Disgrifiad

Rounds is a website-care service for developers and agencies. Your client opens a small panel on their own site, points at a text, and asks for a change or makes it. You decide which texts they may touch, and every change can be undone.

This plugin connects a WordPress site to Rounds. It does nothing on its own: you need a Rounds account (free to start, paid plans for more sites) at rounds-for.dev.

What the plugin lets Rounds do, and nothing else:

Read the editable texts of a page: Elementor text, heading, button and similar widgets; block editor paragraphs, headings, list items and buttons; headings, texts, buttons, alt texts, accordions and tabs made with WPBakery, Divi 4, Avada, Beaver Builder, Bricks, SiteOrigin Page Builder, Kadence Blocks, Spectra and GenerateBlocks; and a post’s title, excerpt and text custom fields (never one that holds a script link, a path or data).
Prepare a change in the plugin’s own table. The page does not change yet.
Put a change live in the page as its builder stores it, changing only that text, after a snapshot, with a revision that names the change where WordPress keeps one.
Roll a change back from that snapshot.
Report versions of WordPress, PHP, the database, the theme and the plugins, so you can see what needs updating, with the installed themes and how many administrators the site has (a number, never who).

Settings changes: off until you turn them on. Under Settings Rounds, an administrator can allow Rounds to change some of the site’s settings, group by group, each with its own checkbox:

site identity (title, tagline, logo, site icon); menus (classic and block theme navigation); header and footer text in widgets and template parts; the homepage and the posts page; turning comments off on a page;
contact forms’ recipient, subject and messages (Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Elementor Pro), with an e-mail to the site’s admin address whenever a form’s recipient changes; a page’s SEO title and description (Yoast SEO, Rank Math, SEOPress, All in One SEO); 301 redirects (Redirection, Rank Math, Yoast SEO Premium), never from the login, wp-admin, the REST API, WordPress’s own files or the homepage;
media: an image’s alt text, and replacing an image’s file with another from the media library (its old files, every size of it, are kept for 30 days in a folder of the plugin’s own, so it can be put back; the folder refuses web requests on servers that read .htaccess, and deleting the plugin removes it);
WooCommerce: prices, stock, short descriptions and the store notice;
the page cache: emptying it through your cache plugin’s own purge.

A setting is changed only from that fixed list, only in the groups you allow, and only after your developer approves the change in Rounds, having seen it before and after. Most can be undone. Unticking a group stops its changes at once. Who changed the choice and when is kept here and sent to Rounds (see External services).

What is kept, and for how long: who changed the choice and when, here and at Rounds, while the site is connected (Rounds keeps an older choice 24 months after it was replaced, to show what was allowed when, and deletes all of a removed site’s within 30 days); each change, here, for 12 months from its last step, which is also how long it can be undone; a replaced image’s old files for 30 days. Deleting the plugin removes all of it from the site.

What it can never do, by construction:

Run code, SQL or commands sent from outside.
Install or delete plugins or themes, or edit theme, plugin or any other code files. (The one file it ever writes is an image you replace from the media library, when you allow media changes.)
Administer the site: create, invite or delete accounts, change anyone’s role, or switch plugin or WordPress updates on or off. Those stay with the site’s administrators, in WordPress.
Read orders, form entries or comments, or delete posts.

Every request from Rounds is signed with a key made for your site alone and checked by the plugin. No WordPress password, Application Password or cookie ever leaves your site. Under Settings Rounds you can pause Rounds or disconnect it at any time, and see a log of everything it did.

The plugin adds nothing for your visitors: no script, no style and no request to Rounds, until you connect the site.

Source code

The plugin’s PHP is in this package, readable, and follows the WordPress coding standards; its translations come from translate.wordpress.org. assets/rounds.js, the panel your clients open, is the readable (not minified) build of the same Rounds widget code sites load, built from one entry with esbuild; it is the whole of that code, with nothing left out.

External services

This plugin connects your site to Rounds, a service run from rounds-for.dev (https://www.rounds-for.dev, or the address in the ROUNDS_CONNECTOR_API_URL constant). It needs Rounds to work. Every call below goes to Rounds and nowhere else, and none of them carries a WordPress password, an Application Password or a cookie. It does not contact Rounds or anyone else until an administrator connects the site.

