DecaRoy Site Helper
DecaRoy Site Helper is a minimal plugin that adds a single REST API
endpoint to read, write, and delete a Google Site Verification meta tag
that is then injected into the document <head> on every page.
The plugin is intended for sites managed programmatically by automation
tools that need to verify domain ownership in Google Search Console
without giving the automation tool FTP or filesystem access.
Features
- Single REST endpoint at
/wp-json/decaroy/v1/head-meta - GET — read current configuration
- POST — set the Google Site Verification token (validated against
Google’s expected format) - DELETE — remove the configured token
- Token is rendered as
<meta name="google-site-verification" ...>
in the <head> viawp_headaction - No tracking, no phone-home, no remote calls
- No database tables, no cron jobs
How it works
When a token is set via POST, it is stored in a single WordPress option
(decaroy_gsc_verification_token). On every page render, the plugin
hooks into wp_head and emits a meta tag with the token. Google can
then read that meta tag during the verification step, after which the
domain becomes available to the verifying account in Search Console.
Authentication uses standard WordPress capabilities: the requesting
user must have manage_options (typically administrators). Pair with
WordPress Application Passwords for headless authentication.