A tiny, universal, self-hosted updater for plugins and themes. Network-activate
\nit once; any project that opts in via its Update URI header gets WordPress-native
\nupdate notifications, \"View details\", and one-click / auto updates — network-wide,
\nwith no per-project updater code and no tokens.
It's \"Git Updater meets PUC,\" but thin: WordPress already does the hard part
\n(scanning every installed project's header, routing by host, building the update
\ntransient, rendering the row, running the install). This plugin only supplies the
\npiece core can't — reading your JSON manifest and returning the update.
# fragment is the triggerAppend a fragment to the project's Update URI header. The fragment is the only
\ntrigger (we never sniff paths), so this can't collide with a project that updates
\nsome other way:
# A plugin, JSON manifest:\nUpdate URI: https://your-host/path/to/my-plugin.json#manifest-updater.json\n\n# A theme, JSON manifest (in style.css):\nUpdate URI: https://your-host/path/to/my-theme.json#manifest-updater.json\n# is the source (here, the manifest URL).#manifest-updater.json opts the project in and selects JSON-manifest mode.#manifest-updater.git is reserved for a future git-repo mode (recognised now,The Update URI header also earns the project automatic protection from being
\noverwritten by a same-named wordpress.org plugin/theme — for free, from core.
Then network-activate Manifest Updater (it is Network: true). That's it.
get_plugins() / wp_get_themes() return every installed project regardless of
\nactivation, and the update_plugins / update_themes transients are network-level
\non multisite. So updates surface and install network-wide while the projects
\nthemselves can be site-active, network-active, or inactive. A project no longer
\nhas to be network-active just to receive updates — only this one does.
The PUC (\"Plugin Update Checker\") metadata format — works for plugins and themes.
\nOnly version and download_url are required; everything else enriches the row
\nand the details modal. See example-manifest.json for every supported field:
name, slug, version, download_url, homepage, requires, tested,
\nrequires_php, requires_plugins, last_updated, upgrade_notice, author,
\nauthor_homepage, sections (description/installation/changelog/faq/any
\ncustom tab), icons, banners, banners_rtl, screenshot_url (themes),
\ntranslations, and the optional wp.org-style stats rating/num_ratings/
\ndownloaded/active_installs.
Update URI carries the fragment).Update URI headers) and PHP 8.1+.All notable changes to Manifest Updater are documented here. The format follows
\nKeep a Changelog and the project adheres to
\nsemantic versioning.
admin-ajax endpoint thattags passed through to the \"View details\" modal sidebar..ci/ that MU mirrors to the channel on release.Update URI header, opted in with a #manifest-updater.json fragment.A tiny, universal, self-hosted updater for plugins and themes. Network-activate it once; any project that opts in via its Update URI header gets WordPress-native update notifications, \"View details\", and one-click / auto updates — network-wide, with no per-project updater code and no tokens.
It's \"Git Updater meets PUC,\" but thin: WordPress already does the hard part (scanning every installed project's header, routing by host, building the update transient, rendering the row, running the install). This plugin only supplies the piece core can't — reading your JSON manifest and returning the update.
\nOpt in — the # fragment is the trigger. Append a fragment to the project's Update URI header; the fragment is the only trigger (paths are never sniffed), so it can't collide with a project that updates some other way:
Update URI: https://your-host/path/my-plugin.json#manifest-updater.json — a plugin.Update URI: https://your-host/path/my-theme.json#manifest-updater.json — a theme (in style.css).The part before # is the manifest URL; #manifest-updater.json opts the project in and selects JSON-manifest mode. The Update URI header also earns the project automatic protection from being overwritten by a same-named wordpress.org plugin or theme — for free, from core.
Network-wide, so everything else can be site-active. get_plugins() / wp_get_themes() return every installed project regardless of activation, and the update transients are network-level on multisite — so updates surface and install network-wide while the projects themselves stay site-active, network-active, or inactive. Only Manifest Updater needs to be network-active.
Same-origin image proxy. Icons and banners are re-served from your own site, so the browser never makes a cross-origin request to the update host — which sidesteps Private Network Access blocks, NAT hairpin, CORS, and service workers that otherwise leave the icon blank on the Updates screen.
", + "installation": "wp-content/plugins/ and Network Activate it (it is Network: true).Update URI header ending in #manifest-updater.json, pointing at its JSON manifest.Does the project have to be network-active to get updates?
\nNo. Only Manifest Updater is network-active. Opted-in projects can be site-active, network-active, or inactive and still receive updates.
\nWhere do manifests come from?
\nAny URL you control, returning the PUC (\"Plugin Update Checker\") JSON format. Only version and download_url are required; everything else enriches the row and the details modal. Manifests are cached in a network site-transient for 12h; the Updates screen's \"Check again\" busts the cache.
1.1.1
\n* \"View details\" sections now come from readme.txt (the WP-native source) rather than README.md; changelog version markers render bold (no clear:both modal gap); base/config renamed to .mu-manifest.yaml + .mu-release.yaml.
1.1.0
\n* Same-origin image proxy for plugin/theme icons + banners — fetched server-side, re-served from this site, so cross-origin/private-network/CORS/service-worker hurdles never blank the icon. SSRF-contained (same host as the manifest, no redirects), raster-only, content-type allow-listed, cached, size-capped.
\n* tags passed through to the \"View details\" modal sidebar.
\n* Self-hosting via the shared update channel + a reusable release pipeline (.ci/) mirrored to the channel on release.
1.0.0
\n* Initial release: network-wide self-hosted updates for plugins and themes via the Update URI header + a #manifest-updater.json fragment. Full PUC manifest field support, 12h manifest cache, self-update.