From your server to Rounds:

/v1/wp/connect/start – when an administrator presses Connect to Rounds. Sends your site’s address, the address of its REST API and of the plugin’s screen, a public key the plugin has just made, the plugin’s version and the administrator’s language. Rounds answers with the one-time code the screen shows.
/v1/wp/connect/status – while a code waits to be entered in your Rounds account (fifteen minutes at most), each time an administrator opens the plugin’s screen or presses Check now. Sends the same public key and the language, and receives Rounds’ public key once the code is claimed.
https://www.rounds-for.dev/v1/wp/pair – when you connect with a pairing code from your account instead. Sends the code, your site’s address and REST API address, the new public key and the versions of the plugin, WordPress and PHP.
/v1/wp/probe – once, right after connecting, signed with your site’s key. Asks Rounds to try to reach your site, so the plugin knows whether calls from outside get through.
/v1/wp/work – signed, once an hour, or every minute when your site blocks calls from outside (or ROUNDS_CONNECTOR_POLL is set). Collects the requests Rounds has signed for your site and sends back their results, which can include the editable texts of the pages asked about, the result of a change, and the versions report.
/v1/wp/consent – signed, each time an administrator changes which settings changes are allowed (Settings Rounds). Sends the groups now allowed, who changed them as user: and their WordPress user number (never a name or address), and when, so that Rounds offers only the changes you allow. Nothing is sent while Rounds is paused or the site is not connected; Rounds then learns the choice from the site’s next report.

From Rounds to your site: Rounds calls your REST API under /wp-json/rounds/v1/, signed, when you or the people you invited work on a page. Your site answers with the editable texts of that page, the settings Rounds may change with their values (among them the addresses your contact forms send to, which Rounds shows to your developer but never gives to its AI), the result of a change, or the versions of WordPress, PHP, the database, the theme and the plugins.

From the browser of somebody who opens the panel (you, your client, or a person you invited; never a visitor who does not):

/v1/wp/widget/<project> – the panel’s settings and words, and whether the site is in strict mode. Outside strict mode no code is loaded from Rounds.
/widget/v/1.2.1/strict.js – in strict mode only, which you turn on or off in your Rounds account: a small script from Rounds that draws the highlights and opens the panel in a frame on www.rounds-for.dev, where its sign-in and session stay. The plugin names this exact file and its SHA-384 hash, and the browser runs that file or nothing; a newer one comes only with a plugin update. It holds no password, session or cookie, and the frame hands the page only the ticket below.
/widget/edit-kit.js – in strict mode only, when somebody previews a formatted text or a photo on the page: the formatting and photo previews that strict.js loads, named and pinned by its own SHA-384 inside that file, so it too is that exact file or nothing.
/v1/wp/panel-ticket – a short-lived ticket that lets your site mark the editable texts on the page for that person.
/v1/content/<project> – reading the text they point at, and saving or asking for a change to it.
/v1/requests – a request for a change, with the words they typed and the page it is about.
/v1/panel/session and /v1/rounds/* – an invited person’s sign-in, and the round of changes they are putting together.
/signin/<project> – for an invited person only: a window on www.rounds-for.dev where they type their e-mail address and the six-digit code Rounds e-mails to them. It sets two cookies on rounds-for.dev, sent only to its sign-in pages and never to your site: rounds_signin (the sign-in in progress, ten minutes) and rounds_panel_device (keeps them signed in on that device for 30 days, or until they or you sign them out).
/v1/wp/approvals/<project> – for the person you allowed to approve changes (the client approver) only, outside strict mode: the changes waiting for them, with their text now and after as read from your site, their decisions, publishing what they approved, and preview links.

Rounds uses all of this only to show the texts, prepare and make the changes, and keep their history; the texts themselves stay on your site, in revisions and in the plugin’s own tables. When you pause or disconnect, the calls from your server stop and Rounds’ requests are refused. The privacy notice says what Rounds keeps and for how long.

The service is provided by Rounds: Terms of service, Privacy notice.

Lluniau Sgrin

Settings → Rounds before the site is connected: paste the one-time code from your Rounds account. — Settings Rounds before the site is connected: paste the one-time code from your Rounds account.

Connected: pause Rounds or disconnect at any time, and see everything Rounds did on this site. — Settings Rounds before the site is connected: paste the one-time code from your Rounds account.

