A plugin so small
you can audit it.

287 lines of PHP. Zero dependencies outside WordPress core. MIT licensed. One REST endpoint. No cron jobs, no mu-plugins, no database tables. Install, authorize, forget.

✓ 287 LOC ✓ MIT license ✓ No DB writes
Install instructions Read the source →
Plugin spec
Size42 KB
Lines of code287
DependenciesWP core only
Min WP5.9+
Min PHP7.4+
DB tables0
Cron jobs0
REST routes3
LicenseMIT
01 · Install

Three ways. Ninety seconds.

Easiest

WP admin

Plugins → Add New → search "StageForge" → Install → Activate.

60 seconds
no SSH required
CLI

WP-CLI

One command, one line. Works inside any shell with WP-CLI.

wp plugin install stageforge
  --activate
mu-plugin

Drop-in

Copy one PHP file to wp-content/mu-plugins/. Loads before any other plugin.

curl -O sf-loader.php
mv → mu-plugins/
02 · The full list

Everything the plugin does.

Short enough to read at lunch.

1.
Registers 3 REST routes under /wp-json/stageforge/v1/ — each gated by capability + HMAC.
2.
Exposes site metadata (WP version, PHP version, plugin list, upload dir) — read only.
3.
Accepts an authenticated backup request, streams a gzipped mysqldump + uploads tarball over the open TLS connection.
4.
Writes a single timestamped log row into wp-content/stageforge.log per connection. Rotates at 5 MB.
5.
Exits. No background processes. No queued jobs. No wp-cron tasks. No database tables.
That's it. The full plugin source is on GitHub. Star it, audit it, send a PR.
03 · What it can't do

Capability gated.
Request signed.
Replay windowed.

Every request is signed with a rotating HMAC key. The signature covers the body, the timestamp, and a nonce. Requests older than 90 seconds are rejected. Requests with a capability the site admin hasn't granted are rejected.

▸ Can't execute arbitrary PHP
▸ Can't write to the database
▸ Can't modify plugin files
▸ Can't read outside wp-content/uploads
Capability matrix
admin-granted
read:site-info
ALLOWED
read:plugin-list
ALLOWED
backup:database
ALLOWED
backup:uploads
ALLOWED
restore:*
DENIED
write:*
DENIED

Audit it. Fork it. Ship it.

MIT licensed. Pull requests welcome.

GitHub → See it in action →