Loopress Light

FAQ

What is the difference between Loopress Light and Loopress Full?

Loopress Light (this plugin) syncs ACF, WPForms forms, menus, custom post types, taxonomies, post meta keys, user roles, and tracked options. Loopress Full adds code snippet sync (Code Snippets, WPCode), Composer dependency management, a security audit, and platform diagnostics. Loopress Full costs nothing, it is not a paid upgrade: it is downloaded directly from loopress.dev instead of wordpress.org. Directory guidelines do not allow a plugin that installs executable code from external registries such as Packagist, and separately do not allow a plugin whose REST API can deploy arbitrary PHP/JS/CSS into another plugin such as Code Snippets or WPCode; both capabilities live in Loopress Full instead, not because of pricing. Installing Loopress Full deactivates Loopress Light automatically: it is a full replacement, not an add-on. See the documentation for the full feature comparison and download link.

Which ACF versions are supported?

Advanced Custom Fields (options pages require ACF PRO). You keep using its interface as usual. SEO plugin settings (Yoast, Rank Math) are a single option each, tracked like any other option.

Does the plugin execute code by itself?

No. Loopress Light only reads and writes ACF field group definitions, form definitions, menus, custom post type, taxonomy, post meta and role arguments, and options through the WordPress and plugin APIs, exactly as when you edit them by hand in their interface. It never accepts or stores arbitrary code: script tags, inline event handlers, and javascript: URLs are stripped from pushed ACF and form values, and a custom post type, taxonomy, post meta or role file only holds register_post_type(), register_taxonomy() or register_post_meta() settings or a role’s name and capabilities, any argument that would run code (a callback, a REST controller class) is refused.

Which options can be synced?

Only the options your project lists. By default, options whose name looks like a stored secret (API keys, tokens, passwords) are refused on read. This is best-effort matching on names and can miss some secrets (stripe_sk, for example), so do not track an option that holds a credential: its value would end up in the JSON you keep in Git. Options that change who can access the site or where it loads from (siteurl, home, default_role, users_can_register, cron, Loopress’s own settings) are refused on write by default. Developers can change both lists with the loopress_option_readable and loopress_option_writable filters.

Who can access the REST API?

Only authenticated users with the manage_options capability (administrators). The CLI authenticates with a WordPress application password that you can revoke at any time.

Do I need the CLI?

The plugin is the site-side companion of the Loopress CLI (lps, installable from npm). Without the CLI, it does nothing beyond showing its admin page.