Download

Upgrading to 1.7.0

Plugin 1.7.0 is a security release with breaking changes. Updating takes a minute; the steps after it, rotating the secret and reissuing tokens, are what keep your site safe. Do them in this order.

On this page

Why rotating is required. Earlier versions let a read-only administrator token read wp-config.php, which holds the signing secret. Anyone with that secret can create a token with every permission. A new secret makes every old token useless.

Before you start

  • Update a staging copy first if you have one, and run your usual prompts against it.
  • Take a backup, with your host’s tools or with wp_backup_create.
  • Make a list of every place that holds a token for this site: Xaflo Desktop, Claude Code, Claude Desktop, ChatGPT Desktop, scripts.

The steps, in order

  1. Update the plugin

    Use the normal WordPress update screen, or upload xaflo-wp-connect-1.7.0.zip from the Download page over the old version. The plugin stays active.

  2. Rotate the signing secret

    Open Xaflo → Settings and click Rotate secret. Every existing token stops working at once, so your AI clients will answer with an authentication error until step 4.

  3. Create new tokens

    In Xaflo → Tokens, create one token per client, as an administrator. The screen groups the scopes and warns about each dangerous one. Add fs:admin only where files outside uploads must change, and admin:login only for Xaflo Desktop’s quick login. See Token scopes.

  4. Replace the token in every client

    In Xaflo Desktop: Sites → the site → Replace token. In Claude Code, Claude Desktop or ChatGPT Desktop, paste the new token into the site’s configuration, then quit and reopen the app. On Windows, update Xaflo Desktop to 2.0.2 at the same time.

  5. Save the IP allow-list again

    If you use one, open Xaflo → Settings and save the list again. A list saved under 1.6.0 is not enforced until then; Settings shows whether it is enforced, saved but not enforced, or off.

  6. Check

    Ask your assistant to run wp_health_check. On 1.7.0 it reports plugin_version and, with MCP server 1.3.1 (in Xaflo Desktop 2.0.2), the scopes of the token in use. Xaflo → Audit Log shows every call, refusals included.

What changes for your workflows

Files

site:write now changes files only inside wp-content/uploads, and only documents, images, audio, video and archives. Editing theme or plugin files, or anything else outside uploads, needs a token with fs:admin as well, and every overwrite, rename or delete there asks for confirmation. Without it you get xaflo_fs_outside_uploads.

Database

/db/query needs an administrator account. Writes need the users, usermeta, options and token tables to be InnoDB (409 otherwise), and the whole route is refused under the NO_BACKSLASH_ESCAPES or ANSI_QUOTES SQL modes or with a big5, cp932, gbk, gb18030 or sjis connection. With params, use only %s, %d and %f, and pass anything else, such as a LIKE pattern, as a value.

Tokens created by non-administrators

Every token route now checks a WordPress capability. A token created by an Editor keeps working for content, but file, database, backup, maintenance and similar routes refuse it. Create those tokens as an administrator.

Confirmations

Xaflo Desktop 2.0 and MCP server 1.3 always show you what will change and wait for your yes. Desktop 1.x answered some confirmations by itself, so update it.

Something not working after the update? Troubleshooting after 1.7.0. Every change is listed in the Changelog.