Performance settings with preview and one-click switch-off, page-builder editing, plugin rollback. On a paired site, the installed version of a plugin is now archived before each plugin update so it can be restored; nothing else changes until AudiScale applies a setting.<\/p>","5.1.1":"
First public WordPress.org release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3633458,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3633458,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3601417,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3601417,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["5.1.1","5.2.0","5.3.0","5.3.1","5.4.0","5.5.0","5.6.0","5.7.0","5.7.1","5.8.0","5.9.0","6.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[5777,6487,726,1117,186],"plugin_category":[55],"plugin_contributors":[270706],"plugin_business_model":[],"class_list":["post-337142","plugin","type-plugin","status-publish","hentry","plugin_tags-meta-description","plugin_tags-open-graph","plugin_tags-redirects","plugin_tags-schema","plugin_tags-seo","plugin_category-seo-and-marketing","plugin_contributors-platinumwp","plugin_committers-platinumwp"],"banners":{"banner":"https:\/\/ps.w.org\/audiscale-connector\/assets\/banner-772x250.png?rev=3601417","banner_2x":"https:\/\/ps.w.org\/audiscale-connector\/assets\/banner-1544x500.png?rev=3601417","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/audiscale-connector\/assets\/icon-128x128.png?rev=3633458","icon_2x":"https:\/\/ps.w.org\/audiscale-connector\/assets\/icon-256x256.png?rev=3633458","generated":false},"screenshots":[],"raw_content":"\n
AudiScale Connector is the companion component for the hosted AudiScale service (https:\/\/audiscale.com). It unlocks the SEO actions that WordPress core and the standard REST API do not allow \u2014 most notably printing a This plugin communicates with the third-party AudiScale service. No data is\nsent until you have explicitly paired<\/strong> your site from your AudiScale dashboard.\nOnce paired, AudiScale can remotely apply a fixed catalog of operations<\/strong>\n(listed below), each of which is:<\/p>\n\n The plugin never executes arbitrary code<\/strong>: there is no code-evaluation\nendpoint and no remote code download. \"Almost everything\" means an enumerated,\nhand-coded, audited catalog.<\/p>\n\n The plugin detects Yoast, Rank Math and SEOPress and stands down<\/strong>\nautomatically if one of them already manages the Only when AudiScale asks for it through a signed operation, never while a visitor\nloads a page:<\/p>\n\n The plugin never downloads or executes code: archives are only ever reinstalled\nthrough the WordPress upgrader, from files the site itself produced.<\/p>\n\n This plugin connects to two external services.<\/p>\n\n The hosted AudiScale service (https:\/\/audiscale.com), which this plugin is the\ncompanion of. Nothing is sent until an administrator pairs the site. Once paired,\nAudiScale sends signed operation requests to the site, and after an update the\nplugin sends the installed plugin version and the site URL back to AudiScale\n(one request per version).<\/p>\n\n Used only when AudiScale turns on Google Fonts self-hosting ( To revoke access at any time: \"Settings \u2192 AudiScale \u2192 Disconnect\", or disconnect\nthe site from AudiScale.<\/p>\n\n\n No. No communication happens until the site is paired, and pairing requires an\nadministrator ( AudiScale Connector detects Yoast \/ Rank Math \/ SEOPress and prints nothing in\nthe Unpairing erases the pairing secret: the command channel becomes inert\nimmediately. It also switches off every performance setting AudiScale applied.<\/p><\/dd>\n \"AudiScale \u2192 Connection \u2192 Switch off AudiScale optimizations\" removes them at\nonce, without AudiScale. Deactivating the plugin removes them too: they are\napplied while pages load, nothing is written into your theme or plugin files.<\/p><\/dd>\n The archives live in a folder with a random name and random file names, with an\n index.php in every folder, and an The plugin's options, its pending proposals, its audit table, the self-hosted\nGoogle Fonts and the plugin archives. Your content, media and plugins are left\nas they are.<\/p><\/dd>\n\n<\/dl>\n\n\n<meta name=\"description\"><\/code> tag in the <head><\/code> without forcing you to install another SEO plugin.<\/p>\n\nService disclosure (SaaS)<\/h4>\n\n
