Shake Connect is the site-side companion to the WPShake dashboard at wpshake.com. Install it on each WordPress site you want to monitor, then add the site to your WPShake account using the connection token shown on the plugin’s settings page. The dashboard then runs daily checks across every connected site without you logging into each one.

What Shake Connect adds to this site

A bearer-token-authenticated REST API under /wp-json/wpshake/v1/* that the WPShake dashboard calls to read site state.
Endpoints for: plugin and theme inventory with available updates, core info, WP checksums, database health, recent WooCommerce orders if WooCommerce is installed, recent PHP errors from WP_DEBUG_LOG, backup-plugin detection (UpdraftPlus, BlogVault, BackWPup, Solid Backups, WPvivid, Duplicator), the activity log (plus the WP Activity Log plugin’s table when that plugin is installed), a built-in malware signature scanner, and a broken-link checker.
Maintenance endpoints scoped to safe operations: cache flush across popular caching plugins, run-due WP-Cron, expired-transient cleanup, permalinks flush.
A WP-CLI subcommand wp wpshake for token rotation and status checks.

Activity log

Shake Connect records who did what on the site and keeps it in its own database tables. Open it from the Activity log menu in the WordPress admin.

Sign-ins, failed logins, user and role changes, application passwords, plugin, theme and core changes, settings, menus, widgets, cron and file edits.
Posts, pages, custom post types, media and terms, with the fields that changed.
WooCommerce orders, products, coupons, stock and store settings when WooCommerce is active.
Yoast SEO, Rank Math, Redirection, ACF, Gravity Forms, WPForms, TablePress, Termly, Two Factor, bbPress, LearnDash, MemberPress, Paid Memberships Pro and MainWP when those plugins are active.
A log viewer with filters, saved searches, notes, CSV and JSON export, and a dashboard widget.
A list of logged-in users, with the option to end a session and to limit how many sessions each role may hold.
Scheduled email reports.
Copies of the log to a local file or to a destination you choose: syslog, Papertrail, Loggly, Slack, AWS CloudWatch Logs, an HTTPS webhook or an external MySQL database.
Events made by AI agents and automation tools are tagged with the agent behind them.
A setup wizard, retention settings, and wp shake activity commands for WP-CLI.

Once the site is connected to WPShake, the dashboard also keeps an off-site copy of the log.

How the connection works

Install and activate Shake Connect.
Open Settings Shake Connect in the WordPress admin to generate a connection token. The token is shown once.
Sign up at wpshake.com, click “Add a site”, paste the token and your site URL.
The dashboard performs an initial handshake and pulls site state.

The token is stored as a SHA-256 hash on this site. The dashboard sends the plain token in an Authorization: Bearer header on every request. Every authenticated endpoint validates the header before doing anything.

Built for agencies

If you maintain more than a handful of WordPress sites, you already know the work. Shake Connect is the receiver for an agent that handles the daily checks across your fleet: backup verification, plugin and theme update visibility, vulnerability scanning, performance probes, PHP error monitoring, broken link checks, and per-site recommendations on what to update and what to hold.

The WPShake dashboard is a separate paid service. This connector plugin is free and open source under GPL.

Multisite

Shake Connect supports WordPress multisite. Network-activate the plugin and the connection token is stored at the network level so every subsite shares the same credentials. Enumerate subsites via /network/sites and pass ?blog_id=N to per-site read endpoints (for example /site/info?blog_id=3 or /plugins?blog_id=3) to inspect each subsite. Without blog_id, requests run against the main site. Enumeration is capped at 500 subsites per call.

External services

Shake Connect contacts the services below. Each one is either the WPShake dashboard you connect the site to, or a destination you add yourself.

WPShake dashboard

The site sends activity log events to WPShake so the dashboard keeps an off-site copy of the log. This starts only after you connect the site to your WPShake account and the dashboard sets up the connection with your bearer token. Events are sent at the end of the page request that recorded them, and once a day for any the dashboard hasn’t confirmed. Each event holds its type and severity, the time, the user ID, username and roles, the visitor’s IP address and browser user agent, the affected object’s type, ID and name, the subsite ID and a few event-specific details. Requests go to the WPShake ingest address the dashboard provides (for example https://ingest.example.com/activity) and are signed with a key shared during setup.

Service: wpshake.com. Terms of service, privacy policy.

Log mirrors you configure

Under Activity log, Mirrors, you can copy the log to destinations of your own. Nothing is sent until you add one. Each mirror receives the same event fields as above, plus the site address and a readable message. A background job sends new events about once a minute.

Papertrail: syslog messages over TLS or UDP to the host and port from your Papertrail account (for example logs.example.com:12345). Terms, privacy.
Loggly: HTTPS requests to https://logs-01.loggly.com/bulk/, with your customer token. Terms, privacy.
Slack: messages listing each event’s severity, description, username and type, sent to the incoming webhook URL you enter (for example https://hooks.slack.com/services/T000/B000/XXXX). Terms, privacy.
AWS CloudWatch Logs: signed HTTPS requests to https://logs.<region>.amazonaws.com/ for the region, log group and stream you choose. Terms, privacy.
HTTPS webhook: JSON batches, signed with your secret, to the URL you enter (for example https://hooks.example.com/activity). The terms and privacy policy are those of whoever runs that address.
Syslog: messages over UDP, TCP or TLS to the server and port you enter (for example syslog.example.com:514). The terms are those of whoever runs that server.
External MySQL or MariaDB: rows written to a table in the database server you enter (for example db.example.com:3306). The terms are those of whoever runs that server.

Broken-link checks

When the WPShake dashboard asks for a link check, the site sends a HEAD request (or a GET, if the server refuses HEAD) to each link found in its own content, to read the response status. Only the URL is requested, nothing else is sent. These go to whichever sites your content links to. The Recheck now action in Tools > Broken Links sends the same request for one link when an editor clicks it. Addresses on private or internal networks are never requested.

When an editor dismisses or restores a link in Tools > Broken Links, the site also tells the WPShake dashboard, so both show the same list. The request goes to the WPShake ingest address (the same one as the activity log, with a different path) and is signed with the key shared during setup. It carries the site ID, the link URLs and the editor’s username. It is sent only after the dashboard has set up the connection.

Scheduled activity reports are emailed through this site’s own mail setup.