The Zero-Bloat Companion
for Agency WordPress Fleets
Traditional SaaS worker plugins pollute client databases, run background cron jobs, and phone home to third-party clouds. Clockwork Companion is a single-file Must-Use plugin that executes cryptographically signed commands only when your control panel asks.
Why Must-Use (mu-plugin) Architecture?
Standard WordPress plugins live in wp-content/plugins/ where any client with an administrator account can click "Deactivate" or delete them. Clockwork Companion lives in wp-content/mu-plugins/ for three non-negotiable reasons:
Client-Proof Persistence
Must-Use plugins (mu-plugins) do not appear with a "Deactivate" link in wp-admin/plugins.php. Client administrators cannot accidentally disable or delete your agency’s operational bridge.
Pre-Execution Priority
Loads prior to standard plugins and the active WordPress theme. Ensures clean request authentication, zero hook collisions, and immunity to broken third-party theme functions.php files.
Zero Admin Spam or Bloat
No upsell banners, no review solicitations, no affiliate marketing, and no persistent transient rows clogging up your client’s wp_options table. It remains quiet, clean, and lightweight.
Engineered for Agency Reliability & Speed
Every capability inside the Clockwork Companion is built specifically to solve daily WordPress fleet friction for agency owners and lead developers.
1-Click Passwordless SSO
Jump directly into any client’s wp-admin dashboard with one-time, cryptographically minted nonces. No shared master passwords, no password managers to synchronize, and zero credentials stored on third-party servers.
On-Disk Checksum Verification
Audits local WordPress core files directly against official WordPress.org release SHA-256 hashes on the local server filesystem. Detects unauthorized core code modifications or injected backdoors in milliseconds.
HMAC-SHA256 Signed Endpoints
Exposes clean REST routes under /wp-json/clockwork/v1/. Every request is authenticated using HMAC-SHA256 signatures with microsecond timestamp windows. Unauthorized calls are dropped before executing.
White-Label Transparency Portal
Embeds an agency-branded Tools → [Your Agency Name] portal inside wp-admin. Clients can inspect care plan maintenance logs, backup recency, PHP runtime stats, and clean security audits under your brand.
Synchronous Plugin Upgrader
Executes plugin and theme updates synchronously using WordPress core’s native Plugin_Upgrader engine. Automatically validates site health before and after updates, prioritizing packages with known CVE vulnerabilities.
Zero Outbound Phone-Home Calls
Unlike third-party SaaS agents that maintain persistent WebSocket tunnels or ping cloud servers every 60 seconds, Clockwork Companion only executes when your control panel sends an authenticated request.
Clockwork Companion vs. Legacy SaaS Workers
See how an agency-owned Must-Use plugin fundamentally differs from third-party vendor worker plugins (ManageWP Worker, Jetpack, MainWP Child).
| Feature & Architecture | Clockwork Companion | Legacy SaaS Worker Plugins |
|---|---|---|
| Plugin Architecture | ✓Must-Use (mu-plugin) at wp-content/mu-plugins/ | ×Standard plugin in wp-content/plugins/ |
| Client Deactivation Risk | ✓Zero. Cannot be deactivated by client admins | ×High. Any admin can click "Deactivate" or "Delete" |
| Database Overhead | ✓Zero persistent tables or transient locks | ×Heavy persistent log tables and transient bloat |
| Network Telemetry | ✓Zero phone-home calls; responds only to agency requests | ×Continuous outbound pings to vendor SaaS servers |
| Single Sign-On (SSO) | ✓Cryptographically signed, short-lived one-time nonces | ×Stored master credentials or third-party cookies |
| Agency White-Labeling | ✓Included free & 100% unlocked in core | ×Locked behind expensive monthly add-on plans |
| Source Code Auditability | ✓100% open-source single PHP file under MIT | ×Proprietary, minified, or obfuscated vendor code |
| Per-Site Monthly Cost | ✓$0.00 forever across unlimited client sites | ×$2.00 – $8.00/site/mo billed on a meter |
Zero-Touch Deployment & Canary Updates
How Clockwork Control safely rolls out and manages the Companion across dozens or hundreds of client sites with zero manual SFTP dragging.
