I'd like to know if there's any way to hook into WordPress update process and send $_POST variable to update server?

I'm delivering plugin/theme updates from private server and I hook into this:

add_filter('pre_set_site_transient_update_themes', 'check_for_update');

which works just fine. Newer version of theme/plugin appears under Dashboard > Updates and I can update. But the problem is - I want users to only be able to download/update if they provided correct login/password (first via add_option()). Ideally, direct link should never work unless client sends $_POST with login/password to update.php (the files on update server that will send plugin.ZIP in return).

I'm looking for something like this:

add_filter('updating', 'my_func');
function my_func($request){
   $request['login'] = get_option('login');
   $request['pass'] = get_option('pass');
   return $request;

And WordPress, while updating theme/plugin, should send $_POST['login'] and $_POST['pass'] to http://example.com/update.php and update.php should only allow downloading/updating if login matches the one defined there (update.php is the file on update server that sends ZIP package with newer plugin to WordPress).

I hope that it's clear :)

  • Did you change update url in WP? How? Dec 17, 2012 at 9:11
  • Check my hook above and use function check_for_update($checked_data) { return $checked_data; } - you can add more themes/plugins to $checked_data and they can come from private servers. I also managed to resolve this issue already in a bit different way :) There are tutorials out there on that subject and they are of great help here.
    – Paul
    Dec 18, 2012 at 9:45
  • did you finished the code for it? if so, are you willing to share it?
    – Sisir
    Jul 31, 2013 at 11:36

1 Answer 1


Update & the internal WP HTTP API

A slightly modified version of my answer to this question, but also as a plugin that shows how it could work.

Note: The code is not tested - I don't know your server setup, etc. - and just written out of my head. You'll have to test it, find the proper position for merging the arguments and set your URL, etc.

The initial test (#1) could be improved if the custom remote repository sends back usable headers (which isn't often the case). So if it does, you're better off using wp_remote_head() instead as it makes the HTTP request more lightweight.

defined( 'ABSPATH' ) OR exit;
 * Plugin Name: (#78267) Custom Theme Update Args
 * Description: Adds custom arguments to the HTTP request for a theme or plugin update from a custom location.
 * Version:     2013-04-02.2139
 * Author:      Franz Josef Kaiser <[email protected]>
 * Author URI:  http://unserkaiser.com
 * License:     The MIT License (MIT)
 * LicenseURI:  http://www.opensource.org/licenses/mit-license.php

add_filter( 'http_request_args', 'custom_upgrade_process', 9, 2 );
 * Callback for a HTTP request used to switch the
 * SSL verification in case of a WP error response
 * and routing to a custom Theme or Plugin repository.
 * @param  array  $r   Request arguments
 * @param  string $url Request URL
 * @return array  $r
function custom_upgrade_process( $r, $url )
    // Alter the following settings according to your
    // update procedure and admin pages that deliver it.
    # A) The admin URL
    $custom_repo = 'https://example.com?foo=bar';

    if (
        0 !== strpos( $url, 'http://api.wordpress.org/plugins/update-check' )
        XOR 0 !== strpos( $url, 'http://api.wordpress.org/themes/update-check' )
        return $r;

    # 1) Do an initial test to check if things are working as expected
    $response = wp_remote_get(
            'timeout'     => 120,
            'httpversion' => '1.1',
    # 2) Turn off SSL verification in case the HTTP request didn't work out
    if (
        is_wp_error( $response )
        AND strstr( $response->get_error_message(), 'SSL: certificate subject name' )
        add_filter( 'https_ssl_verify', '__return_false' );

    # 3) Add your custom request arguments
    $r = array_merge( $r, array(
        'login' => get_option( 'login' ),
        'pass'  => get_option( 'pass' ),
    ) );

    return $r;

Good luck. :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.