\n
manage_options<\/code>);<\/li>\n\n
Operation catalog<\/h4>\n\n
\n
<head><\/code>: meta description, SEO title, canonical, robots, Open Graph, Twitter cards, native sitemap exclusion<\/li>\nwp_footer<\/code> (badge install \/ removal)<\/li>\ndisplay=swap<\/code> and self-hosting, removal of emojis \/ oEmbed \/ jQuery Migrate \/ Dashicons for visitors, script defer \/ async \/ delay until interaction, per-page removal of unused scripts and styles, scripts and styles inventory, server environment report \u2014 each one reversible, previewable before it goes live, and switched off at once from the Connection tab<\/li>\n<head><\/code>, to avoid duplicate\ntags.<\/p>\n\nFiles downloaded to your site (performance features)<\/h4>\n\n
\n
perf.fonts.set<\/code> with selfHost<\/code>): the plugin\ndownloads the Google Fonts stylesheets the site already uses from\n fonts.googleapis.com and the font files they reference from\n fonts.gstatic.com, into wp-content\/uploads\/audiscale-fonts\/<\/code>. Visitors then\nload the fonts from your own domain, so their IP address is no longer sent to\nGoogle on each page view. No other host is contacted, and no request carries\nvisitor data.<\/li>\nwp-content\/uploads\/<\/code> (random folder and file\nnames, an index.php<\/code> in every folder, closed to web access on Apache) so it can\nbe restored. One archive per plugin, deleted after 90 days; its SHA-256 checksum\nis verified before any restore. Nothing is archived on a site that is not paired.<\/li>\n<\/ul>\n\nExternal services<\/h3>\n\n
AudiScale<\/h4>\n\n
\n
Google Fonts<\/h4>\n\n
perf.fonts.set<\/code> with\n selfHost), and only during that operation \u2014 never while a visitor loads a page.\nThe site's server requests, from fonts.googleapis.com<\/code>, the Google Fonts\nstylesheets the site already loads, then, from fonts.gstatic.com<\/code>, the font files\nthose stylesheets reference. The requests carry the server's IP address and a\nbrowser User-Agent string (Google only serves WOFF2 files to a browser it\nrecognizes); they carry no visitor data and no site data beyond the stylesheet URLs.\nAfterwards visitors load the fonts from the site itself, so their IP address is no\nlonger sent to Google.<\/p>\n\n\n
\n
POST \/wp-json\/audiscale\/v1\/pair<\/code> with a secret generated on the AudiScale side.<\/li>\n\n
Does the plugin send data without my consent?<\/h3><\/dt>\n
manage_options<\/code>).<\/p><\/dd>\nWhat happens if I already have an SEO plugin?<\/h3><\/dt>\n
<head><\/code> to avoid duplicates.<\/p><\/dd>\nHow do I revoke access?<\/h3><\/dt>\n
How do I switch off the performance optimizations?<\/h3><\/dt>\n
My server runs nginx: are the plugin archives protected?<\/h3><\/dt>\n
.htaccess<\/code> that Apache honors. nginx ignores\n .htaccess, so add this rule to the site's server block:<\/p>\n\nlocation ~* \/wp-content\/uploads\/audiscale-backup- { deny all; }\n<\/code><\/pre><\/dd>\nWhat does uninstalling remove?<\/h3><\/dt>\n
6.0.0<\/h4>\n\n
\n
perf.*<\/code> operations, performance<\/code> capability token):\npreconnect and font preload hints, Google Fonts display=swap<\/code> and\nself-hosting, removal of emojis \/ oEmbed \/ jQuery Migrate \/ Dashicons for\nvisitors, script defer \/ async (WordPress script strategies when available) and\ndelay until the first interaction, per-page removal of unused scripts and\nstyles (keepOn<\/code> keeps them on some pages, onlyOn<\/code> removes them only there), scripts and styles inventory, server environment report. All of them\nare applied while pages load and stored in the plugin's own options \u2014 nothing is\nwritten into WordPress content or files, and the stock state hooks nothing.<\/li>\npublishMode<\/code> (draft by default), dryRun<\/code>, returns the\nexact call that undoes it, and is logged. A draft is only rendered for a\nrequest carrying a signed, 30-minute preview token (never cached, never\nindexed, identified by an X-AudiScale-Preview<\/code> header); a visitor never sees\nit. perf.promote<\/code> \/ perf.discard<\/code> \/ perf.reset<\/code> manage the lifecycle.