Zero-Touch Provisioning
Clockwork Control pushes clockwork-companion.php to the client’s wp-content/mu-plugins/ directory using native SSH/SFTP runners (SpinupWP, GridPane, Cloudways, Linode) or async command APIs (Pressable).
Cryptographic Key Exchange
Clockwork Control generates a unique HMAC shared secret and stores it securely encrypted via AES-256-GCM. The site immediately begins authenticating private REST commands.
Canary Staging Validation
When updating the Companion, Clockwork Control releases to staging environments first, automatically validating REST endpoint health and PHP compatibility before touching production.
1-Click Fleet Propagation
With one click or scheduled maintenance window, roll out verified updates across your entire client fleet. If any install reports an anomaly, Clockwork Control rolls back instantly.
Inside clockwork-companion.php
No minified blobs, no hidden network phone-home sockets, and no proprietary obfuscation. Here is the elegant, readable anatomy of how the Companion operates:
<?php
/**
* Plugin Name: Clockwork Companion
* Description: Client-safe Must-Use operational bridge for Clockwork Control.
* Version: 1.2.0
* Author: Clockwork Web Dev, LLC
* License: MIT
*/
if (!defined('ABSPATH')) { exit; }
// 1. Register private authenticated endpoints
add_action('rest_api_init', function () {
register_rest_route('clockwork/v1', '/audit/checksums', [
'methods' => 'POST',
'callback' => 'clockwork_verify_core_checksums',
'permission_callback' => 'clockwork_validate_hmac_signature',
]);
});
// 2. HMAC-SHA256 signature and timestamp verification
function clockwork_validate_hmac_signature(WP_REST_Request $request): bool {
$signature = $request->get_header('X-Clockwork-Signature');
$timestamp = (int) $request->get_header('X-Clockwork-Timestamp');
// Reject replay attacks outside 300s window
if (abs(time() - $timestamp) > 300) { return false; }
$secret = defined('CLOCKWORK_SECRET') ? CLOCKWORK_SECRET : get_option('clockwork_secret');
$payload = $timestamp . '.' . $request->get_body();
$expected = hash_hmac('sha256', $payload, $secret);
return hash_equals($expected, (string) $signature);
}Agency Questions Answered
Does the Clockwork Companion slow down client websites?
No. The Clockwork Companion introduces zero front-end overhead. It does not run background wp-cron tasks, does not inject front-end tracking scripts, and does not execute database queries during normal visitor page requests. It only executes when responding to an authenticated management request from your Clockwork Control panel.
Why deploy as an mu-plugin instead of a standard plugin?
Standard plugins can be deactivated or deleted by client administrators, breaking your agency’s monitoring and maintenance automation. Must-Use plugins (mu-plugins) load automatically for every site, cannot be disabled from the WordPress admin interface, and execute earlier in the WordPress bootstrap lifecycle.
Can we white-label the plugin name and admin menu?
Yes. Clockwork Control provides full white-label settings. You can brand the menu item (e.g. Tools → Acme Agency Care), company logo, support URL, and diagnostic details so your clients see your agency’s brand with zero mention of third-party vendors.
How does deployment work on hosting without SSH access?
For hosts that provide zero SSH access (such as Pressable), Clockwork Control utilizes the hosting provider’s native asynchronous command execution endpoints (e.g. run_site_bash_commands and run_site_wpcli_commands) to write and update the mu-plugin file without needing an SSH user.
How does 1-Click SSO authenticate without passwords?
When an operator clicks "Log into wp-admin" from Clockwork Control, the control panel issues a short-lived, single-use cryptographic token signed with your agency’s HMAC secret. The Companion verifies the signature and timestamp, logs in the designated administrator user, and immediately expires the nonce.
Deploy zero-bloat WordPress control
for your agency fleet today
No per-site subscription fees. No cloud vendor locks. Run Clockwork Control locally on your Mac Mini or office server and manage your entire WordPress fleet with total confidence.
