itdatex Sync Gate

Sync Gate connects two WordPress installs through an HMAC-signed pair handshake (no cloud broker in between). After pairing, individual database tables can be pulled from or pushed to the other site, with:

• Automatic pre-backup (SQL dump inside the uploads/ directory, HTTP access blocked)
• Serialization-safe URL rewrite (unserialize -> replace -> serialize, so no broken serialized options escape)
• Sensible default exclusions (users, orders, sessions stay local)
• Full audit log (which table, when, how many rows, which backup)

Audience: Agencies and developers who need to selectively synchronize WooCommerce shops or content sites between staging and live.

Features (v0.11.2)

• HMAC-signed REST endpoints (no cloud middleman)
• Pairing via pending secret + handshake (15 minute TTL)
• Table sync – pull and push individual database tables between paired sites
• File sync – pull and push wp-content/uploads/ with diff (size + mtime), backup, dry-run and optional –delete. Chunked up to 500 MB per file (5 MB per HTTP chunk, SHA256 integrity check, wp-cron cleanup of expired sessions). Parallel chunks via curl_multi in both directions (1..10 configurable, default 3) and auto-resume on push AND pull (push session as WP option, pull session as folder-backed store in uploads/itdatex-sync-gate/pulls/)
• Central settings under Tools -> Sync Gate -> Settings and via WP-CLI wp sync-gate config. Configurable: chunk_concurrency (1..10), chunk_size (256 KB..20 MB), session_ttl_hours (1..168)
• Web UI under Tools -> Sync Gate with tabs “Pairs”, “Tables”, “Files”, “Log” and direction radios
• WP-CLI: list-tables, pair-init, pair-connect, pair-list, pull, push, files pull|push, files-resume-list, pull-resume-list, pull-resume-forget
• Default exclusions for WooCommerce orders, users, sync-gate’s own tables (enforced server-side and client-side)
• Serialized values are handled correctly (including nested)
• Nonce-based replay protection (10 minute TTL) and time window +/- 60s
• Path traversal protection, .php/.phar exclusion, symlink ignore

Security model

Every REST call between paired sites carries four headers:

• X-Itdatex-SG-Signature = HMAC-SHA256(secret, method || path || sha256(body) || nonce || timestamp)
• X-Itdatex-SG-Nonce (16 byte hex, valid once for 10 minutes)
• X-Itdatex-SG-Timestamp (unix seconds, +/- 60s window)
• X-Itdatex-SG-Remote-URL (sender URL for pair lookup)

The secret itself is transmitted over HTTPS and stored in plain text in the pair table. Anyone with database access on either side effectively has access to the other; encryption at rest would not add real security here because the decryption key would live in the same WordPress install.