<\/li>\nX-AudiScale-Preview-Assets<\/code> whether that generation worked.<\/li>\nunfiltered_html<\/code>), as Elementor itself requires \u2014 including when a pending\nchange is approved from the \"Pending\" screen.<\/li>\nbuilder.data.get<\/code>, builder.data.update<\/code>,\n builder.data.discard): read and update a page in the builder it is edited\nwith \u2014 Elementor, Divi, WPBakery, Beaver Builder \u2014 with each builder's own\nstorage, a draft\/approval cycle, and a refusal when the page changed since it\nwas read. Oxygen and Bricks are detected and refused. Beaver layouts are read\nwithout instantiating any class other than stdClass<\/code>.<\/li>\n_wpb_shortcodes_custom_css<\/code> exactly as\nWPBakery does when a page is saved in its editor, so design options apply\nwithout re-saving the page.<\/li>\nbuilder.data.get<\/code> and perf.environment.get<\/code> report whether the\nFlexbox Container feature is active; a document built with containers is\nrefused while it is not (Elementor would render nothing).<\/li>\ncontent.create_draft<\/code> accepts builder<\/code> + builderData<\/code> to create a new page\ndirectly in the site's builder (content.create_draft.builder<\/code> token).\nUnchanged without them.<\/li>\nplugins.update<\/code> archives the installed version first, and so does every\nplugin update WordPress runs (wp-admin, auto-updates). New plugins.rollback<\/code>\noperation reinstalls that archive and reactivates the plugin; a rollback can\nitself be rolled back. Archives live in a private folder, one per plugin,\npurged after 90 days, 1 GB cap.<\/li>\ncontent.update_fields<\/code> in draft mode returns pendingHash<\/code>, the fingerprint\nthe preview echoes.<\/li>\n<\/ul>\n\n5.9.0<\/h4>\n\n
\n
content.untrash<\/code> operation (edit_posts<\/code> capability): restores a page or a\npost from the WordPress trash. Until now AudiScale could move a content to the\ntrash but never take it back out, so a content it had trashed had to be restored\nby hand in wp-admin. It calls wp_untrash_post()<\/code> and nothing else, and replaying\nit on a content that is not in the trash reports \"nothing to do\" instead of an\nerror, exactly as content.trash<\/code> does on a content already trashed.<\/li>\ndraft<\/code> \u2014 not to the status it had\nbefore it was trashed \u2014 unless the site filters wp_untrash_post_status<\/code>. So the\noutcome cannot be deduced from the WordPress version, and the plugin reads it\nback after the write: after<\/code> is the observed status, previousStatus<\/code> the one\nthe content had when it was trashed, and restoredToPreviousStatus<\/code> says whether\na page that was published is readable again or is now a draft.<\/li>\ncontent.trashed.list<\/code> operation (edit_posts<\/code> capability, read-only): lists\nthe trashed contents with their id, title, type, trash date and previous status.\nA trashed content answers no URL any more, so this is the only way to name the\ncontent to restore. Media are out of scope, like everywhere else: WordPress does\nnot trash an attachment, it deletes it and its files for good.<\/li>\n<\/ul>\n\n5.8.0<\/h4>\n\n
\n
taxonomy.list<\/code> operation (edit_posts<\/code> capability, read-only): lists the\ntaxonomies that apply to a post type \u2014 categories, tags, and any custom one the\nsite declares \u2014 and, on request, one bounded page of their terms. AudiScale\nreads it so it can only ever propose a term that exists.<\/li>\ncontent.terms.assign<\/code> operation (manage_options<\/code> capability): files a page\nor a post under existing terms. It adds<\/strong> by default: assigning one category\nno longer removes the others, and clearing the existing terms requires spelling\nout mode: \"replace\"<\/code>. It never creates a term<\/strong>: an unknown one is refused and\nreported, so a near-duplicate (\"Actualit\u00e9s\" on a site holding \"Actualit\u00e9\") is\nnever silently created. The complete previous set of terms is written to the\naudit log, and the recorded result is re-read after the write, so it shows the\ndefault category WordPress reassigns to a post left without one.