AddoBase data: what your site sends to AddoCore

This page lists all AddoBase data that leaves your site: what a check sends to addocore.com, when checks run, what AddoCore stores and what it never receives. In short: the site address, three version numbers and the list of AddoCore plugins. No content, users, orders or customer data.

When does AddoBase contact addocore.com?

A site that is connected or uses a license key checks in with AddoCore at these moments:

• twice a day through WP-Cron, scheduled when AddoBase is activated,
• when someone opens the AddoBase screen and the last check is more than 5 minutes old,
• when you click Check now,
• before WordPress looks for plugin updates, when the last check is more than an hour old,
• after every switch on or off, from the AddoBase screen or the Plugins screen, and after an add-on update.

WP-Cron runs on page visits. On a site with DISABLE_WP_CRON and no real cron job, the twice-daily check does not run and only the other moments remain.

A site that is not connected and has no license key only asks addocore.com for the latest AddoBase version, at most every 6 hours. That request contains nothing about your site.

What AddoBase data does each check send?

Each check sends one JSON body with the site details and the AddoCore plugins on the site. A typical body looks like this:

{
  "site_url": "https://example.com/",
  "wp_version": "6.8",
  "core_version": "1.0.0",
  "php_version": "8.2.0",
  "installed": [
    { "slug": "addofy", "version": "1.0.0", "active": true }
  ]
}

The installed list contains each plugin’s folder name, its version and whether it is active. Only AddoCore plugins are listed: plugins whose Update URI points at addocore.com, plus add-ons that registered with AddoBase. Other plugins and themes are never part of the AddoBase data. A site that uses a license key also sends the key in the same body.

Which AddoBase data does AddoCore store?

AddoCore stores the site address, the WordPress and AddoBase versions and the time of the last check. You see them per site in My Account → WordPress plugins as “Last check: 3 hours ago · AddoBase 1.0.0 · WordPress 6.8”. It also stores which add-ons are switched on for which site, because that decides how many sites of your license are in use.

The PHP version is not stored. Your server’s IP address is used for rate limiting only.

AddoCore keeps the address without https://, www. or a trailing slash. That way two forms of the same address never count as two sites.

How is AddoBase data secured in transit?

All traffic goes over HTTPS. On top of that, every request from a connected site is signed with HMAC-SHA256. The signature covers a millisecond timestamp, a random nonce and the exact body, and travels in the X-AddoBase-Site, X-AddoBase-Timestamp, X-AddoBase-Nonce and X-AddoBase-Signature headers. AddoCore rejects a request more than 5 minutes off the real time and a nonce it has seen before.

The secret behind the signature is only known to the site and AddoCore. A site with a license key signs with a SHA-256 hash of the key instead, in X-MCPL-* headers.

On the site, the secret and the license key are stored encrypted. The encryption key comes from the site’s own salts in wp-config.php, so a database dump alone does not reveal them.

What does the connect step send?

Connecting sends your browser to addocore.com/my-account/connect-site/. The link carries the site address, the site name, the return address in wp-admin, a random state value and a PKCE code challenge. The confirmation screen uses the name and address to ask “Connect [site] to the AddoCore account [e-mail]?”, with Connect site and Cancel.

After you confirm, the site exchanges a one-time code (valid 10 minutes) for its own ID and secret. That exchange sends the site address and the WordPress, PHP and AddoBase versions, but no plugin list.

What does the site receive in return?

The answer contains your account e-mail in masked form (for example m***@example.com) and one entry per add-on: its name, if you hold a license or trial, the end date, how many sites are in use, whether it is switched on here, and the latest version with requirements, changelog and a download link that is valid for 6 hours. It also carries the grace period of 96 hours. AddoBase keeps this answer in a WordPress option, so clearing a cache never switches add-ons off.

What AddoBase data is never sent?

AddoBase never sends posts, pages, media, users, orders, customer data, settings of other plugins, or the list of other plugins and themes. It also does not send anything from the front end of your site or from your visitors.

What happens to AddoBase data when you disconnect or uninstall?

Disconnect on the AddoBase screen tells AddoCore to unlink the site and then deletes the stored secret and the last state from the site. Deleting AddoBase in the Plugins screen does the same and also removes the scheduled check. Deactivating AddoBase only stops the scheduled check; the connection stays, so reactivating needs no new connect.

On the AddoCore side an unlinked site keeps its entry, so reconnecting the same address reuses it. For the license-key variant, see using a license key instead of connecting. If a check fails and you want to know why, troubleshooting AddoBase lists every message. This is the complete list of AddoBase data; nothing else leaves the site.