Hermes Conector

Hermes helps Brazilian law firms keep their own blog up to date. It suggests topics, drafts articles whose case-law citations are checked against official court sources, and schedules them. The firm decides whether each article waits for its approval or goes live on the scheduled date.

Hermes publishes through the standard WordPress REST API, signed in with an Application Password that a site administrator approves. This plugin is optional: publishing works without it. It adds what the core REST API does not provide:

• SEO fields over REST – registers the Yoast SEO and Rank Math title and description fields in the REST API, so the values Hermes sends are saved instead of silently discarded.

• Article read counts – while the site is connected to Hermes, a tiny inline script on single posts records one read per visit: post, time, referrer domain, utm_source and utm_medium, device type, operating system, a truncated network prefix (never the full IP address) and the country sent by Cloudflare, when present. No cookies and nothing stored on the visitor’s device. Logged-in users, bots and browsers that send Global Privacy Control or Do Not Track are not counted.

• Google Search Console verification – prints the verification meta tag (and serves the matching verification file) so that the firm’s own Google account becomes the verified owner of the site.

• Search engine visibility – only tells Hermes whether “Discourage search engines from indexing this site” is checked, so Hermes can warn the firm and hold scheduled posts. The plugin never changes this or any other site setting: an administrator changes it in Settings > Reading.

• Connection status – Settings > Hermes and Tools > Site Health show whether Hermes can sign in, how many reads arrived and what to fix.

No ads, no upsells, no locked features. A Hermes account is needed to see the data in the Hermes dashboard.

External services

This plugin does not send requests to any external server by itself. It only answers requests made to your own site.

br), the service the law firm uses to write and publish its articles. After an administrator connects the site in the Hermes dashboard, which creates a WordPress Application Password for a user of their choice, Hermes calls these authenticated routes:

• GET /wp-json/blog-juridico/v1/saude – when connecting and about once an hour. Returns the plugin and WordPress versions, the active SEO plugin, whether page caching and read counting are on, whether the site is visible to search engines and what the connected user is allowed to do.

• GET /wp-json/blog-juridico/v1/metricas – about once an hour. Returns the view counter, status, date and link of the posts Hermes published.

• GET /wp-json/blog-juridico/v1/visitas – about once an hour, only for editors or administrators. Returns the reading statistics described under Privacy.

• POST /wp-json/blog-juridico/v1/verificacao-google – when you link Google Search Console in Hermes. Stores the verification code issued by Google.

br/termos

br/privacidade

Google Search Console: the plugin prints a google-site-verification meta tag (and serves the matching file) that Google’s crawler reads to confirm ownership. No visitor data is sent to Google. com/privacy

Cloudflare (only if your site already uses it): the plugin reads the CF-IPCountry header that Cloudflare adds to each request. Nothing is sent to Cloudflare.

The reading script sends data only to your own site (/wp-json/blog-juridico/v1/batida).

Privacy

• Reads are recorded only while read counting is on (Settings > Hermes) and the site is connected to Hermes (Hermes signed in during the last 30 days).

• Stored in the {prefix}blog_juridico_visitas table: post, date and time, referrer domain, utm_source and utm_medium, device type and operating system (derived from the User-Agent, which is not stored), country (only behind Cloudflare) and a network prefix (IPv4 /24, IPv6 /48) used only to estimate the city.

• The network prefix is erased once Hermes has read the record (usually within a couple of hours) and in any case after 7 days. Records are deleted after 180 days.

• To avoid counting reloads, a keyed hash (HMAC-SHA256 with a key derived from your wp-config.php salts, rotated daily) of the IP address and browser is kept with the record for at most one day, then erased. It is never sent to Hermes and cannot be reversed with the database alone.

• Hermes keeps a copy without the network prefix, with the estimated city, for up to 25 months. The site owner is the controller; Hermes processes the data on the owner’s behalf.

• After that day, records cannot be linked to a person, so the plugin does not register personal data exporters or erasers.

• A suggested text for your privacy policy is added to Settings > Privacy > Policy Guide.