Take it further

Bynefit Connect for WordPress

Connect a WordPress site to your Bynefit team. Reports daily usage to Bynefit, gives you one place to manage every site you run, and (coming soon) lets you drop Bynefit forms, events, and donate flows into any WP page with a shortcode.

Who this is for: teams who run their site on WordPress instead of (or alongside) a Bynefit-hosted site. The Connect plugin makes WP a first-class part of the Bynefit dashboard.

What it does today (v0.1)

Daily usage reporting — storage in bytes, WP/PHP version, plugin version. No user data, no post content. Server-to-server only.
Heartbeat test button — verify your key + signature work end-to-end from the WP admin.
HMAC-signed payloads — every request is signed with a per-site key. Bynefit rejects replayed or unsigned requests.

What's coming next (v0.2)

[bynli-form id="frm_xxx"] — drop any Bynefit form into a WP page
[bynli-events] — your team's upcoming events as a Bootstrap-styled list
[bynli-donate] — a one-click donate card with your team's preset amounts
Auto-update from the WordPress.org plugin directory

Install

Open /dash/sites in Bynefit.
In the Managed WordPress sites panel, click Register a site. Fill in the slug, your WP URL, and host provider. Save.
Open /dash/sites/host-keys. Pick the site you just registered and click Generate key. Copy the plaintext key NOW — it's only shown once.
Download the Bynefit Connect plugin ZIP from the releases page.
In WordPress: Plugins → Add New → Upload Plugin → choose the ZIP → Install Now → Activate.
In WordPress: Settings → Bynefit Connect. Paste the key you copied. Save.
Click Send heartbeat. You should see "Heartbeat sent successfully. Bynefit received the ping."

Verify in Bynefit

Back in Bynefit, open /dash/sites/host-keys. The Last used column for your key should now show a recent timestamp and the IP address of the cPanel that sent the heartbeat. That's the loop closed.

What lives where

Where	What it does
`/dash/sites`	Register or remove managed WordPress sites. Each site is one row in the Managed WordPress sites panel.
`/dash/sites/host-keys`	Issue and revoke signing keys, one per site. The plaintext key is shown once at creation; only the prefix is visible after. Revoke any time — the WP plugin stops being able to report immediately.
`github.com/bynefit/bynli-wp`	The plugin's source repo. Public, GPL-2.0+, no build step. File issues there.
`POST /api/site-host/report`	The signed endpoint the plugin hits. `Authorization: Bearer <bynli_sh_…>` + `X-Bynli-Timestamp` + `X-Bynli-Signature: sha256=<hex>`.

What gets sent

Only the platform-level signals Bynefit needs to right-size your plan and bill accurately:

{
  "kind": "daily",
  "usage_date": "2026-06-04",
  "bandwidth_bytes": 0,
  "storage_bytes":   314572800,
  "request_count":   0,
  "meta": {
    "wp_version":     "6.6.2",
    "php_version":    "8.2.18",
    "plugin_version": "0.1.0",
    "home_url":       "https://your-site.example.com",
    "measurement":    "best_effort_v1"
  }
}

No post content. No user emails. No visitor information. The plugin walks ABSPATH to total file sizes; that's the only storage signal. Bandwidth and request counts are reported as 0 until we add server-log parsing per host provider.

Key security

Per-site keys — compromise of one site doesn't expose others.
SHA-256 hashed at rest — Bynefit never stores the plaintext after issuance.
HMAC-SHA256 over timestamp + "\n" + body, ±300s replay window.
Revoke instantly from /dash/sites/host-keys — the plugin stops being able to report on the next request.

Troubleshooting

Heartbeat fails with "unauthorized": Your key was revoked, mistyped, or you pasted a key for a different site. Double-check the slug at /dash/sites/host-keys matches the slug you registered.
Heartbeat fails with "signature_invalid": The WP server's clock is more than 5 minutes off from Bynefit's. Check the WP host's NTP / system time.
Plugin settings page is empty after install: You're not logged in as a WordPress administrator. Bynefit Connect requires the manage_options capability.
"No wp_managed sites yet" on /dash/sites/host-keys: You haven't registered a managed WordPress site yet. Go to /dash/sites and use the Register a site button first.

Embed on your site — the lighter-weight floating widget for non-WP hosts
Site config (config.json) — for Bynefit-hosted sites, the equivalent of this plugin's settings
Developer docs — public API, webhooks, OAuth