Skip to content

Fleet Console

Gaurav Tiwari edited this page Aug 27, 2026 · 1 revision

Fleet Console

Moves reviewed settings between your own sites as signed, single-use bundles. Off by default.

It is deliberately not remote management. There is no file upload, no plugin installation, no PHP evaluation, and no remote command path — the entire surface is "accept a signed blob of settings this site already knows how to validate".

Setup

  1. Enable Fleet on every site that will participate.
  2. Save the same signing secret on each, or define it once per site:
define( 'GTPERF_FLEET_SIGNING_SECRET', 'one long passphrase shared across your sites' );

The constant takes precedence over the encrypted dashboard value.

Export and import

wp gt-performance fleet export
wp gt-performance fleet import

Or from the Fleet tab.

Choose which modules travel: cache, cloudflare, cdn, css, javascript, media, fonts, database, bloat, commerce, integrations, private_fragments.

What the bundle can never carry

Secrets are stripped recursively before signing, even when their parent module is selected:

  • Cloudflare API tokens, Global API Keys, account email
  • Redis credentials
  • xCloud API token
  • The fleet signing secret itself

So a bundle is safe to paste into a support ticket or a chat window. It cannot leak a credential because it never contained one.

Why bundles expire and are single-use

Exports expire after five minutes and each is accepted once. A settings bundle is a capability: anyone holding it can reconfigure a site that trusts the secret. Short expiry plus replay rejection means a bundle recovered from a chat log, a clipboard manager or a shell history is already useless.

Settings are sanitized again on import against the receiving site's own schema. Unknown keys are dropped rather than stored, so a bundle from a newer version cannot inject configuration this site does not understand.

Refusing imports

allow_imports can be turned off per site. Useful for a production site that should export its configuration to staging but never accept one back.

Related

Settings Reference · Constants Reference · WP-CLI

Clone this wiki locally