Tendrix Connector

Tendrix Connector is the client side of a two-plugin system. It is installed on a site that
somebody maintains for you, or that you maintain for a client, and it reports to an
Tendrix Hub running on a WordPress site that you or your agency owns.

There is no third-party service. This plugin talks to one Hub and only to the Hub you paired
it with, whose address is pinned at pairing time and cannot be changed by a request.

What it does

• Sends a heartbeat every five minutes, with the site’s technical inventory when something changed.
• Runs local audits when the Hub asks: security, pending updates, health, SEO, broken links, accessibility and file integrity.
• Executes commands from a closed list, and refuses anything else without interpreting it. The list covers audits, inventory, image optimisation and alt text, cache purging, database cleanup and backups: content, data and cache, never site administration. With the free Tendrix Hub the connector only runs audits and sends its inventory; the other commands are sent only by the Tendrix Hub Pro add-on.
• Records fatal errors and outgoing mail failures so they can be diagnosed from the Hub.
• Recompresses and resizes the images the Hub selects, keeping a copy of each original.
• Carries the daily counts of Tendrix Chat and Tendrix Consent, when they are installed. Anything that is not a whole number is dropped before sending, so no plugin can use this channel for personal data.

What it never does

• It does not execute code sent by the Hub. The Hub sends the name of a command from a fixed list, never code, never a file path and never SQL.
• It does not send your users’ names, e-mail addresses or content. People are reported as counts per role. Mail diagnostics mask the recipient (m***@gmail.com).
• It does not install, update, activate or delete plugins, themes or WordPress core. The Hub shows which updates are pending; an administrator of this site applies them from its own dashboard.
• It does not open sessions on this site, create users or change their roles.
• It does not change site settings, permalinks, robots.txt, security settings or plugin databases, and it does not delete files from the site. Those are changed by an administrator of this site from its own dashboard.
• It does not accept instructions on its public endpoint. The one inbound route only wakes the plugin up, carries no orders, and requires the same signature as everything else.

File integrity

When the Hub asks for it, the connector hashes the WordPress core files and the files of
plugins that come from the wordpress.org directory, compares them against the official
checksums published by wordpress.org, and looks for executable PHP inside the uploads folder.

This is an integrity canary, not an antivirus. It proves that a file is not the one that was
distributed. It says nothing about a malicious plugin whose files are intact, and it never
deletes or quarantines anything: it reports, and a person decides.

Communication and security

The connector always initiates the connection outwards. The single inbound route,
/tendrix-conector/v1/wake, does not carry orders: it tells the plugin to run its cycle
now, and the plugin then asks the Hub for work over its usual signed outbound channel. If
your host blocks incoming requests, nothing is lost: the five minute cycle picks the work up
anyway.

Every request is signed with HMAC-SHA256 over the method, path, timestamp, nonce and a hash
of the body, compared in constant time, with a five minute clock window and single-use
nonces. The shared secret is created at pairing time and is deleted from this site when you
unpair.

External services

The Tendrix Hub you paired it with

Its address is entered by an administrator of this site during pairing, is stored, and cannot
be changed by an incoming request. Sending data to it is the entire purpose of the plugin.

What is sent: WordPress, PHP and server versions and settings; the list of installed plugins
and themes with their versions; database size and table statistics; counts of posts, pages,
comments, media and users per role; security and SEO configuration; audit findings; fatal
error messages with the file, line and URL where they happened, with server paths trimmed;
and the recipient domain, subject and status of recent outgoing mail.

What is never sent: post or page content, passwords, user names or user e-mail addresses.

api.wordpress.org

Used only during a file integrity audit, to fetch the official checksums for the WordPress
version this site runs. What is sent: the WordPress version and the site language. This is
the same request WordPress itself makes through its own get_core_checksums() function.
Provided by the WordPress Foundation. Terms and privacy: https://wordpress.org/about/privacy/

downloads.wordpress.org

Used only during a file integrity audit, to fetch the published checksums of installed
plugins. What is sent: the slug and version of a plugin, in the URL. Nothing about this site
is included, and the answer is cached for a week. Provided by the WordPress Foundation.
Terms and privacy: https://wordpress.org/about/privacy/

No data is sent to the author of this plugin, and there is no telemetry.