# WPExit > WPExit turns a WordPress site into a fast static version at the same URLs, hosts it, and lets you make changes by chat. Built by Bit Source in Pikeville, Kentucky. # Leave WordPress. Arrive at the web that is coming. URL: https://wpexit.io/ Description: WPExit moves your site off WordPress and PHP onto fast static hosting at the same URLs, then rebuilds it for people and for the AI agents that increasingly visit on their behalf: readable as Markdown, described in schema.org, reachable over MCP, signed so anyone can verify it, and under your own AI access policy. Measured on 22 real sites. Site: WPExit (Bit Source, Pikeville, Kentucky) Same URLs. A fraction of the weight. No plugin updates ever again. And a site that is ready for the next visitors: AI agents that read, compare and book on people's behalf. [Try it with your URL](https://wpexit.io/#try) · [What agent-ready means](https://wpexit.io/agent-ready/) ## Built for the web that is coming More of the web's traffic is arriving as software acting for a person: an assistant comparing contractors, a model answering a question about your hours, an agent filling in your quote form. Pages built for ten years ago are hard for them to read and impossible for them to trust. Every Rebuild ships with the pieces that make a site work in that world: - **Readable by machines.** Every page has a Markdown twin, an `llms.txt` index, and schema.org data for the business, the pages and what can be spoken aloud. - **Act, don't scrape.** Each site gets a hosted MCP server: agents list pages, read them, search, and submit your forms as tools, under your rules. - **Verifiable.** Every build is signed. A manifest lists the hash of every page and anyone can check the signature against the site's published key. - **Your AI policy.** Open, attribution required, or closed: stated once, published in robots.txt, llms.txt and the agent manifest. - **Fast everywhere.** Pages under 150 KB load on satellite links and old phones as well as on fiber. - **Yours to take.** The whole site is a folder of files and Markdown. Download it any time; there is nothing to export from. The detail, including what is shipping today and what is on the road map, is on [Agent-ready](https://wpexit.io/agent-ready/). ## How it works 1. **Install the plugin.** A thin WordPress plugin inventories your site: plugins, forms, post types, menus. It sends nothing until you click Connect, and it never sends content, comments, or accounts. 2. **See your preview.** We crawl the public site the way a visitor would and build it at a private preview address. You get the link by email, usually the same day. 3. **Pick Freeze or Rebuild.** Freeze is a pixel-faithful copy of the site you have. Rebuild is a lean, agent-ready version of the same pages at the same URLs: accessibility and schema checks, Markdown and MCP for AI agents, a signed build, your AI policy, and chat editing on top. 4. **Go live.** Point your domain at us from any registrar, or connect Cloudflare in one click; the portal detects your DNS host and shows the exact records. TLS is issued on demand. Leave your WordPress host up for 14 days as a fallback, then cancel it. The long version, including what happens to forms, search, and comments, is on [How it works](https://wpexit.io/how-it-works/). ## Pricing Two monthly plans and one $50 migration fee per site. No contract. - **Freeze**: $10/month. A pixel-faithful static copy of your site, hosted. The on-ramp and the safety net. Includes: Hosting with TLS on your domain; Same URLs and redirects; Forms keep working, with email notifications; Move to Rebuild whenever the site needs editing; Download your files any time. - **Rebuild + AI editor**: $25/month. The same pages, rebuilt lean and agent-ready. Edits by chat, approved by you. Includes: Everything in Freeze; Home page typically under 150 KB and under 10 requests; WCAG 2.2 AA checks and remediation on every build; schema.org, llms.txt, and a Markdown mirror of every page; A hosted MCP server: agents read your pages and use your forms as tools; Signed provenance manifest on every build, with your site's public key; Your AI access policy: open, attribution required, or closed; AI-assisted editing: ask for a change in chat, approve it, undo it. - **One-time migration**: $50 once, per site, whatever its size. Crawl, build, review, launch. One fee per site, however many pages it has. - The migration fee is one-time and the same for every site: $50, charged with your first month. It covers the crawl, the build, the review, and going live. A ten-page brochure and a nine-hundred-page archive pay the same. - No contract. Cancel from the portal and your files are yours to download. - Stores, memberships, courses, forums, and directories do not fit a static site. We tell you that at the preview stage, before you pay anything. ## Questions people ask first ### What breaks when the site goes