# WP Octo Documentation

> How to manage a fleet of WordPress sites with WP Octo: updates, backups, monitoring, the worker plugin on every site, and the API.

Every page is also available as Markdown by appending `.md` to its URL, and the whole set as https://wpocto.com/docs/llms-full.txt.

# Docs

- API: The HTTP API of the platform, for integrations.
  - [API overview](https://wpocto.com/docs/api): A small, versioned HTTP API for reading a workspace's data from an integration.
  - [Authentication](https://wpocto.com/docs/api/authentication): A workspace API key, sent as a bearer token.
  - [Authorization](https://wpocto.com/docs/api/authorization): What a key can read, and the one rule that decides it.
  - [Pagination and sorting](https://wpocto.com/docs/api/pagination): How list endpoints page and sort.
  - [Errors](https://wpocto.com/docs/api/errors): The status codes the API answers with, and what each means.
  - [Changes](https://wpocto.com/docs/api/changes): What was added to or changed in the API, by application release.

  - **Reference**
  - [API reference](https://wpocto.com/docs/api/reference): Every endpoint of the WP Octo HTTP API, generated from its OpenAPI description (version 1).
  - Websites
    - [List the websites of the caller's workspace](https://wpocto.com/docs/api/reference/websites/get-dashboard-websites)
- Application: The WP Octo dashboard, from the first site to what changed.
  - [What WP Octo does](https://wpocto.com/docs/application): A dashboard for a fleet of WordPress sites, and a plugin on every site that does the work.
  - Getting started: From a new workspace to a connected, checked site.
    - [Getting started](https://wpocto.com/docs/application/getting-started): From a new workspace to a connected, checked site, in six short steps.
    - [Requirements](https://wpocto.com/docs/application/getting-started/requirements): What a site needs before WP Octo can look after it, and what WP Octo itself runs on.
    - [Account and workspace](https://wpocto.com/docs/application/getting-started/workspace): Your account, the workspace your sites live in, and who else can be in it.
    - [Add your first website](https://wpocto.com/docs/application/getting-started/add-your-first-website): Register a site in the dashboard so the platform knows it and the worker plugin can connect to it.
    - [Install and connect the worker](https://wpocto.com/docs/application/getting-started/install-the-worker): Put the WP Octo worker plugin on the site and pair it with the platform.
    - [First checks](https://wpocto.com/docs/application/getting-started/first-checks): What to look at once a site is connected, and what a healthy site looks like in the dashboard.
    - [Common next steps](https://wpocto.com/docs/application/getting-started/next-steps): Where to go once the first site is connected and checked.

  - **Your sites**
  - [Dashboard](https://wpocto.com/docs/application/dashboard): The fleet at a glance.
  - [Websites](https://wpocto.com/docs/application/websites): The list of sites, adding and editing one, connecting it, and the header every site page shares.
  - [Updates](https://wpocto.com/docs/application/updates): The update round — a backup, the updates, the checks, and the rollback when a check fails.
  - [Plugins, themes and core](https://wpocto.com/docs/application/plugins-themes-and-core): The site's inventory, and the one-at-a-time changes made from it.
  - [Backups](https://wpocto.com/docs/application/backups): How a site is backed up, where the copies go, what "completed" means, and how the records are kept honest.
  - [Restores](https://wpocto.com/docs/application/restores): Restoring a site from a backup, from either copy.
  - [Monitoring](https://wpocto.com/docs/application/monitoring): Uptime and certificate checks on a site's pages, and the log of what they found.
  - [Regression pages](https://wpocto.com/docs/application/regression): The pages captured before and after an update round, and compared.
  - [Reports](https://wpocto.com/docs/application/reports): Lighthouse reports and thumbnails.
  - [Site users and login](https://wpocto.com/docs/application/site-users-and-login): The site's WordPress users, and logging in to a site without a password.
  - [Notes](https://wpocto.com/docs/application/notes): Free-form notes on a site.

  - **Your workspace**
  - [Clients](https://wpocto.com/docs/application/clients): The customers the sites belong to.
  - [Packages](https://wpocto.com/docs/application/packages): The service level a site is on.
  - [Team](https://wpocto.com/docs/application/team): Members and invitations.
  - [Roles and permissions](https://wpocto.com/docs/application/roles-and-permissions): What each role in a workspace may do.
  - [Workspace settings](https://wpocto.com/docs/application/workspace-settings): Name and details, API keys, storage and billing.
  - [Notifications](https://wpocto.com/docs/application/notifications): The emails the platform sends.
  - [Billing](https://wpocto.com/docs/application/billing): Plans, subscriptions, orders and transactions.
  - [Pages not yet available](https://wpocto.com/docs/application/pages-not-yet-available): Two pages exist in the navigation and say so.

