DatPilot Connector

DatPilot Connector works on its own, with no account and nothing sent outside your site, and can optionally be connected to DatPilot, a WordPress maintenance service for Vietnamese site owners. The admin screens are in Vietnamese.

Works without connecting (all features, free):

• Health score in Settings → DatPilot: outdated core/plugins/themes, PHP version, debug output, HTTPS, risky settings, admin accounts, backup age. Read only.
• Manual backup of the database and wp-content, run in small steps so cheap hosting does not time out. Backups stay on your hosting (in a randomly named, access-denied folder under uploads); the database dump is encrypted when the sodium extension is available. Download or delete them from the same screen.
• Malware and spam scan (read only): compares WordPress core and plugins downloaded from WordPress.org against the official checksums, looks for common backdoor patterns in themes, premium plugins and the uploads folder, and finds posts injected with gambling/casino spam or hidden links.
• PHP fatal error log: records fatal errors (white screen, “critical error”) without enabling WP_DEBUG, in the same protected folder as the backups. Server paths, emails, phone numbers and quoted values are removed from the message, and only the page path (no query string) is kept.

When connected to DatPilot (you paste a connection key from your DatPilot account), the service can alert you by Telegram when the site is down or throws fatal errors, send a monthly report, run scheduled backups and weekly scans.

The connection is limited to monitoring and data. DatPilot can only send a fixed list of signed, read-mostly commands: site information, health check, the read-only scans above, reading the PHP error log, purging the page cache, and creating, listing or deleting backups. This plugin gives DatPilot no administrative actions: it cannot install, activate, deactivate or update plugins, themes or WordPress core, restore backups, change settings, manage users or run code. Disconnect or deactivate the plugin at any time to stop all access.

Tiếng Việt: Plugin kiểm tra sức khoẻ web, sao lưu thủ công, quét mã độc và spam SEO, ghi lỗi PHP nghiêm trọng, dùng miễn phí không cần tài khoản. Kết nối DatPilot (tuỳ chọn) để được báo qua Telegram khi web sập, nhận báo cáo tháng và dùng gói bảo trì.

External services

This plugin can talk to the following services. Nothing is sent before you act as described.

DatPilot (datpilot.com) — only after you paste a connection key in Settings → DatPilot.

• On connect, the plugin sends your site ID, home URL, REST URL, WordPress, PHP and plugin versions to https://app.datpilot.com/api/v1/connector/hello.
• Afterwards DatPilot sends signed commands (Ed25519, single-use nonce, 5-minute window) to your site’s REST endpoint /wp-json/datpilot/v1/run and receives the results: version lists, health check flags, scan findings (suspicious file paths, IDs and titles of posts that look like spam), PHP fatal errors (type, file, line, page path without query string, message with personal data removed), backup status. Backups themselves stay on your hosting and are never sent to DatPilot. Automated reports contain no customer, order or member data.
• Terms of use: https://datpilot.com/dieu-khoan
• Privacy policy: https://datpilot.com/chinh-sach-bao-mat#connector

WordPress.org — only when you (or DatPilot, if connected) run a deep scan.

• Official core checksums from https://api.wordpress.org/core/checksums/1.0/ (through WordPress’ get_core_checksums()).
• Plugin checksums from https://downloads.wordpress.org/plugin-checksums/<slug>/<version>.json. Only the plugin slug and version are sent.
• WordPress.org privacy policy: https://wordpress.org/about/privacy/