Site Kit Portal Pin 1.6216.1411

Site Kit Portal Pin 1.6216.1411

A feature release that adds a small developer surface without changing the plugin's default behaviour. On a normal install it behaves exactly as before; the new hooks are there for the sites that need to steer it.

Added

• A sitekit_portal_pin_enabled master gate plus eight filters (sitekit_portal_pin_is_production, sitekit_portal_pin_is_auth_healthy, sitekit_portal_pin_snapshot_path, sitekit_portal_pin_tracked_options, sitekit_portal_pin_usermeta_prefix, sitekit_portal_pin_pre_pin, sitekit_portal_pin_max_restore_age, sitekit_portal_pin_should_restore) so you can control pin and restore behaviour without editing the plugin.
• A filterable 30-day snapshot age cap so auto-restore declines to act on a stale snapshot.

Changed

• The automatic snapshot cron and the auto-restore-on-admin-load now honour the enabled gate. The wp sitekit-pin restore command stays exempt, so manual recovery is never blocked even when automatic behaviour is switched off.
• wp sitekit-pin status now reports the enabled state.

Notes

No database or config migration is required. The prefix-based googlesitekit_* snapshot capture and the manage_options restore gate are unchanged.

1.6190.1000 — Documentation overhaul

What changed

The plugin code that seals and checks your Site Kit snapshot is the same. What changed is everything around it.

PHP fixes

• Fixed a misleading docblock on PROD_URL_OPTION that described a different option
• Fixed indentation on a WP_CLI::error() call in the snapshot command

Documentation

• readme.txt — complete rewrite. The old version didn't explain why someone would need this plugin, so I started over. The new one leads with the missing_delegation_consent error and explains exactly why Portal copies break Site Kit credentials. There's a full FAQ covering 11 questions, including what the HMAC is for, how to verify the snapshot worked with WP-CLI, and whether it works on hosts other than WP Engine.
• README.md — the old README described a completely different plugin (an admin toolbar link). Fixed.
• CHANGELOG.md — removed a false claim that the plugin uses semantic versioning. It uses the X.Yjjj.hhmm scheme, so 1.6190.1000 means major version 1, 2026, Julian day 190, 10:00 AM Toronto time.

Version

1.6190.1000 — July 9, 2026, 10:00 AM (Toronto)

1.6148.2110

WP 7 hardening release. Compatibility, security, accessibility (WCAG 2.2 AA), and promise-accuracy fixes. See readme changelog.

v1.6147

Maintenance release. Moves from semantic versioning to the x.Yddd calendar scheme used across the plugin family, and confirms WordPress 7.0 compatibility.

1.0.1

Changed

• Standardized the donation link to GitHub Sponsors.

Compatible with WordPress 7.0.

v1.0.0 — Initial public release

Pins production's Site Kit OAuth state across WP Engine Portal copies. Snapshots prod's healthy auth blobs to a file outside wp-content/ (untouched by Portal copies) and auto-restores when a dev → prod copy lands dev's empty state on prod.

What's in this release

Configurable production URL

No longer hard-coded. Resolved via PHP constant → WP option → filter (in that order). Plugin no-ops silently if nothing is configured — safe to deploy to both environments from a shared codebase.

// wp-config.php
define( 'SITEKIT_PORTAL_PIN_PROD_URL', 'https://example.com' );

HMAC snapshot integrity

The snapshot file is signed with wp_salt('auth') using SHA-256 HMAC. Every read verifies the signature before trusting the data. A mismatch or missing MAC fails closed with a single admin notice. wp sitekit-pin status reports MAC-verified OK, MAC-missing, or MAC-FAILED.

Throttled auto-restore

Checks for broken Site Kit state (missing credentials, owner_id mismatch, error_code) on admin page load, throttled to once per 5 minutes via a transient. Skips restore if the snapshot is older than 30 days.

WP-CLI

wp sitekit-pin status    # snapshot age, auth health, MAC status, next cron
wp sitekit-pin snapshot  # force a snapshot (refuses if auth is unhealthy)
wp sitekit-pin restore   # force restore from latest snapshot

PR lint via GitHub Actions

php -l across PHP 7.4–8.3 on every pull request.

Install

Drop sitekit-portal-pin.php into wp-content/mu-plugins/:

cd wp-content/mu-plugins
curl -L -O https://github.com/thisismyurl/thisismyurl-sitekit-portal-pin/releases/latest/download/sitekit-portal-pin.php

Then set SITEKIT_PORTAL_PIN_PROD_URL in wp-config.php and you're done. See the README for full installation and configuration options.

Requirements

• WordPress 6.0+
• PHP 7.4+
• WP Engine (or any host where dev and prod share the same wp-config.php salts)
• Google Site Kit plugin active on production