Site connector permissions: why some are off, and changing them from SEOmise

Open Settings → Connect your website → Site connector → Permissions in your project to see what the connector on your site may do, why each permission that is off is off, and how to turn it on.

Why some permissions are off

When a site connects, the connector allows the safe things: reading pages, improving titles and descriptions, editing approved text, internal links, new pages as drafts, undo, speed fixes and pictures. Everything else stays off until the site's owner turns it on, so a SEOmise account (or anyone who took one over) can never give itself power over a site:

• Publish new pages: new pages stay drafts until the owner lets them go live by themselves.
• Host the sponsored partners page: it puts sponsored partner cards on a page of the site, only for sites in the Publisher Network.
• Safe updates and Manage plugins: they change the code the site runs.
• Make backups: a backup copies the whole site and its database to storage.
• Restore backups: a restore replaces the site's files or database.
• Firewall: it adds a loader to the site and can block visitors.
• Filter form e-mails for spam: the site's form messages pass through SEOmise.

On WordPress, safe updates, plugins, backups, restores and the firewall run in SEOmise Connector Pro. When the WordPress screen says "Pro (included)", Pro is already running inside the plugin SEOmise sends, so these permissions work as soon as they are turned on. Without Pro, the row says so and Install Pro for me on the Site connector page installs it.

Changing a permission from SEOmise

The site always decides. There are two ways:

1. The site lets SEOmise change its permissions. In WordPress, open SEOmise → Permissions and switch on Let SEOmise change these permissions (it is off by default and shows a warning). On Laravel the developer sets 'remote_permissions' => true under services.seomise_connector in config/services.php; on the PHP file, SEOMISE_REMOTE_PERMISSIONS is set to true. From then on, a switch on the Permissions page changes the permission at once.
2. Ask the site's administrator (WordPress). Each switch sends a request. The administrator sees a notice in WordPress and gets an e-mail with Approve and Decline links, which open a page on their own site where they confirm with one click. The links work once and only for a few hours. Nothing changes until they approve.

Turning on Manage plugins, Restore backups, Firewall or Safe updates needs the current code from your authenticator app, even when you are signed in.

Every change is signed, logged in SEOmise and on the site, and e-mailed to the site's admin address. Revert beside a change on the Permissions page sends the opposite change; on WordPress the administrator can also press Undo beside it under SEOmise → Permissions.

Some permissions can never be changed from SEOmise: reading (always on while the site is connected) and the site's own Let SEOmise change these permissions switch.

An older connector

If the page says Update the connector to manage permissions from here, the site runs a connector from before this feature. Update the connector installs the newest version on the site (it checks the site still loads and puts the old version back if not). Until then, change permissions on the site itself.