Download the PHP package apermo/wp-update-server without Composer

WP Update Server

A self-hosted update API for WordPress plugins and themes, compatible with the Plugin Update Checker library and Composer.

Originally forked from YahnisElsts/wp-update-server, now independently maintained with a modernized codebase.

Features

• Plugin and theme updates — works like WordPress.org from the user's perspective
• Multiple versions per package — versioned directory layout with ?version= parameter
• Pre-release channels — distribute alpha/beta/RC builds via ?channel= parameter
• Composer repository — ?action=composer_packages endpoint for composer require
• Upload API — deploy new versions via POST ?action=upload with Bearer token auth
• License key authentication — pluggable provider with file-based default
• Configuration file — config.php for settings without subclassing
• Extensible by design — override filterMetadata(), checkAuthorization(), or any method

Requirements

• PHP 8.0+
• ext-zip
• ext-json

Quick Start

1. Install

Or download the latest release and upload to your server. Composer is optional — a built-in PSR-4 autoloader handles class loading without it.

2. Configure

Edit config.php to your needs. All settings are optional — the server works with sensible defaults.

3. Add packages

Create the versioned directory structure and drop your ZIP files:

The ZIP must contain a single top-level directory matching the slug, with a valid Plugin Name: or Theme Name: header inside.

4. Verify

You should see a JSON response with the plugin metadata.

Integrating with Plugins

Use the Plugin Update Checker library:

Updates will appear in the WordPress Dashboard just like plugins from WordPress.org.

Tip: Create a readme.txt following the WordPress.org standard to populate the "View details" modal.

Integrating with Composer

Point Composer at your server as a repository:

Composer requests /packages.json on the repository URL. This requires a web server rewrite rule to route the request through index.php — see Web Server Configuration below.

The vendor prefix is configurable in config.php (default: wpup).

Authenticated Composer access

For packages that require a license key, Composer authenticates via its native auth.json mechanism. The server accepts Bearer tokens from the Authorization header, which Composer sends automatically when configured:

This stores the token in auth.json (not composer.json, so it stays out of version control):

Enable license authentication on the server side in config.php:

API Reference

Configuration

Copy config.sample.php to config.php. Key options:

See config.sample.php for the full reference.

Web Server Configuration

The Composer integration requires /packages.json to be routed through index.php. A matching .htaccess is included for Apache. For other web servers, add the equivalent rewrite rule.

Apache / LiteSpeed

The included .htaccess handles this automatically. Ensure mod_rewrite is enabled:

LiteSpeed is fully compatible with Apache .htaccess rewrite rules — no additional configuration needed.

nginx

Add a location block to your server configuration:

Extending the Server

Create a subclass and override any method:

Common extension points:

• filterMetadata() — modify the JSON response
• checkAuthorization() — custom auth logic
• RequestLogger::filterLogInfo() — customize log entries (subclass RequestLogger)
• dispatch() — add custom actions

Logging

All requests are logged to logs/request.log:

Enable IP anonymization and log rotation in config.php.

Development

Migrating from v2.x

See docs/migration.md for a step-by-step upgrade guide including a shell script to migrate packages from the flat layout to the versioned directory structure.

Credits

Originally created by Yahnis Elsts. Now independently maintained by Christoph Daum.

License

MIT