About this plugin
Storita Connector exposes safe, read‑only access to your WordPress database over the REST API.
Key features:
– Read‑only queries (SELECT only) with robust validation
– API key authentication (or admin users via WP login)
– Nginx/FastCGI friendly header handling (X-Storita-Key, legacy X-DF-Key, or Authorization)
– Built-in rate limiting (1200 requests per hour per API key by default) and a maximum of 1000 rows per query by default
– Optional table whitelisting (restrict access to specific tables/patterns)
– Excluded tables list (empty by default); passwords, login keys and other secrets are always protected
– Secret redaction: password hashes, WordPress auth keys and salts and the API key are removed from every query result
– Schema explorer and health status endpoints; reading error logs is opt-in and off by default
– Admin settings page with copy‑to‑clipboard helpers
– Google Analytics 4 Integration: Proxy requests to GA4 using the existing Google Site Kit connection (supports standard and real-time reports).
This plugin is designed for integrations and reporting tools that need controlled, secure, read-only database access.
ai account. ai account the data it exposes has no consumer and the plugin has no purpose.
External services
Storita.ai
ai), a store analytics and assistant service. ai uses the plugin to read your store data so it can answer questions and produce reports about your store.
When data is made available:
– Only after the site owner configures an API key in Settings -> Storita.
ai service using the API key in the X-Storita-Key (or legacy X-DF-Key ) or Authorization header, or by a logged-in administrator.
– Nothing is sent on activation. ai itself and does not track visitors.
What data is made available:
– Store profile, products, orders and customers data.
– The database schema (schema explorer) and read-only SQL SELECT query results ( POST /query ). Queries are SELECT-only and validated; tables the site owner excludes are blocked; credential tables are always blocked; and password hashes, WordPress auth keys and salts and the API key are removed from every result.
– Google Analytics 4 data, proxied through your site’s existing Google Site Kit connection (see below).
– Runtime health information. log, WooCommerce logs, the PHP error log) is shared only if the site owner turns on “Allow Storita to read error logs” in Settings -> Storita (off by default). Logs may contain personal data.
– The public /status endpoint returns only ok and the time.
The admin Test Connection feature calls only the site’s own REST URL (its own address) and never leaves the site.
ai legal documents:
ai/legal/privacy-notice
ai/legal/data-processing-addendum
ai/legal/trust-center
Google Analytics Data API (via Google Site Kit)
com) using Site Kit’s existing Google connection and the Google Analytics property configured in Site Kit. Google returns aggregated analytics report data. Nothing is sent to Google unless such a request is made, and the plugin sends no visitor data of its own.
- Google Terms of Service: https://policies.google.com/terms
- Google Privacy Policy: https://policies.google.com/privacy
- Google Analytics Terms of Service: https://marketingplatform.google.com/about/analytics/terms/us/
Usage
example/wp-json/storita/v1
example/wp-json/df-db/v1 is still supported.
Authenticate by sending one of the following headers:
– X-Storita-Key: YOUR_API_KEY
– X-DF-Key: YOUR_API_KEY (legacy)
– Authorization: Bearer YOUR_API_KEY
– Authorization: DF-Key YOUR_API_KEY
If you are logged in as an administrator ( manage_options ), endpoints are accessible without the API key.
Endpoints
1) POST /query
– Body params:
– query (string) – SQL SELECT query to execute
– query_base64 (string, optional) – Base64-encoded SQL (alternative to query )
Example (JSON body):
example/wp-json/storita/v1/query" \
-H "X-Storita-Key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "SELECT ID, post_title FROM wp_posts WHERE post_status=\"publish\" LIMIT 5"}'
2) GET /schema
– Query param: table (optional) – returns structure for a specific table; omit to list all tables
Examples:
example/wp-json/storita/v1/schema"
table=wp_posts"
3) GET /status
– Public health endpoint; no auth required
`
example/wp-json/storita/v1/status”
`
4) POST /google-analytics/report
– Queries Google Analytics 4 using Site Kit authentication.
)
Example:
example/wp-json/storita/v1/google-analytics/report" \
-H "X-Storita-Key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"dateRanges": [{"startDate": "30daysAgo", "endDate": "today"}], "metrics": [{"name": "activeUsers"}]}'
5) GET /health/logs and /health/logs/tail
– Off by default; enable “Allow Storita to read error logs” in Settings → Storita.
Security Controls
- Requests per window – Rate limit per API key or IP (default 1200 requests per 3600 seconds).
- Rate limit window (seconds) – How long the window lasts.
- Maximum rows per query – Adds LIMIT automatically when missing; blocks excessive LIMITs (default 1000; 0 disables).
- Excluded tables – Select specific tables to block. Nothing is blocked by default; passwords, login keys, API key secrets and 2FA secrets are always protected.
- Allowed tables (optional) – Whitelist tables/patterns (e.g., wp_posts, wp_% ). Leave empty to allow all tables unless excluded.
- Allow Storita to read error logs – off by default.
Filters
- storita_wp_rest_api_query – Filter the final SQL before execution.
- Params: string $query, WP_REST_Request $request
- storita_wp_rest_api_validate_key – Custom validation strategy for API keys.
- Params:?bool $is_valid, string $provided_key,?WP_REST_Request $request