Gosod

Install the plugin from Plugins Add New, or upload the zip under Plugins Add New Upload Plugin, and activate it.
In your Rounds account, add the site as a WordPress site and copy its one-time pairing code. A code works once, for fifteen minutes.
In wp-admin, open Settings Rounds, paste the code and press Connect to Rounds.
The screen says Connected. Your site is now listed in Rounds.

To stop, press Pause Rounds or Disconnect on the same screen. Deleting the plugin removes its tables, settings, role and service user (on a multisite network, from every site); your pages and their revisions stay.

Cwestiynau Cyffredin

Do I need a Rounds account?: Yes. The plugin is the site’s side of Rounds and does nothing without an account. You can start for free at rounds-for.dev.
Which page builders are supported?: Elementor (its text, heading, button, icon box, image box and similar widgets, add-on packs too), the block editor (paragraphs, headings, list items and buttons, and the text blocks of Kadence Blocks, Spectra and GenerateBlocks), Beaver Builder and SiteOrigin Page Builder, each tested with the real plugin. WPBakery Page Builder, Divi 4, Avada and Bricks are tested with saved pages in each builder’s format, not yet with the builders themselves. Pages made with Oxygen, Breakdance or Divi 5 are not changed directly yet: the panel says which builder made the page, and your client can still describe the change and send it to you as a request. The plugin reads each builder’s stored page; it never runs the builder to make a change. Beaver Builder and SiteOrigin also keep a copy of a page’s text in the post itself, which search and excerpts use; Rounds leaves that copy as it was, and it is brought up to date the next time the page is saved in the builder.
Can my client break the site?: They can only change the texts you allow, as text: scripts, styles, event handlers, unsafe links and shortcodes are removed before anything is saved. Every change can be rolled back from the snapshot Rounds keeps before it. Where WordPress keeps revisions for it (Elementor, the block editor, WPBakery, Divi, Avada, and a post’s title and excerpt), the change is also saved as a revision; Beaver Builder, Bricks, SiteOrigin and custom fields keep none.
Does the plugin slow my site down or track my visitors?: No. It adds nothing to your pages for visitors and sends nothing about them. Until you connect, it sends nothing about your site and makes no call at all.
What happens when I disconnect?: The site’s keys are deleted at once and Rounds can no longer reach the site. The settings you allowed Rounds to change are all unticked, and changes still waiting for approval are closed. Pairing again with a new code makes new keys.
Where is my data?: The texts and their history stay in your WordPress database. Rounds keeps the site’s address and versions, and what it needs to show and undo the changes made through it. See the privacy notice.

Adolygiadau

There are no reviews for this plugin.

Contributors & Developers

“Rounds – Website care” is open source software. The following people have contributed to this plugin.

roundsfordev

Translate “Rounds – Website care” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Cofnod Newid

0.1.26

For a site on metered care, the panel’s button says “Send the round”, and a round sent too soon after the last one says when it can go.

0.1.25

The panel links Rounds’ privacy notice beside the button that sends a request.

0.1.24

Preview links escape the previewed title, excerpt and content as they are printed.
The panel’s marks for the title, the excerpt and custom fields now use WordPress’s own page output buffer (WordPress 6.9 and later); the plugin no longer opens one of its own. On older WordPress those fields are simply not marked.

0.1.23

Rounds no longer administers the site: inviting people, changing roles and switching automatic updates are gone from the settings Rounds may change. Managing people and updates stays with the site’s administrators, in WordPress.
Translations now come from translate.wordpress.org; the plugin no longer bundles its own.
The versions report no longer says which plugins update themselves.
The plugin is now called “Rounds – Website care”.

0.1.22

The panel’s script is rebuilt with this release of Rounds (pointing stops cleanly when the panel is closed). Nothing changes in how you use it on WordPress.

0.1.21

In strict mode, choosing who owns a translation (“keep my own” or “keep it in step”) asks the person to confirm it is them first, as saving a text does, and “keep my own” is not pressed while something covers the panel.

0.1.20

Two saves to the same text at nearly the same moment no longer undo each other: the later one is refused and the panel says the text changed meanwhile. Undo after somebody else changed the text is refused the same way, so their change stays.