static? Anything that ran PHP on each visit. Forms are the common one, and they keep working: we point them at our forms endpoint and email you each submission. Site search is replaced with a static index built at publish time, so it keeps working without a server. Comments become read-only; new comments are a server feature and we tell you up front if you depend on them. Stores, memberships, courses, forums, and directories do not fit; we flag those at the preview stage and you pay nothing. ### How do I make changes without WordPress? On the Rebuild plan you ask for the change in chat: fix a phone number, swap a photo, add a paragraph, post a notice. Low-risk text edits apply right away with an undo. Larger changes wait for your approval before they go live. Every change is versioned, so any version can be restored. Freeze is for a site that does not change; when it needs to, move to Rebuild and the editor works from the same snapshot. ### What about my domain? You keep it, at any registrar. The portal walks you through a verification record, then an A or CNAME record. If your DNS is on Cloudflare, it is one click. TLS certificates are issued automatically when the first request arrives. ### What about email? WPExit does not host mailboxes, and your existing email is not affected by moving the website. The only mail we send is form notifications: each submission goes to the addresses your form plugin used, or ones you choose. You can add DNS records so those notifications come from your own domain. ### Can I go back? Yes. Your WordPress install is yours and untouched. Once your domain points at us, your WordPress install is no longer reachable at that name. We suggest leaving it up for 14 days as a fallback, then cancelling the hosting. If you keep it running for editing on the Freeze plan, put it behind a private hostname and HTTP authentication; we will help you set that up. Going back means pointing your DNS at it again. Every snapshot we build is also kept, and you can download the files at any time. ### Is this ADA compliant? We do not make legal claims about compliance. What we do: every Rebuild runs WCAG 2.2 AA checks (axe-core) at build time, serious and critical issues block publishing, and we remediate what the checks find in the templates and content. The measured violation count is in each site's build report. More on the [FAQ page](https://wpexit.io/faq/). ## Try it with your URL Give us the address of a WordPress site you own. We crawl the public pages, build a preview, and email you a link to look at. No plugin needed for the preview; nothing changes on your site. POST https://app.wpexit.io/api/f/wpexit-try (application/x-www-form-urlencoded) with fields: url (url, required), email (email, required). Hidden fields: _wpexit_form=wpexit-try. Previews are private and expire after 14 days. We crawl only what the public can already see. --- # From WordPress to a static site, step by step URL: https://wpexit.io/how-it-works/ Description: What the WPExit plugin sends, what the crawl does, how Freeze and Rebuild differ, and what happens to forms, search, comments, your domain, and edits after launch. Site: WPExit (Bit Source, Pikeville, Kentucky) Four steps. Nothing on your WordPress site is changed at any point; we read it and build beside it. ## The four steps 1. **Install the plugin.** A thin WordPress plugin inventories your site: plugins, forms, post types, menus. It sends nothing until you click Connect, and it never sends content, comments, or accounts. 2. **See your preview.** We crawl the public site the way a visitor would and build it at a private preview address. You get the link by email, usually the same day. 3. **Pick Freeze or Rebuild.** Freeze is a pixel-faithful copy of the site you have. Rebuild is a lean, agent-ready version of the same pages at the same URLs: accessibility and schema checks, Markdown and MCP for AI agents, a signed build, your AI policy, and chat editing on top. 4. **Go live.** Point your domain at us from any registrar, or connect Cloudflare in one click; the portal detects your DNS host and shows the exact records. TLS is issued on demand. Leave your WordPress host up for 14 days as a fallback, then cancel it. ## What the plugin sends The plugin is deliberately thin. It does nothing until an administrator clicks Connect. Then, on request, it sends an inventory: WordPress and PHP versions, the theme, the plugin list, public post type and taxonomy counts, menus, media count, form plugins and their notification addresses, shortcodes in use, and public URL counts. No post content, no comments, no accounts, no passwords. When we crawl, the plugin recognizes our signed requests and turns off caching, minification, lazy loading, the admin bar, and head noise so the copy is clean. It also hands the crawler a complete list of your public URLs and redirect rules, so no page is missed. The full disclosure is on the [plugin page](https://wpexit.io/plugin/). ## What the crawl does Two passes. An HTTP pass fetches every URL on the manifest and every asset those pages reference. A browser pass renders each page in Chrome to catch what scripts added. The result is a snapshot: a signed archive of files that is the input to both Freeze and Rebuild. Along the way we score the site for compatibility. Forms, search, and galleries are fine. Stores, memberships, courses, forums, and directories are blockers; a site with one is quoted as a consult, and a site with three or more is declined at the preview stage with an explanation. ## Freeze and Rebuild **Freeze** serves the snapshot as-is: every page, every image, every stylesheet, at the same URL. It looks exactly like your site because it is your site, minus PHP. It is ready in minutes and it is the safety net under everything else. **Rebuild** uses the snapshot and the structured export to regenerate the same pages as a lean Astro site: system fonts, inlined CSS, responsive images, no builder scripts. Same URLs, same redirects. On the 22 sites measured so far the median home page went from 5.6 MB to 128 KB and from 108.5 requests to 3. Every Rebuild passes through build-time gates before it can be published: weight budgets, URL and redirect preservation, WCAG 2.2 AA checks with remediation, schema.org markup, an llms.txt index, a Markdown mirror of every page, a machine-readable agent manifest, a signed provenance manifest, and your AI access policy in robots.txt. Each rebuilt site also gets a hosted MCP endpoint so agents can read and act instead of scraping. This marketing site is built the same way; append `index.md` to any URL here. More on [Agent-ready](https://wpexit.io/agent-ready/). ## Forms, search, comments - **Forms** keep their fields and their look. Submissions post to our endpoint, are stored in your portal, and are emailed to the addresses your form plugin used. - **Search** is rebuilt as a static index generated at publish time. It works without a server and without sending queries anywhere. - **Comments** are preserved as published text. New comments need a server; if they matter to your site, we say so at the preview stage. - **Redirects** from your WordPress install and from redirect plugins are carried over, so old links keep landing. ## Going live You approve the preview and pay from the portal. The portal then asks you for one DNS record to prove you control the domain, then an A or CNAME record (or a one-click Cloudflare connection). Certificates are issued on demand when the first request arrives. Once your domain points at us, your WordPress install is no longer reachable at that name. We suggest leaving it up for 14 days as a fallback, then cancelling the hosting. If you keep it running for editing on the Freeze plan, put it behind a private hostname and HTTP authentication; we will help you set that up. ## Editing after launch On Rebuild, changes happen in chat. Describe what you want: a new phone number, a replaced photo, a notice on the home page, a new page for a service. Low-risk text edits apply immediately with an undo. Anything larger is shown to you first and waits for approval. Structural changes, like a new section type, are escalated to a person. Every published version is kept and can be restored. Freeze is for a site that does not change. When it needs to, move to Rebuild: the editor works from the same snapshot, and the monthly price is the only difference. [Try it with your URL](https://wpexit.io/#try) · [See pricing](https://wpexit.io/pricing/) --- # A site for people, and for the agents acting on their behalf URL: https://wpexit.io/agent-ready/ Description: What WPExit ships so a rebuilt site works in a web where AI agents read, compare and act for people: Markdown and schema.org, a hosted MCP server, signed provenance, an AI access policy, portability, and speed on any connection. Shipping today versus road map, stated plainly. Site: WPExit (Bit Source, Pikeville, Kentucky) The pattern of search, click ten links, read is giving way to ask, get an answer, maybe verify. Websites are starting to serve two kinds of visitor: people on screens, and software that reads, compares, books and buys on a person's behalf. Here is what a WPExit Rebuild does about that, with no vapor. ## Shipping today ### Readable by machines Every page is published twice: as HTML for people and as Markdown at the same URL plus `index.md`. An `llms.txt` index lists every page with a one-line description, and `llms-full.txt` carries the whole site in one file. schema.org data describes the business (LocalBusiness or Organization), each page, and which parts should be spoken aloud by voice assistants. Headings, landmarks and alt text are checked on every build, which is what makes a page legible to a model as well as to a screen reader. ### Act, don't scrape: a hosted MCP server per site Model Context