0

The context: I have a customer for whom I've installed Wordpress in an internal network, behind several layers of the firewall.

I need to have this WP installation updated on a regular basis The machine where it's installed is behind a proxy (all proxy parameters are set in Wordpress)

But in order for my WP installation to actually reach the update servers, they need to be allowed by the proxy (which works on the principle that everything is closed excepted what's explicitly allowed)

So we come to the question: What are the names/urls/Ips of the Wordpress updates servers/repositories which I need to ask to be whitelisted on that proxy? - (core and plugins).

Failing the list itself, what would be a good way to try and get those addresses by myself?

I've searched in vain for an official list on Wordpress.org, and googled that search in various forms, without obtaining a satisfactory answer.

Please bear in mind that the list should be as complete as possible, since my customer being a big organization, this kind of request takes weeks to be reviewed, then implemented.

Any help on that would be greatly appreciated. Thanks in advance

Improve this question
3
  • I think the URL is api.wordpress.org
    – eldoleo
    Commented Apr 28, 2017 at 15:46
  • I actually found a way thanks to this post : putting that bit of code require_once ABSPATH . '/wp-admin/includes/update.php'; echo '<pre>CORE UPDATES'."\n"; print_r( get_core_updates() ); echo '</pre>'; echo '<pre>Plugin Update'."\n"; print_r( get_plugin_updates() ); echo '</pre>'; echo '<pre> ALL PLUGINS'."\n"; print_r( get_plugins() ); echo '</pre>'; into an existing file under wp-admin on my staging machine returns an object, containing the package address.
    – Eric
    Commented Apr 28, 2017 at 16:03
  • Can't you just grab the latest copy of WP? Extract it over the top of your install and hey presto you've upgraded, it's a standard HTTP request there's no magic voodoo update process necessary
    – Tom J Nowell ♦
    Commented Apr 28, 2017 at 18:16

1 Answer 1

Reset to default
1

Why would you even want n automatic update in such a setting? bit orgs rarely allow just random software being installed without testing it first.

In any case, this is unlikely to be achievable in a sane way unless you limit yourself only to plugins from the wordpress.org repository as any "pro" type of plugin and theme will require making more "holes" for its update server.

Unsupervised automated updates are always a bad idea, but to reduce general security to support them is just unthinkable from a security POV.

Improve this answer
2
  • the installation is on a VM, separate from the rest of their network, And no the updates will NOT be automated, but the servers need to be reached in order to manually core update when needed (after being tested on a staging machine which does have access to the updates. And of course i could : - backup the production machine - send that backup to the staging machine and restore it there - do the update on the staging machine - backup the staging machine end send back the archive to be restored on prod. (4 Gb of data each way, yay). I'd just rather not.
    – Eric
    Commented Apr 28, 2017 at 15:49
  • that doesn't make much sense. If the upgrade is manual, what is exactly the big issue with just downloading it via FTP/SVN/GIT. The extra 10 minutes that it will require are not even a blip on the time being usually wasted in such orgs. Side effect of the firewall is that you will not get notifications about updates as well, but this also is solvable for anything worthy to be installed. And yes, your backup to staging plan is exactly what you should do, welcome to the big league.
    – Mark Kaplun
    Commented Apr 28, 2017 at 16:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.