<\/li>\ncontent.trash<\/code> operation (delete_posts<\/code> capability): moves a page or a post\nto the WordPress trash, from where you can restore it. Until now a draft created\nfrom AudiScale could not be removed from AudiScale. Nothing is ever deleted\npermanently: if the trash is disabled on your site the operation is refused\ninstead of destroying the content, and media are out of scope \u2014 WordPress does\nnot trash an attachment, it deletes it and its files for good.<\/li>\npromote<\/code> operation now also approves a page body prepared in draft mode\n(field: \"content\"<\/code>). It previously handled SEO fields only, so a body drafted by\nAudiScale could be approved from WordPress and nowhere else.<\/li>\ncontent.set_page_template<\/code> now honours publishMode<\/code> like every other content\noperation: by default the new template waits on the \"Pending\" screen instead of\nbeing applied to the live site immediately.<\/li>\ncontent.status.set<\/code> and content.trash<\/code> now refuse to unpublish or trash the\npage used as the front page or as the posts page, which would leave the site\nwithout an entry point.<\/li>\n?p=<\/code>,\n ?page_id=, ?attachment_id=<\/code> \u2014 the three WordPress itself honours), then the\nsite's own rewrite rules, then the site root, and refuses otherwise with\n audiscale_url_needs_post_id (404). The slug fallback that used to search the\npath against every content type is removed<\/strong>: a slug read off a crawled URL\nnames the right content only by luck, and every way it named a wrong one ended in\na success on content nobody aimed at \u2014 on a shop holding both a page and a product\nnamed \"contact\", the write landed on whichever the database returned last. A URL\nwhose path WordPress does not resolve now needs an explicit content id; AudiScale\nresolves the target on its side and sends it.<\/li>\nsite_url()<\/code> and the audiscale_trusted_hosts<\/code> filter, and\ninternationalized domains, punycode and a trailing dot compare equal.<\/li>\npost<\/code> and post_id<\/code> are no longer read as content ids \u2014 WordPress\nhonours neither, while plugins use both as ordinary parameters, so a crawled\n\"\/recherche\/?post_id=2\" resolved to the post 2 instead of the search page.<\/li>\ncontent.set_page_template<\/code> \u2014 the operation id alone is the same as\nin 5.7.1, where the template was always applied immediately.<\/li>\ncode<\/code> (and the details behind it,\nsuch as the templates the theme really declares) next to the message, so AudiScale\ncan tell one refusal from another and suggest the right fix. The error<\/code> field is\nunchanged.<\/li>\n<\/ul>\n\n5.7.1<\/h4>\n\n
\n
?page_id=<\/code>, ?p=<\/code>, ?post=<\/code>, ?post_id=<\/code>) was\nread as the site root, because its path is \/<\/code>. Depending on the site it either\nfailed with audiscale_no_front_page<\/code> or \u2014 with a static front page \u2014 applied the\noperation to the home page instead of the content actually targeted. The declared\nid is now read first, and an id matching no content fails instead of falling back\nto the home page. Affects every operation resolving a URL, SEO ones included.<\/li>\n<\/ul>\n\n5.7.0<\/h4>\n\n
\n
media.upload<\/code> operation (upload_files<\/code> capability): sideloads a remote\nimage or video into the media library and returns its attachment id, so a page\nAudiScale drafts can reference a real attachment instead of an external URL.\nThe downloaded bytes are type-checked (no SVG), the source URL is validated\nagainst WordPress' own SSRF guard, the transfer is capped at 25 MB (declared\nsize checked before the download, response size capped during it), and nothing\nexisting is overwritten. This operation is why the plugin requires WordPress\n6.0 or later: download_url()<\/code> fetches through wp_safe_remote_get()<\/code>, which\nre-validates every redirect target against the same SSRF guard rather than\nfollowing it blindly.