Miroir Local Sync

Miroir keeps a local WordPress environment and one or more remote sites in sync, with an interface designed for non-technical users.

The same plugin embeds two roles: an orchestrator on the local site and an agent on each remote site. They communicate over the WordPress REST API (authenticated with Application Passwords) and, optionally, SFTP.

Features:

• Push (local to production) and Pull (production to local) of the database.
• Safe search-replace that handles PHP-serialized data, escaped JSON (Gutenberg blocks) and wp_options.
• Automatic snapshot and rollback before a database import.
• Comparison screen with a per-component diff and data-loss warnings.
• File deployment of specific themes and plugins.
• Editorial content merge by post type (GUID-matched, no deletion; WooCommerce excluded).
• One-click deployment shortcuts.
• REST (chunked) and SFTP transport.
• Live data protection on push: WooCommerce orders, customers, users, comments and reviews on the target keep their current state.
• Scheduled sync (WP-Cron): refresh your local copy from production automatically.
• WP-CLI commands (wp miroir status|compare|push|pull) for CI/CD and system crons.
• Webhook notifications (Slack, Discord, custom endpoint) in addition to email.
• CSV export of the activity log.
• File rollback: themes and plugins are snapshotted before deployment and can be restored, alongside database snapshots, from the Snapshots view.
• Streaming database import (constant memory) and one-pass search-replace, safe on hosts without shell access.
• SSH host key pinning on first SFTP pairing, and checksum-verified transfers.
• Activity log with per-site filters and pagination; keyboard- and screen-reader-friendly screens.

External services

Miroir only ever talks to servers you configure yourself. No data is sent to Sumotori or to any service belonging to the plugin’s author. The plugin contains no telemetry, no analytics, no licence check and no phone-home of any kind. If you pair no site and configure no SFTP host or webhook, Miroir makes no outbound request at all.

1. The remote WordPress sites you pair with

Address: the URL you type yourself when adding a site (for example https://example.com). There is no default and no suggested host.

What is sent: your WordPress username and Application Password for that site (HTTP Basic Auth, over the connection scheme of the URL you gave); database dumps produced from the current site; ZIP archives of the themes, plugins or media folders you selected; JSON bundles of the post types you chose to merge; and, when you ask for it, a ZIP of the Miroir plugin itself in order to update the remote agent.

What is received: the remote site’s status, its list of themes, plugins, media and content, its database dump when you pull, and the result of each operation.

When: only on an explicit action of yours (a push, a pull, a comparison, a deployment shortcut, an agent update) or on the schedule you enable yourself in Settings → Scheduled sync. Nothing is transmitted in the background otherwise.

This exchange is the entire purpose of the plugin: the site you pair with is your own, and the terms that apply are those of its host.

2. An SFTP host (optional)

If, and only if, you fill in the SFTP settings of a profile, Miroir connects to the host, port and account you entered, to deposit or fetch the transfer files (database dumps, ZIP archives) instead of passing them through the REST API. The host key is pinned on first connection and a changed key aborts the transfer. Leave these fields empty and no SFTP connection is ever made.

3. A notification webhook (optional)

If you fill in a webhook URL in Settings, Miroir sends one HTTP POST to that address after each real push or pull. The body is JSON and contains only: the source site address, the event name, the operation type, the target site name, whether it succeeded, and the list of steps with their status. No credentials and no site content are included. Leave the field empty and nothing is sent.