The plugin: thin by design

The plugin inventories your site, pairs it with WPExit, and gives our crawler a clean read. It does nothing and contacts nobody until an administrator clicks Connect.

Download the plugin (zip)

Requires WordPress 5.9 or later and PHP 7.4 or later. Licensed GPLv2 or later. Version 0.1.0.

Install

1. Upload the wpexit folder to /wp-content/plugins/, or install the zip from the Plugins screen.
2. Activate the plugin.
3. Go to Settings, WPExit, copy the pairing code into the WPExit app, then click Pair now.
4. Click Run inventory now, review the summary, then Send to WPExit.

What it does

• Inventory. Counts plugins, themes, post types, taxonomies, media, menus, users, comments, shortcodes, forms, and a handful of dynamic-behaviour signals. Nothing is sent until you click Send.
• Pairing. A one-time code links the site to your WPExit account.
• Manifest. A paginated list of every public URL and redirect rule, so the crawler never misses a page.
• Content export. Rendered and raw post content, menus, and a safe allowlist of options such as the site title.
• Crawler mode. When a request is signed by WPExit, caching, minification, lazy loading, the admin bar, and head noise are disabled so the crawl is clean.

All crawler-facing endpoints require an HMAC signature derived from a per-site secret issued at pairing time. The secret is stored in wp_options and never printed anywhere. On normal front-end requests the plugin only checks for two request headers; it does not slow your site down.

Privacy and external services

This plugin does nothing and contacts nobody until an administrator clicks Connect to WPExit. After that it communicates only with the WPExit control plane shown on its settings page. What is sent, and when:

• On connect: the site URL, the pairing code, the plugin version, and the administrator's email address and site name, so WPExit can create the owner's portal account and email a sign-in link.
• When you send an inventory: WordPress and PHP versions, the active theme, the list of installed plugins and whether each is active, public post type and taxonomy counts, menu names, media count, form plugin names and their notification addresses, shortcodes in use, whether search or private posts exist, custom database table names, and public URL counts. No post content, no comments, no user accounts or passwords.
• When WPExit crawls your site after pairing: it requests your public pages like any visitor, authenticated with a per-site secret so caching plugins are bypassed. On request it can also read a structured export of published posts and pages (the same content any visitor can see), your menus, and a small allowlist of options.

Nothing is sent on a schedule and nothing is sent to anyone other than the control plane you connected to. Disconnecting deletes the pairing credentials from your site. Uninstalling removes every wpexit_* option and the plugin's transients.

Next

Once the inventory is in, the app shows your compatibility score and page count and starts the preview. How it works covers the rest.