Server Connections
Server Connections allow a SyteOps Server to remotely manage multiple SyteOps Endpoints. This is separate from your Product License — both the server and each endpoint need their own valid Product License, but the connection system operates independently.
Server Mode vs Endpoint Mode
- Server mode — The central site that manages other sites. Issues connection IDs and performs remote actions.
- Endpoint mode — A managed site that receives commands from a server. Activates using a Connection ID provided by the server.
Architecture Overview
A single SyteOps Server can manage multiple Endpoints. The server polls each endpoint periodically to collect status information and push remote actions.
How Connections Work
- An endpoint enters the server's URL during Initial Setup or in the Admin tab
- The endpoint activates, which sends a request to the server
- The server automatically issues a Connection ID and Connection Secret
- The connection appears in the server's Issued Connections table
- The server can now monitor and manage the endpoint remotely
Connection Establishment Flow
Issued Connections Table
The server displays all connections in the Issued Connections table, showing:
- Endpoint domain — The connected site's URL
- Connection status — Active, Disconnected, Revoked, or Ready
- Endpoint status badges — Current state of FlowMattic, REST API, Debug Mode, and logging on the endpoint
- Last checked — How long since the server last scanned the endpoint (e.g., "5m ago")
Use the Refresh button on each connection to update the endpoint's status.
Connection Actions
Each connection has a dropdown menu with available actions, organized by category.
Standard Actions
| Action | Description |
|---|---|
| Retry Connection | Re-establish a disconnected connection |
| Edit Users | Manage user settings on the endpoint |
| Module Access | Choose which modules this site is offered and updated with, and whether it installs module updates automatically |
Module Access
Module Access lists every module this server publishes, each with an on/off switch for that one site:
- Private modules start off — the site never sees them until you switch them on.
- Public modules start on — switch one off and the site stops being offered it and its updates.
- Turning a module off never uninstalls it. A copy already on the site stays where it is; it just stops getting updates.
- Install module updates automatically is off by default, so the site shows an Update button. Turn it on and the site installs updates to the modules it is allowed to have on its daily check.
A switch applies to the site's domain with or without www.. Only SyteOps Admins can change these switches, and each change is recorded in the log.
REST API Actions
| Action | Description |
|---|---|
| REST API: Restrict / Unrestrict | Toggle REST API restriction on the endpoint |
| REST API: Manage Allowlist | Add or remove custom allowlist paths on the endpoint |
| REST API: Enable/Disable Logging | Toggle REST monitoring on the endpoint |
The Manage Allowlist action is hidden when the endpoint's REST API is unrestricted.
Debug Actions
| Action | Description |
|---|---|
| Debug: Enable/Disable SyteOps | Toggle SyteOps Debug Mode on the endpoint |
| Debug: Enable/Disable WordPress | Toggle WordPress debug logging on the endpoint |
Logging Actions
| Action | Description |
|---|---|
| Logging: Purge SyteOps | Delete SyteOps debug logs on the endpoint |
| Logging: Purge WordPress | Delete the WordPress debug.log on the endpoint |
FlowMattic Actions
These actions only appear when FlowMattic is detected on the endpoint.
| Action | Description |
|---|---|
| FlowMattic: License | Activate a FlowMattic license on the endpoint |
| FlowMattic: Revoke License | Revoke the FlowMattic license on the endpoint |
| FlowMattic: Manage Workflows | Import or manage workflows on the endpoint |
| FlowMattic: Check Updates | Check for integration updates on the endpoint |
Plugins Actions
| Action | Description |
|---|---|
| Plugins: Manage | Enable or disable plugins on the endpoint |
Cache Actions
| Action | Description |
|---|---|
| Purge LiteSpeed Cache | Clear the LiteSpeed cache on the endpoint (only available when LiteSpeed Cache is active) |
Danger Zone
These actions are destructive and appear at the bottom of the dropdown.
| Action | Description |
|---|---|
| Plugins: Delete | Permanently remove plugins from the endpoint |
| Revoke SyteOps | Disconnect and disable SyteOps on the endpoint |
| Uninstall SyteOps | Remove SyteOps and restricted plugins from the endpoint |
| Delete Connection | Remove this connection from the server's list |
All danger zone actions require confirmation before executing.
Bulk Actions
Select multiple connections and apply actions in bulk using the action dropdown at the top of the table. Bulk actions run concurrently with progress tracking.
Endpoint Scanning
When the server scans an endpoint, it checks:
- FlowMattic license status and version
- REST API restriction state
- Debug mode status
- REST monitoring status
- Active cache plugins
The results appear as status badges next to each connection.
Giving the server its own enrollment secret
By default every connected site holds the same shared secret as the server. When your connected sites are on a current version, give the server its own secret so the shared one can be retired:
- Open Issued Connections and check the line "N of M sites use their own secret". Each row shows its credential. A site moves to its own secret on its next check after it updates. The row follows within about a day, from the daily refresh of a site on v1.6.670 or later (which reports the secret its checks would use), or at once when the site clicks Sync now.
- Click Give this server its own enrollment secret. The new secret is shown once, with a Copy button. Use it only for connecting a new site. Your FlowMattic token does not change. Afterward, Roll the enrollment secret replaces it at any time; no connected site holds it.
- Click Stop accepting the shared secret. Before it takes effect, the server lists every site not seen using its own secret for its checks (from a check, or from a daily refresh that reports it) in the last 14 days; if any are listed, type RETIRE to continue. A site left behind shows an error asking it to update and is not locked out.
- After the server has its own enrollment secret, rolling the FlowMattic token does not change the shared secret older sites use, and the roll says so. To make the shared secret stop working, use Stop accepting the shared secret (type RETIRE if sites are still listed). Roll the FlowMattic token (push to all) and fix any workflow that used it to call these routes.
Accept the shared secret again undoes step 3 at any time.
After step 3 each site connects to the server with its own secret, and the server no longer accepts the shared secret or the FlowMattic token from a site. The FlowMattic token is then only a FlowMattic credential.
A connected site on a current version also stops accepting the shared secret or the FlowMattic token on its own connection routes, as soon as its server has told it that it connects with its own secret. The server reaches the site with that site's own secret, so every action in Issued Connections, including pushing a new FlowMattic token, keeps working. A site in server mode keeps accepting the shared secret from its own connected sites until you stop accepting it there.
Troubleshooting
Endpoint shows "Disconnected": The server cannot reach the endpoint. Check that the endpoint is online and that firewall rules (including Cloudflare) allow server-to-server requests. Use Retry Connection to re-establish.
Actions dropdown is disabled: The endpoint URL or domain is missing from the connection. The endpoint needs to complete activation with the server URL configured.
FlowMattic actions not showing: FlowMattic actions only appear when the server detects FlowMattic on the endpoint. Refresh the connection status to update detection.