Protocol is how AI applications connect to tools. Each rebuilt site gets its own endpoint, advertised in the site's agent manifest and llms.txt. An agent that finds it can call `site_info`, `list_pages`, `get_page`, `search`, `list_forms` and `submit_form`: read your pages as clean Markdown, find the one that answers the question, and send a contact or quote request through your real form, which notifies you by email exactly as a visitor's would. No HTML parsing, no guessing, and your AI access policy is the first thing it is told. ### Verifiable: every build is signed When synthetic text and images are everywhere, the useful question stops being is this real and becomes who published this, and has it changed. Every Rebuild publishes `/.well-known/provenance.json`: the SHA-256 of every page and text file, signed with an Ed25519 key that is unique to your site, with the public key beside it. Anyone, human or agent, can fetch a page, hash it, and confirm it is the version you published. The key stays with us encrypted; only its public half ships. ### Your AI access policy You choose how AI systems may use your content: **open**, **attribution required** (answers must link to the page used), or **closed** (the known AI crawlers are disallowed). The choice is published in three places that machines actually read: robots.txt, llms.txt and the agent manifest. Search engines are always welcome. ### Fast on any connection A rebuilt home page is typically under 150 KB in under 10 requests, measured on 22 sites. That matters on satellite internet and old phones, and it matters to agents, which pay for every byte they read. ### Yours to take anywhere There is no database and no proprietary format. Your site is a folder of HTML, Markdown and images that any static host on earth can serve. Download it from the portal at any time. Social profile links carry `rel="me"`, so identity verification on the open social web (Mastodon and friends) works from your own domain. ## On the road map - **Content credentials for images.** C2PA manifests attached to the photos you publish, so an image can carry who published it and when. - **Paid and metered access.** A way to let AI crawlers in for a price or a license, for sites whose content is the product. - **Richer actions.** Bookings, availability and structured offers exposed as MCP tools, for the businesses that have them. - **Portable identity.** One-click verification of your domain for Bluesky and the fediverse. ## What this is not It is not a chatbot bolted onto your site, and it does not send your content anywhere. It is your site, built so that the software now visiting it can understand it, act through it, and prove it came from you. Freeze keeps your site exactly as it is; Rebuild is where the above lives. [Try it with your URL](https://wpexit.io/#try) · [See pricing](https://wpexit.io/pricing/) --- # Two plans, one migration fee, no contract URL: https://wpexit.io/pricing/ Description: WPExit pricing: Freeze hosting $10 a month, Rebuild with AI editor $25 a month, and a one-time $50 migration fee per site, whatever its size. Site: WPExit (Bit Source, Pikeville, Kentucky) The monthly plan pays for hosting and, on Rebuild, for the editor. The migration fee pays for the work of moving: crawl, build, review, launch. ## Plans - **Freeze**: $10/month. A pixel-faithful static copy of your site, hosted. The on-ramp and the safety net. Includes: Hosting with TLS on your domain; Same URLs and redirects; Forms keep working, with email notifications; Move to Rebuild whenever the site needs editing; Download your files any time. - **Rebuild + AI editor**: $25/month. The same pages, rebuilt lean and agent-ready. Edits by chat, approved by you. Includes: Everything in Freeze; Home page typically under 150 KB and under 10 requests; WCAG 2.2 AA checks and remediation on every build; schema.org, llms.txt, and a Markdown mirror of every page; A hosted MCP server: agents read your pages and use your forms as tools; Signed provenance manifest on every build, with your site's public key; Your AI access policy: open, attribution required, or closed; AI-assisted editing: ask for a change in chat, approve it, undo it. - **One-time migration**: $50 once, per site, whatever its size. Crawl, build, review, launch. One fee per site, however many pages it has. - The migration fee is one-time and the same for every site: $50, charged with your first month. It covers the crawl, the build, the review, and going live. A ten-page brochure and a nine-hundred-page archive pay the same. - No contract. Cancel from the portal and your files are yours to download. - Stores, memberships, courses, forums, and directories do not fit a static site. We tell you that at the preview stage, before you pay anything. ## What is included in both plans - Hosting on your own domain with automatic TLS and HTTP/3 - Every URL and redirect preserved - Forms kept working, with