<\/li>\nblocks.validate<\/code> operation (edit_posts<\/code> capability, read-only): parses\nblock markup the way the editor does and reports content sitting outside any\nblock, unknown block types, or markup that does not survive a parse\/serialize\nround-trip. AudiScale calls it before proposing a draft, so a page never lands\nin the editor showing \"This block contains unexpected or invalid content\".<\/li>\nsite.layout_options<\/code> operation (edit_posts<\/code> capability, read-only):\nlists the page templates the active theme actually declares, and whether the\ntheme renders wide\/full alignments. AudiScale reads it before offering any\nlayout change, so it can only ever propose a layout the theme can render.<\/li>\ncontent.set_page_template<\/code> operation (manage_options<\/code> capability):\nchanges the template of an existing page or post, targeted by post_id<\/code> or\n url. The value must be a template the active theme declares (or default<\/code>);\nanything else is refused rather than written, and the before\/after is recorded\nin the audit log.<\/li>\ncontent.create_draft<\/code> and content.update_fields<\/code> accept an optional\n page_template, validated the same way. On creation the template is checked\nbefore the post is inserted, so a refused template never leaves an orphan\ndraft behind.<\/li>\n<\/ul>\n\n5.6.0<\/h4>\n\n
\n
plugins.check_updates<\/code> operation (update_plugins<\/code> capability): purges the\n update_plugins transient and re-runs WordPress' update check immediately, with\nno staleness guard, then reports how many updates are now visible. WordPress only\nrefreshes that cache about twice a day and its upgrader refuses any plugin the\ncache does not list, so updating a freshly released version from AudiScale failed\nfor hours for no real reason. AudiScale now calls this before retrying, and the\nupdate goes through. plugins.list<\/code> is unchanged.<\/li>\n<\/ul>\n\n5.5.0<\/h4>\n\n
\n
5.4.0<\/h4>\n\n
\n
site.footer_snippet.set<\/code> \/ .clear<\/code> \/ .get<\/code> operations: store a marked\nHTML block (a link and an image, no script) and print it on wp_footer<\/code>. Used\nby AudiScale for the one-click \"Verified\" badge install. The block lives in an\noption, not in the theme's footer.php<\/code>, so a theme update cannot wipe it, and\nre-posing the same marker replaces the block instead of stacking a second one.<\/li>\n<\/ul>\n\n5.3.1<\/h4>\n\n
\n
plugins.update<\/code> no longer leaves a plugin deactivated after a successful\nupdate: a failed reactivation is now reported (reactivationFailed<\/code>) instead\nof being swallowed, and a main file renamed by the update is re-resolved\nbefore reactivating.<\/li>\n<\/ul>\n\n5.3.0<\/h4>\n\n
\n
seo.sitemap.exclude<\/code> operation: flags a content so the native\nwp-sitemap.xml skips it (reversible with excluded: false<\/code>; draft\/approve flow\nsupported). No effect while a third-party SEO plugin provides the sitemap.<\/li>\ncontent.status.set<\/code> operation: switches a content between \"publish\" and\n\"draft\" only (strict whitelist \u2014 no trash, no private, no scheduling),\n publish_pages capability, audited before\/after.<\/li>\n5.2.0<\/h4>\n\n
\n
5.1.1<\/h4>\n\n
\n
plugins.update<\/code> now keeps the target plugin active after upgrading it (the\nWordPress upgrader deactivates during the file swap and does not restore it on a\nprogrammatic call).<\/li>\n<\/ul>\n\n5.0.0<\/h4>\n\n
\n
security.*<\/code> operation family: hardenings applied at the PHP\nruntime, without touching wp-config and always reversible in a single call\n(file editor, REST user enumeration, XML-RPC + pingbacks, HTTP headers\nHSTS\/nosniff\/X-Frame-Options\/Referrer-Policy, minor core auto-updates,\nversion masking, ?author=N<\/code> scan blocking).<\/li>\ndryRun<\/code> (simulation without writing) and logs the before\/after\nvalue for an undo via the inverse op. security.state.get<\/code> exposes the current\nstate. Disconnecting (unpair<\/code>) resets all hardenings.<\/li>\nhsts<\/code> is set only if HTTPS is actually enforced (anti-lockout guard).<\/li>\n<\/ul>\n\n4.0.0<\/h4>\n\n
\n
security.audit<\/code> operation (read-only, manage_options<\/code> capability):\nfree hardening snapshot (versions, configuration flags, admin accounts, core\nintegrity via wordpress.org checksums). No secret is returned.<\/li>\n<\/ul>\n\n3.0.0<\/h4>\n\n
\n