Use one agent key for your account and paste it into the WP Triage plugin on each site. The plugin handles registration and per-site credentials automatically.
/settings/agent) and click Generate agent key. Copy the wpa_… value immediately — it is shown once.wpa_… key on every site you manage.https://wptriage.app.POST /api/v1/agent/connect and stores the site ID and ingest token.Traffic is outbound from WordPress to WP Triage only. No tunnel or inbound firewall rules on the WP Triage host.
| Credential | Prefix | Who uses it | Scope |
|---|---|---|---|
| Agent key | wpa_… |
WordPress plugin (settings field) | POST /api/v1/agent/connect only |
| Ingest token | wpt_… |
Plugin internally after connect | Snapshots + ingest ping for one site |
| Sanctum PAT | (varies) | CLI, scripts, integrations | Full account API (/me, /sites, etc.) |
The ingest token is issued on each successful connect and saved in WordPress options. Operators do not need to copy it manually.
Site registration requires an HTTPS URL. Plain http://localhost will fail unless you use a local HTTPS hostname. The URL should match how you think of the site in your portfolio (www vs non-www matters for matching).
| Action | Effect |
|---|---|
| Generate new agent key (web UI) | Revokes the previous wpa_… key. Re-save plugin settings on each WordPress site with the new key. |
| Save plugin settings | Calls agent connect again; issues a new wpt_… ingest token for that site. |
| Symptom | Likely cause |
|---|---|
| Connect fails HTTP 403 on other APIs with agent key | Expected — agent keys cannot call /me or /sites. |
Connect fails HTTP 422 on url |
Site URL is not valid HTTPS. |
| Test connection fails after save | API base URL wrong, agent key revoked, or WordPress cannot reach the API over HTTPS. |
| Site not in dashboard | Connect succeeded but no snapshot yet — use Send snapshot now. |
| Two sites merged | Same canonical URL under one account — intentional deduplication. |
Generate the agent key on your local app (/settings/agent), then paste it in the plugin. Use Advanced → API base URL for local Sail: http://laravel.test.
For local WordPress with HTTPS validation, use a local HTTPS hostname (e.g. https://wpfoundry.test:8443) so agent connect passes url:https validation.
Questions? Get in touch.
When the latest snapshot includes a plugin or theme update, install those versions on the site, then open the site in WP Triage and click Re-check updates at the top of the page. An issue that already shows an available update also has Re-check this update.
Re-check treats the pending version as installed and compares it to vulnerability data already stored for that plugin or theme. It does not contact WordPress and does not refresh the vulnerability database. The score and issue list update immediately. Last sync stays the time of the last plugin snapshot.
The site page labels the result as a re-check and lists the assumed versions. The next plugin sync — the daily cron or Send snapshot now — replaces that assumption with the inventory WordPress reports. If the component is still on the old version, the issue comes back.
Re-check is shown for plugin and theme vulnerabilities whose pending update falls outside the affected range, after vulnerability data for that component has been cached by a sync. PHP end-of-life, closed, and unmaintained issues stay until a snapshot changes them.
When the same finding repeats across many installs, suppress it from the triage view (On this site or On all sites under Suppress issue), the Recurring issues panel on Sites, or Settings → Suppressions. See Suppressing findings for scope and when to pause a site instead. After you install an update the issue already listed, use Re-check above to rescore before the next snapshot.