submissions stored in your portal and emailed to you - A preview address for every build before it goes live - The previous version kept, one click to restore - Your files, downloadable at any time ## Sites that do not fit Stores, memberships, courses, forums, directories, and anything else that needs a database on every visit. The compatibility score tells us at the preview stage, and we tell you. For some of these a structured export into a modern stack is possible as a consulting project; ask on the form below. ## Agencies Running several sites? The [agencies page](https://wpexit.io/for-agencies/) covers how a portfolio works and who holds approval for changes. ## Talk to a person Questions about a specific site, an agency arrangement, or something that does not fit the pricing page? Write to us. We are a small team in Pikeville, Kentucky and we answer. POST https://app.wpexit.io/api/f/wpexit-contact (application/x-www-form-urlencoded) with fields: name (text, required), email (email, required), phone (tel), website (url), message (textarea, required). Hidden fields: _wpexit_form=wpexit-contact. We reply by email, usually within one business day. --- # Nothing to patch, nothing to log in to URL: https://wpexit.io/security/ Description: Why a static site is safer than WordPress: no PHP, no admin login, no plugin CVEs, no database. What WPExit stores, how TLS works, and what the plugin sends. Site: WPExit (Bit Source, Pikeville, Kentucky) Most WordPress compromises arrive through a plugin vulnerability, a weak admin password, or an unpatched PHP install. A static site has none of those surfaces. ## Why static - **No PHP.** The host runs a file server. There is no interpreter to exploit and no code that runs per request. - **No admin login.** There is no `/wp-admin`, no `/wp-login.php`, no `xmlrpc.php`. Requests for them are answered 410 Gone without touching disk, and repeat offenders are banned at the firewall. - **No plugin CVEs.** The plugins are gone with the PHP. There is nothing to update on a Tuesday night and nothing to fall behind on. - **No database.** Your content is files. There is no SQL to inject and no user table to dump. - **Strict headers.** `X-Content-Type-Options: nosniff`, `Referrer-Policy: strict-origin-when-cross-origin`, HSTS on the app, and no server banner. ## TLS and the edge Certificates are issued on demand by Caddy when the first request for your hostname arrives, after our control plane confirms the domain belongs to a customer. Renewal is automatic. HTTP/1.1, HTTP/2, and HTTP/3 are all served. We do not put a third-party CDN between you and your visitors unless you choose Cloudflare in front of us. ## What we store - Snapshot archives of your public site (the crawl) and the built outputs, in object storage with checksums, so any version can be restored. - The plugin inventory: versions, plugin names, counts, form notification addresses. No post content beyond what is public, no comments, no accounts. - Form submissions, in your portal, until you delete them. - Your account email and billing through Stripe. We never see card numbers. - Access logs on the host, rotated after seven days, used for abuse blocking. ## What the plugin sends Nothing until an administrator clicks Connect, and then only to the control plane shown on its settings page. The crawl authenticates with a per-site secret so caching plugins are bypassed. Disconnecting deletes the pairing credentials; uninstalling removes every option the plugin stored. The complete disclosure, in the plugin's own words, is on the [plugin page](https://wpexit.io/plugin/). ## What about the WordPress site itself? Once your domain points at us, your WordPress install is no longer reachable at that name. We suggest leaving it up for 14 days as a fallback, then cancelling the hosting. If you keep it running for editing on the Freeze plan, put it behind a private hostname and HTTP authentication; we will help you set that up. ## Reporting a problem If you find a security issue on a WPExit-hosted site or on this one, use the contact form on the [pricing page](https://wpexit.io/pricing/) and mark it urgent. We respond within one business day. --- # Questions and straight answers URL: https://wpexit.io/faq/ Description: What breaks when a WordPress site goes static, how edits work by chat, domains, email, going back, WCAG checks, timing, page counts, the plugin, and hosting. Site: WPExit (Bit Source, Pikeville, Kentucky) Everything we get asked before someone signs up, in one place. The short versions of the first six are on the home page. ## All questions ### What does agent-ready actually mean? Three concrete things on every Rebuild. Machines can read the site: each page has a Markdown twin, an llms.txt index and schema.org data. Machines can act through it: a hosted MCP server lets an AI assistant list and read pages, search, and submit your forms as tools, so a person