  - **Security and data**
  - Security and data: What WP Octo protects, what it keeps, and how to report a problem.
    - [Security overview](https://wpocto.com/docs/application/security): WP Octo holds the keys to other people's WordPress installs. This section says how those keys are kept, and what is not checked.
    - [Accounts and access](https://wpocto.com/docs/application/security/accounts-and-access): Three kinds of caller — a person, an integration, a site — and how each is identified.
    - [Tenant isolation](https://wpocto.com/docs/application/security/tenant-isolation): A workspace never sees another workspace's data. That is the product, not a quality bar.
    - [Credentials](https://wpocto.com/docs/application/security/credentials): The two credentials WP Octo has, where each belongs, and how each is kept.
    - [Data handling](https://wpocto.com/docs/application/security/data-handling): What the platform stores about a site and a workspace, what it keeps from a site's contents, and for how long.
    - [Reporting a vulnerability](https://wpocto.com/docs/application/security/reporting): How to tell us about a security problem in the platform or the worker, privately.

  - **Help**
  - Troubleshooting: Organised by what you see.
    - [Troubleshooting](https://wpocto.com/docs/application/troubleshooting): Start from what the dashboard shows you; every status names its cause.
    - [Connection problems](https://wpocto.com/docs/application/troubleshooting/connection-problems): The platform cannot reach a site, or what it holds about a site is out of date.
    - [Worker errors](https://wpocto.com/docs/application/troubleshooting/worker-errors): A PHP error on the site, a worker that will not load, a lock that is held.
    - [Permissions](https://wpocto.com/docs/application/troubleshooting/permissions): Something is refused, or a page is not in the navigation.
    - [Hosting limitations](https://wpocto.com/docs/application/troubleshooting/hosting-limitations): What a host can do to get in the way, and what to change.
    - [Update failures](https://wpocto.com/docs/application/troubleshooting/update-failures): A round rolled back, a plugin was refused, or verification failed.
    - [Backup and restore issues](https://wpocto.com/docs/application/troubleshooting/backup-and-restore-issues): A backup that stopped, a copy that is missing, a restore that was refused.
    - [Something has not started](https://wpocto.com/docs/application/troubleshooting/operations-not-starting): An update round, a backup, a restore or a health check you started has not begun.
    - [Authentication issues](https://wpocto.com/docs/application/troubleshooting/authentication-issues): Signing in, two-factor, API keys, and tokens on sites.
  - [Changelog](https://wpocto.com/docs/application/changelog): What changed in the WP Octo application, by date. Newest first.
- Worker plugin: The WordPress plugin on every managed site.
  - [Worker plugin overview](https://wpocto.com/docs/worker): What the WP Octo plugin does on a managed site, and how it relates to the platform.
  - [Installation](https://wpocto.com/docs/worker/installation): Installing the worker plugin on a site and pairing it with a workspace.
  - [Requirements and hosting](https://wpocto.com/docs/worker/requirements-and-hosting): What the worker is built to run on, and the limits of shared hosting it is designed around.
  - [Hosting compatibility](https://wpocto.com/docs/worker/hosting-compatibility): Firewalls, bot protection and authentication plugins that interfere with the platform's calls, and what still works when they do.
  - [Connection](https://wpocto.com/docs/worker/connection): The one credential that pairs a site with its workspace, and the two directions the site and the platform talk in.
  - [Plugin updates](https://wpocto.com/docs/worker/updates): How a new worker release reaches a site, and how the site protects itself while installing it.
  - [Recovery](https://wpocto.com/docs/worker/recovery): What happens when an update breaks the plugin, when the platform is not there, and what a person has to do.
  - [What the plugin stores and trusts](https://wpocto.com/docs/worker/security): What the worker keeps on the site, what it trusts, and what it refuses.
  - [Versions](https://wpocto.com/docs/worker/versions): Which worker versions the application works with, and what changed between them that a site can notice.
  - [Troubleshooting the worker](https://wpocto.com/docs/worker/troubleshooting): The states the platform reports about a worker it cannot reach, what each means, and what to change.
  - [Changelog](https://wpocto.com/docs/worker/changelog): What changed in the worker plugin, per stable version. Newest first.