UpdateProof

Description

UpdateProof is a free local tool for safer site maintenance.

Start with one simple workflow: check your site, test important pages, review the update evidence, and approve changes only when you are ready. Learn about the broader UpdateProof roadmap at https://updateproof.zerofrik.com/.

The Free/Base release helps developers and maintenance agencies establish an evidence-based update workflow before an update:

• Records WordPress and PHP versions.
• Records active plugins and the active theme without collecting their source code.
• Detects available WordPress, plugin, and theme updates using WordPress native update APIs.
• Runs a small, transparent set of deterministic checks and gives a low, review-recommended, or high-risk signal.
• Lets administrators configure up to four critical same-site URLs for manual preflight checks.
• Records HTTP status, response time, and a privacy-safe HTML fingerprint before and after a deployment attempt.
• Creates a selectable plugin/theme deployment plan with an explicit approval step.
• Applies selected plugin and theme updates through WordPress native upgrader APIs.
• Records post-deployment checks and a local deployment history.
• Optionally connects to an administrator-owned browser worker for real Chromium screenshots of up to three public pages.
• Captures a baseline and reports pixel-level visual differences after an update, with screenshots stored in the site’s uploads directory.
• Exposes site metadata, the latest snapshot, and update inventory through a read-only REST API.
• Lets an administrator generate and revoke a per-site API token.

The Free/Base plugin does not create a staging site, run synthetic form or WooCommerce tests, schedule updates, automatically roll back a failed update, or provide multi-site/team management. Those are planned Pro/service capabilities.

Privacy

UpdateProof stores the latest safety snapshot and a one-way hash of the optional site token in the WordPress options table. The free plugin does not send site content, visitor data, or telemetry to ZeroFrik or any third party.

Visual regression is disabled by default. If an administrator enables it, the configured public page URLs are sent to the administrator-provided browser worker, which returns screenshots and pixel-difference data. The plugin stores those images in the site’s uploads directory. Do not configure private, password-protected, or visitor-personalized pages in this Free/Base feature.

When an administrator clicks Deactivate, UpdateProof may show an optional feedback form. Feedback is not sent to ZeroFrik by default. A site owner can explicitly connect an endpoint using the UPDATEPROOF_FEEDBACK_ENDPOINT constant or the updateproof_feedback_endpoint filter. The submitted payload contains the selected reason, optional explanation, plugin identifier, plugin version, and timestamp.

If an administrator generates a site token and gives it to an external service, that service can read the site metadata, update inventory, and safety snapshot exposed by the plugin’s authenticated REST API. The token can be revoked at any time from the plugin settings in the WordPress admin.

External services

The optional visual regression feature connects to a browser worker URL entered by the site administrator. There is no default hosted worker and no request is made unless the administrator enables the feature and presses Capture visual baseline or Run visual check. The worker receives the configured public page URL, viewport size, and a site identifier, then returns a Chromium screenshot and pixel-difference result. The plugin stores the returned screenshots in the site’s uploads directory. The worker does not receive WordPress credentials, post content, or visitor data from this plugin. If a third-party worker is used, its operator’s terms and privacy policy apply.

The optional deactivation feedback feature can send the selected reason and optional explanation to an endpoint explicitly configured by the site owner with UPDATEPROOF_FEEDBACK_ENDPOINT or the updateproof_feedback_endpoint filter. No endpoint is configured by default, and no feedback is sent to ZeroFrik unless the site owner connects one. The endpoint receives the feedback reason, optional explanation, plugin identifier, plugin version, and submission timestamp.

REST API

The optional read-only endpoints are available below the site REST URL:

• /wp-json/zerofrik-maintenance-safety-agent/v1/site
• /wp-json/zerofrik-maintenance-safety-agent/v1/snapshot
• /wp-json/zerofrik-maintenance-safety-agent/v1/updates
• /wp-json/zerofrik-maintenance-safety-agent/v1/preflight
• /wp-json/zerofrik-maintenance-safety-agent/v1/plan
• /wp-json/zerofrik-maintenance-safety-agent/v1/history
• /wp-json/zerofrik-maintenance-safety-agent/v1/visual

Send the generated token in the X-UpdateProof-Token header. A token is never returned by the API.

Technical details