can say "ask this company for a quote" and it happens through your real form. And machines can trust it: every build is signed, with a manifest of page hashes and a public key anyone can check. You also pick an AI access policy, open, attribution or closed, which is published where crawlers look. ### Can I keep AI companies from using my content? You choose. Closed disallows the known AI crawlers in robots.txt and says so in llms.txt and the agent manifest. Attribution lets them in on the stated condition that answers link to your page. Open is open. Search engines are always allowed. Like any robots policy it relies on crawlers honoring it; the well-known ones do, and the policy is also the record of what you permitted. ### What breaks when the site goes static? Anything that ran PHP on each visit. Forms are the common one, and they keep working: we point them at our forms endpoint and email you each submission. Site search is replaced with a static index built at publish time, so it keeps working without a server. Comments become read-only; new comments are a server feature and we tell you up front if you depend on them. Stores, memberships, courses, forums, and directories do not fit; we flag those at the preview stage and you pay nothing. ### How do I make changes without WordPress? On the Rebuild plan you ask for the change in chat: fix a phone number, swap a photo, add a paragraph, post a notice. Low-risk text edits apply right away with an undo. Larger changes wait for your approval before they go live. Every change is versioned, so any version can be restored. Freeze is for a site that does not change; when it needs to, move to Rebuild and the editor works from the same snapshot. ### What about my domain? You keep it, at any registrar. The portal walks you through a verification record, then an A or CNAME record. If your DNS is on Cloudflare, it is one click. TLS certificates are issued automatically when the first request arrives. ### What about email? WPExit does not host mailboxes, and your existing email is not affected by moving the website. The only mail we send is form notifications: each submission goes to the addresses your form plugin used, or ones you choose. You can add DNS records so those notifications come from your own domain. ### Can I go back? Yes. Your WordPress install is yours and untouched. Once your domain points at us, your WordPress install is no longer reachable at that name. We suggest leaving it up for 14 days as a fallback, then cancelling the hosting. If you keep it running for editing on the Freeze plan, put it behind a private hostname and HTTP authentication; we will help you set that up. Going back means pointing your DNS at it again. Every snapshot we build is also kept, and you can download the files at any time. ### Is this ADA compliant? We do not make legal claims about compliance. What we do: every Rebuild runs WCAG 2.2 AA checks (axe-core) at build time, serious and critical issues block publishing, and we remediate what the checks find in the templates and content. The measured violation count is in each site's build report. ### How long does it take? A preview is usually ready the same day. Going live takes as long as your DNS change: minutes on Cloudflare, up to a day elsewhere. ### What counts as a page? A public URL that returns HTML: pages, posts, category and tag archives, and so on. Images, PDFs, and the one-image attachment pages WordPress makes for every upload do not count; we keep those addresses working by redirecting them to the file. Page count sets expectations for the crawl, not the price: the migration fee is the same for every site. ### Do I have to install the plugin? Not for the preview; we crawl what the public can see. For the migration itself, yes. The plugin gives the crawler a complete list of your URLs and redirects, lets it bypass caching so the copy is clean, and tells us which forms notify which addresses. It sends nothing until you click Connect. ### Where is the site hosted? On servers we run in a US data center, behind Caddy with HTTP/3 and automatic TLS. There is no PHP, no database, and no admin login on the host. The security page lists exactly what we store. ### Freeze or Rebuild: which should I pick? Freeze if you want the site exactly as it looks today and you still edit in WordPress. Rebuild if you want the speed and accessibility gains, and you would rather make changes by chat than keep a WordPress install around. You can start with Freeze and move to Rebuild later; both are built from the same crawl. Something not covered? Use the form on the [pricing page](https://wpexit.io/pricing/). --- # Run your clients' sites through it URL: https://wpexit.io/for-agencies/ Description: WPExit for agencies and freelancers: move a portfolio of WordPress sites to static hosting with measured results, volume pricing, and a portal per client. Proven on 34 real sites. Site: WPExit (Bit Source, Pikeville, Kentucky) If you maintain a dozen brochure sites for local clients, you spend your Tuesday nights on plugin updates and your weekends on the one that got hacked. We built WPExit for exactly that portfolio. ## The proving ground Before we offered this to anyone, we ran 34 real sites through it: city and county governments, health departments, nonprofits, small manufacturers, a water company. 