SpawnWP Deploy

SpawnWP Deploy provides two administrator-initiated workflows:

• Capture a configured WordPress site as a reusable blueprint on a self-hosted SpawnWP server.
• Publish a finished site once to a separate, fresh WordPress installation.

It is not a continuous staging or synchronization system. Site-to-site deployment is
limited to an empty destination and keeps rollback data for seven days. Connections use
single-use pairing codes, signed requests and replay protection.

For blueprint capture, the administrator chooses whether to include plugins, themes,
uploads and database content. WordPress users and user metadata are excluded. The source
site URL is replaced with a fixed placeholder in captured database content, and each site
created from the blueprint receives its own administrator credentials.

Requirements

• WordPress single-site.
• PHP 7.4 or later with the Sodium and ZIP extensions.
• HTTPS with a publicly trusted certificate on paired endpoints.
• A reachable WordPress REST API without an additional HTTP password.
• Write access to the WordPress plugin, theme and uploads directories.
• Sufficient free disk space for staging and rollback data.

Always back up important sites before using deployment or capture tools.

External Connections

This plugin does not contact a SpawnWP-operated SaaS platform and does not send telemetry
to SpawnWP merely because it is installed, activated or loaded.

An administrator can explicitly pair the plugin with either:

1. another WordPress site running SpawnWP Deploy; or
2. a self-hosted SpawnWP server whose URL is supplied by the administrator.

During a requested deployment or capture, the plugin sends the selected package and
technical metadata to that administrator-selected endpoint. Depending on the selected
options, this can include plugin and theme files, media uploads, database content,
WordPress and PHP versions, plugin names and versions, package checksums, job identifiers
and connection signatures. WordPress user and user-meta tables are excluded.

The remote endpoint is operated by the site administrator or their chosen provider. Its
privacy and retention practices are therefore controlled by that operator. SpawnWP is
self-hosted open-source software distributed under the MIT License:

• SpawnWP project: https://spawnwp.com/
• Source code and license: https://github.com/tts-empire/spawnwp
• Security documentation: https://spawnwp.com/docs/security/
• Optional SpawnWP platform telemetry notice: https://spawnwp.com/privacy/telemetry/

When the plugin inventory is displayed and WordPress does not already have cached update
information for an active plugin, SpawnWP Deploy may query the WordPress.org Plugins API
using WordPress core’s plugins_api() function. It sends the plugin slug and uses the
response only to classify the plugin as WordPress.org-hosted or custom. The result is
cached for one day. WordPress.org privacy policy: https://wordpress.org/about/privacy/