About this plugin
com. Install it on each WordPress site you want to monitor, then add the site to your WPShake account using the connection token shown on the plugin’s settings page. The dashboard then runs daily checks across every connected site without you logging into each one.
What Shake Connect adds to this site
- A bearer-token-authenticated REST API under /wp-json/wpshake/v1/* that the WPShake dashboard calls to read site state.
- Endpoints for: plugin and theme inventory with available updates, core info, WP checksums, database health, recent WooCommerce orders if WooCommerce is installed, recent PHP errors from WP_DEBUG_LOG, backup-plugin detection (UpdraftPlus, BlogVault, BackWPup, Solid Backups, WPvivid, Duplicator), activity log integration (reads the WP Activity Log plugin’s table when present), a built-in malware signature scanner, and a broken-link checker.
- Maintenance endpoints scoped to safe operations: cache flush across popular caching plugins, run-due WP-Cron, expired-transient cleanup, permalinks flush.
- A WP-CLI subcommand wp wpshake for token rotation and status checks.
What Shake Connect does NOT do
- It does not auto-update plugins, themes, or WordPress core. Update commands are issued from the dashboard side as separate releases of this connector. This release is read-only plus safe maintenance only.
- It does not collect personal information or analytics. The dashboard reads your site’s existing data on demand.
- It does not communicate with any third party except the WPShake dashboard configured on the plugin’s settings page, and only when the dashboard calls this site’s REST endpoints with a valid bearer token.
How the connection works
- Install and activate Shake Connect.
- Open Settings → Shake Connect in the WordPress admin to generate a connection token. The token is shown once.
- Sign up at wpshake.com, click “Add a site”, paste the token and your site URL.
- The dashboard performs an initial handshake and pulls site state.
The token is stored as a SHA-256 hash on this site. The dashboard sends the plain token in an Authorization: Bearer header on every request. Every authenticated endpoint validates the header before doing anything.
Built for agencies
If you maintain more than a handful of WordPress sites, you already know the work. Shake Connect is the receiver for an agent that handles the daily checks across your fleet: backup verification, plugin and theme update visibility, vulnerability scanning, performance probes, PHP error monitoring, broken link checks, and per-site recommendations on what to update and what to hold.
The WPShake dashboard is a separate paid service. This connector plugin is free and open source under GPL.
Multisite
Shake Connect supports WordPress multisite. Network-activate the plugin and the connection token is stored at the network level so every subsite shares the same credentials. blog_id=3 ) to inspect each subsite.
Without blog_id, requests run against the main site. Enumeration is capped at 500 subsites per call.