22 have finished a Rebuild so far. Median home page: 5.6 MB to 128 KB, 108.5 requests to 3. ## How it works for a portfolio - Install the plugin on each site; the inventory tells you the page count and the compatibility score before anyone commits. - Previews are built in batch. Review them side by side with the originals. - Each client gets a portal scoped to their site: preview, go-live, domain, form submissions, and the change chat. You can hold the login or hand it over. - Pricing is the same ladder as for a single site, and you choose whether to pass it through or bundle it into your retainer. - Change requests your clients would have sent you go to the chat instead. You see every proposed change and can keep approval for yourself. ## What we need from you A list of the sites, admin access to install the plugin or someone who has it, and a decision on who holds approval for changes. Everything else is self-serve. [Talk to us about a portfolio](https://wpexit.io/pricing/#form-marketing) --- # The plugin: thin by design URL: https://wpexit.io/plugin/ Description: Download the WPExit WordPress plugin, install it in four steps, and read exactly what it sends and when. Requires WordPress 5.9 or later and PHP 7.4 or later. GPLv2. Site: WPExit (Bit Source, Pikeville, Kentucky) The plugin inventories your site, pairs it with WPExit, and gives our crawler a clean read. It does nothing and contacts nobody until an administrator clicks Connect. [Download the plugin (zip)](https://app.wpexit.io/api/plugin/download) Requires WordPress 5.9 or later and PHP 7.4 or later. Licensed GPLv2 or later. Version 0.1.0. ## Install 1. Upload the `wpexit` folder to `/wp-content/plugins/`, or install the zip from the Plugins screen. 2. Activate the plugin. 3. Go to **Settings, WPExit**, copy the pairing code into the WPExit app, then click **Pair now**. 4. Click **Run inventory now**, review the summary, then **Send to WPExit**. ## What it does - **Inventory.** Counts plugins, themes, post types, taxonomies, media, menus, users, comments, shortcodes, forms, and a handful of dynamic-behaviour signals. Nothing is sent until you click Send. - **Pairing.** A one-time code links the site to your WPExit account. - **Manifest.** A paginated list of every public URL and redirect rule, so the crawler never misses a page. - **Content export.** Rendered and raw post content, menus, and a safe allowlist of options such as the site title. - **Crawler mode.** When a request is signed by WPExit, caching, minification, lazy loading, the admin bar, and head noise are disabled so the crawl is clean. All crawler-facing endpoints require an HMAC signature derived from a per-site secret issued at pairing time. The secret is stored in `wp_options` and never printed anywhere. On normal front-end requests the plugin only checks for two request headers; it does not slow your site down. ## Privacy and external services This plugin does nothing and contacts nobody until an administrator clicks **Connect to WPExit**. After that it communicates only with the WPExit control plane shown on its settings page. What is sent, and when: - **On connect:** the site URL, the pairing code, the plugin version, and the administrator's email address and site name, so WPExit can create the owner's portal account and email a sign-in link. - **When you send an inventory:** WordPress and PHP versions, the active theme, the list of installed plugins and whether each is active, public post type and taxonomy counts, menu names, media count, form plugin names and their notification addresses, shortcodes in use, whether search or private posts exist, custom database table names, and public URL counts. No post content, no comments, no user accounts or passwords. - **When WPExit crawls your site after pairing:** it requests your public pages like any visitor, authenticated with a per-site secret so caching plugins are bypassed. On request it can also read a structured export of published posts and pages (the same content any visitor can see), your menus, and a small allowlist of options. Nothing is sent on a schedule and nothing is sent to anyone other than the control plane you connected to. Disconnecting deletes the pairing credentials from your site. Uninstalling removes every `wpexit_*` option and the plugin's transients. ## Next Once the inventory is in, the app shows your compatibility score and page count and starts the preview. [How it works](https://wpexit.io/how-it-works/) covers the rest. ---