-
Notifications
You must be signed in to change notification settings - Fork 0
Self hosted updates
Erfort says it does not phone home. That is true with one deliberate, documented exception, described here in full so you can decide what to do about it.
As shipped, the copy in this repository checks
https://updates.erf.studio/erf-shield.json roughly every six hours and
auto-applies a new version in the background when one is published.
Be clear about what that means before deploying: your site will pull and run whatever is published at that URL, unattended, without a click.
This exists because the plugin runs on sites that nobody logs into for months, and an out-of-date security plugin is worse than an honest one.
Keep update checks, stop automatic installs. You still see updates on the Plugins screen, they just never apply themselves:
define( 'ERF_UPDATER_NO_AUTO', true );Point it at your own manifest. Edit the manifest URL at the bottom of
includes/updater.php. The JSON shape is documented in that file's docblock, so
you can host your own builds.
Remove it entirely. Delete includes/updater.php and its entry in the
module-loader array near the top of erf-shield.php. Everything else in the
plugin is unaffected. There is no hidden second update path.
The update check is a plain GET for a JSON file. The optional fleet check-in, which is a separate thing, sends only the site URL, plugin slug, name, and version, and only from sites that already opted into the update channel. Turn it off with:
define( 'ERF_FLEET_NO_CHECKIN', true );Do not take the above on trust. grep the plugin for wp_remote_get,
wp_remote_post, and file_get_contents and read every hit. There are few
enough that reading them all is a five-minute job, which is the point.