lite_scan — structured result of the last lightweight privacy review (counts and a few sample relative paths, never metadata values).
• unifyca_last_privacy_lite_scan_at — ISO timestamp of the last lightweight privacy review.
• unifyca_structured_data — structured data (JSON-LD) published from Unifyca for the homepage, with its publication number, a content hash and whether it is currently printed. Only written when an authorised Unifyca user publishes or unpublishes, or when an administrator stops the output from wp-admin.
• unifyca_core_ops — state of the last clean core replacements (at most 10): steps, WordPress version, relative names of the backup copies and whether they were deleted. Only written when an authorised Unifyca user starts a clean core replacement. The backup copies themselves live in the WordPress folder (wp-admin.unifyca-backup-*, wp-includes.unifyca-backup-*, .unifyca-core-*), are protected against web access on Apache and IIS (on nginx, deny /\.unifyca-core- and /wp-(admin|includes)\.unifyca-backup- in the server configuration) and are only deleted when an authorised user asks for it.
• unifyca_disconnect_feedback_log — rolling local log of the last 20 disconnect feedback submissions (reason code, optional comment, site URL, connection token at the time, plugin version, ISO timestamp). Only written when the administrator submits the optional disconnect feedback form. Always available for inspection via WP-CLI: wp option get unifyca_disconnect_feedback_log --format=json.
• _unifyca_last_login_at, _unifyca_last_login_ip (user metadata) — timestamp and IP of the most recent successful login for administrator users only. Used to flag suspicious administrator activity.

When the site is connected to Unifyca, this information may be transmitted to the Unifyca service to generate security alerts related to administrator account activity. The information is not used for advertising or profiling purposes.

All of the above are removed on plugin uninstall.

Data sent to Unifyca

The plugin does not transmit any data to Unifyca unless an administrator explicitly connects the site.

When connected, the plugin sends audit results and connection metadata required for the Unifyca service to operate.

Privacy scan: what is analysed and what is sent

The optional privacy scan inspects the files published in your uploads folder to report metadata that anyone downloading those files could read. The analysis happens entirely on your own server: files are opened read-only, only their metadata containers are examined (EXIF, IPTC and XMP in images, the document information dictionary and XMP block in PDFs), and the scan itself never modifies a file. Document text is not extracted, no OCR is performed, and file contents are never uploaded.

What is sent to Unifyca when the site is connected are the findings and the metadata values that were found, so that the account holder can see the evidence and show it to the site owner. Those values can include personal information that was already readable by anyone with the file, for example:

• author, artist, creator, owner, by-line and credit names;
• e-mail addresses, phone numbers and postal addresses present in image or document metadata;
• GPS coordinates, altitude and GPS timestamps;
• camera and lens make, model and serial numbers;
• creation and modification dates;
• the software used to create or edit the file;
• copyright notices and usage terms;
• document titles, subjects and keywords.

This is not a zero-knowledge design: the metadata values are stored in your Unifyca account so the audit report can display them. Values are length-limited and stripped of control characters, and the file itself never leaves your server. The transmission uses the same HMAC-signed channel as the rest of the connector.

The plugin does not send:

• WordPress user passwords.
• Hosting, FTP or SSH passwords.
• Database passwords.
• WordPress post or page contents.
• Uploaded media files, thumbnails or any part of a file’s contents — only the metadata values described above.
• Backup archives unless the administrator explicitly configures an external backup destination or uses a Unifyca backup feature that requires file transfer.

Metadata cleaning (optional, administrator-initiated)

When the site is connected, an administrator can ask Unifyca to remove the metadata from a single file reported by the privacy scan. Nothing is cleaned automatically: every clean is started by a person, one file at a time, after a confirmation.

• Only JPEG, WebP, PNG and PDF files inside the uploads folder can be cleaned. Any other location or format is refused.
• Only metadata that can be removed without changing how the file looks or renders is removed. Images are never re-encoded or recompressed, and no image library, external tool or shell command is used; PDFs are only changed when the metadata can be blanked …