0.1.19

Until Rounds has sent your site’s rules on who may change what (it does so when the site is connected, and before each change), only your developer can change texts; people in the panel wait for them. This also holds after connecting again.
Where WordPress filters HTML for everybody (a multisite network, or DISALLOW_UNFILTERED_HTML), Rounds no longer saves a page that filtering would strip, and a change that fails is put back exactly as the page was.
Previews now work for WPBakery, Divi 4, Avada, Beaver Builder, Bricks and SiteOrigin pages, and for titles and custom fields.
Deleting the plugin on a multisite network removes its data from every site, not only the main one.
Two changes to the same form, product or page can no longer overwrite each other.
Disconnecting, or connecting to another Rounds project, unticks the settings Rounds may change and closes the changes still waiting for approval.

0.1.18

The panel’s script no longer carries a shared-password sign-in screen: Rounds retired the shared site password for every website. The people your Rounds account invites sign in with an e-mailed code the first time, then a passkey; the panel then asks Rounds for a short-lived ticket that lets your site mark the editable texts for that person.

0.1.17

After you save one of your texts, the panel can add one plain sentence on why that kind of text matters. Your developer can turn these notes off.

0.1.16

After a round is sent, the panel says when Rounds’ AI is preparing it, that what comes back is a draft, and that nothing goes live until a person approves it.

0.1.14

Before you connect, Settings Rounds links to Rounds for anyone without an account yet (a plain link; nothing is loaded or sent). The plugin’s row in Plugins has a Settings link, and after activation one notice, for administrators only, says where to connect; it goes once the site is connected or you dismiss it.

0.1.13

The person you allow to approve changes (the client approver) gets “Changes to approve” on the site while signed in to the panel: they approve, reject, preview and publish the text changes waiting for them. Settings changes stay yours to approve.
Strict mode loads Rounds’ strict.js 1.2.1, with its accessibility fixes.

0.1.12

Settings changes, off until an administrator turns them on under Settings Rounds: the site title and tagline, menus, header and footer text, the homepage, contact form recipients, SEO titles, redirects, images, products, the store notice, comments on a page, inviting an editor or author, the team’s roles and the page cache. Each change waits for the developer’s approval, shows before and after, and (except a cache purge) can be undone.
The versions report also lists themes, each plugin’s slug, automatic updates and required PHP, and the number of administrators.

0.1.11

The panel is easier to use with a keyboard and a screen reader: its icon buttons show their names on hover and on keyboard focus, “All texts” keeps the focus inside it and closes with Escape, the photo’s focal point moves with the arrow keys, the password field works with password managers, and the panel tells assistive technology which language it speaks.

0.1.10

Strict mode, when you turn it on in your Rounds account: the panel, its sign-in and its session open in a frame on Rounds’ own address, and your site’s page runs only a small script from Rounds, pinned to one version by its hash. No other script on your site can read the sign-in.

0.1.9

Texts that may be formatted (bold, italic, underline, links and lists, as the field allows) open with a formatting toolbar instead of a plain box, and show on the page as you format them. The plugin still checks every value as before.

0.1.8

No change to what the panel does on a WordPress site, where you sign in with your WordPress account as before. Its script now carries the sign-in screen and the confirmation of who you are that other kinds of website use, switched off here.

0.1.6

Texts made with WPBakery, Divi 4, Avada, Beaver Builder, Bricks, SiteOrigin Page Builder, Kadence Blocks, Spectra and GenerateBlocks can be read and changed; a page made with another builder names that builder in the request.

0.1.5

No change to what the panel does. Its script now carries the groundwork for a stricter way of opening the panel, switched off until a later version.

0.1.4

The panel says what it is doing, keeps focus where you were, and keeps an unsent note while it is closed.
“Hold still” answers at once and covers the panel opening and closing.

0.1.3

A field your plan does not open is no longer highlighted as editable in the panel.
A round that must wait for its date can show the way to send it sooner, where that is offered.

0.1.2

Undo in the panel acts once, however many times it is pressed.

0.1.1

The panel’s script is in the package, readable, as WordPress.org asks.
Refused requests are logged once per kind every ten minutes, not once each.
Custom fields that hold a script link, a path or data are never offered or written; ordinary text and web addresses stay editable.
The panel’s pages can no longer be framed by other sites.
Policy patterns cover post titles, excerpts and custom fields, and refuse a trailing line break.
A page deleted while a change is being applied fails that change cleanly.

0.1.0

First release: pairing with a one-time code, signed requests both ways, reading and changing texts in Elementor and the block editor, snapshots and rollback, cache purges after each change, pause and disconnect, an activity log, and a full clean-up on uninstall.