RS Remote Site Manager

Hỏi đáp

Where do I get my API credentials?

Log in to your Rootscope Remote Site Manager dashboard at https://wp-admin.online, add a new site, and you’ll receive your API Key and API Secret.

How often does the plugin sync data?

The plugin automatically syncs data once daily. You can also trigger a manual sync from the settings page.

Is my data secure?

Yes. All communication between your site and Rootscope Remote Site Manager is encrypted via HTTPS and authenticated using HMAC signatures.

How does the plugin resolve client IPs behind a reverse proxy or CDN?

Login and failed-login events record the originating client IP. By default, the plugin uses REMOTE_ADDR directly, and only consults forwarded headers (X-Forwarded-For, X-Real-IP) when REMOTE_ADDR is a private or reserved address (i.e. the request reached PHP from a local reverse proxy).

If your site sits behind a public reverse proxy (load balancer, CDN, etc.), define one or both of the following constants in wp-config.php so the plugin knows which upstream addresses are trusted to set forwarded headers:

define('RSADMIN_TRUSTED_PROXY_IPS', '203.0.113.0/24, 198.51.100.10');

Accepts a comma-separated string or an array of IPs/CIDR ranges (IPv4 and IPv6). When REMOTE_ADDR matches an entry, the plugin walks X-Forwarded-For right-to-left and returns the first IP that is not itself a trusted proxy — this prevents an attacker from spoofing the leftmost value.

define('RSADMIN_TRUSTED_CF_IPS', '173.245.48.0/20, 103.21.244.0/22');

Required if you rely on Cloudflare’s CF-Connecting-IP header. The plugin only honors that header when REMOTE_ADDR is in one of the configured Cloudflare edge ranges — without it, a non-Cloudflare proxy could forward a client-supplied CF-Connecting-IP value and falsify attribution. Use the official list at https://www.cloudflare.com/ips/. If you use the official Cloudflare WordPress plugin (which rewrites REMOTE_ADDR directly), you do not need to set this constant.