ploypress 2

Push, pull and promote WordPress sites between your Mac (Local by Flywheel), staging, and production — files and database — from a desktop app. Two pasted commands to set up, then never again.

Getting started

1. Unzip this folder and move it somewhere permanent — Documents/ploypress is perfect.

2. Open Terminal (Cmd+Space, type "Terminal"), paste this one line, and press Enter — it installs and opens the app:

   cd ~/Documents/ploypress && npm install && npm start

   (If it says npm: command not found, install Node.js first from https://nodejs.org — the LTS version — then paste the line again.)

3. Recommended — turn it into a real Mac app so you never touch Terminal again. Paste this once:

   cd ~/Documents/ploypress && npx electron-builder --mac dir

   That produces ploypress.app inside the dist folder. Drag it into Applications and from then on it opens like any other app. Because it was built on your own Mac, macOS treats it as local software — no security warnings, no right-click-to-open dance.

Adding a site

Click + Add a site. You'll need:

• Local folder — in Local by Flywheel, that's the site's app/public folder. Use the Choose… button.
• Local database — press Detect from wp-config.php to pre-fill, but check the port against Local's Database tab (Local gives every site its own port, and wp-config.php doesn't always have the right one). Press Test connection — it tells you immediately if the details work. Note: Local's database only runs while the site is started in Local.
• Remote environments — add staging, production, or both. Enter the SSH host/user/port/key directly, or an alias from ~/.ssh/config if you have one.

SSH must be key-based. The app can't type a password into a hidden prompt, so password-only SSH won't work — the pre-flight check will tell you in plain English if that's the situation, and most hosts (SiteGround, Cloudways, Krystal, 20i) have a one-click "add SSH key" page.

Syncing

Pick From and To, choose files / database / both, and run. Safety rails, in order:

1. Pre-flight checks run automatically before every sync: SSH connects, the remote path exists and contains WordPress, wp-cli works there, the local database connects, and the server isn't nearly out of disk. If anything fails, nothing is changed and the failure is explained.
2. Dry run is on by default. It shows exactly what would transfer.
3. A backup of the destination database is always taken first (Backups tab, one-click restore).
4. Overwriting anything named production or live requires typing the environment name — no accidental one-click overwrites of a live site.
5. During a live database push, the destination goes into WordPress maintenance mode and comes back out afterwards, even if something fails.
6. URLs are rewritten automatically (including inside serialized data), both the https:// and http:// variants. wp-config.php and .htaccess are never synced, so live database credentials can't be clobbered.

Promote (staging → production) never touches your local site: the database goes server-to-server via wp-cli, and files pass through a temporary folder that's deleted afterwards.

Licensing

Free tier: 1 site. Beyond that, a license key unlocks unlimited sites — click Upgrade in the sidebar and enter a key. Verification happens quietly in the background; if the licensing server is unreachable (bad WiFi, server down), a previously-activated license stays valid for 14 days before re-locking, so a flaky connection never locks out a paying user.

The verification backend isn't deployed anywhere by default. Two ready-to-deploy options live in licensing-server/:

• licensing-server/php/ — plain PHP + MySQL, deploys on SiteGround (or any shared hosting) exactly like a WordPress site: file upload + a database. Step-by-step walkthrough in licensing-server/php/README.md.
• licensing-server/cloudflare-worker.js — a Cloudflare Worker + KV alternative, if you'd rather not run it on your own hosting.

Both are Stripe-driven (Stripe handles all billing/renewals/cancellations) and implement the same tiny contract, so either works with src/license.js unchanged — just set VERIFY_URL once one is live. Until then, the app runs in free-tier mode indefinitely without ever making a network call.

Credential security

Local database passwords are encrypted at rest using Electron's built-in safeStorage, which wraps the OS's own credential store (macOS Keychain). No new dependency, no configuration. Existing plaintext profiles.json entries from older versions are read transparently and upgraded to encrypted storage the next time that site is saved.

Distributing via npm

package.json has a bin entry, so once published (npm publish), anyone can run:

npm install -g ploypress
ploypress

No zip, no AV false-positives from an unsigned .command script, no Gatekeeper dance — command-line installs don't carry the same quarantine flag that browser downloads do. Requires Node.js, which your target audience (WordPress developers) will already have.

Updates

The Updates tab checks and applies WordPress core, plugin, and theme updates via wp-cli, separately from syncing files or the database.

Pick an environment and press Check for updates. Outdated items sort to the top; tick individual plugins/themes and Update selected, or Update all outdated in one go. Core updates have a Security & minor only option to stay off major-version jumps. Every update — core, plugin, or theme — backs up that environment's database first automatically, and on a remote environment named production or live you'll be asked to type the name to confirm, same as a live sync.

Remote environments work immediately, using the same SSH connection as sync. Local updates need wp-cli on this Mac's PATH — Local by Flywheel's bundled copy isn't reachable this way. If you want local updates too: brew install wp-cli. Otherwise, update locally via Local's own Site Shell or wp-admin, or just pull the updated site down from wherever you did update it.

Backups

Every sync and every restore first saves the destination database to ~/.ploypress/backups. The Backups tab lists them per site with one-click restore into any environment — and a restore takes a fresh backup of the current state first, so even restores are reversible.

If something goes wrong

Errors are translated into plain English in the Activity log (wrong host, wrong key, wp-cli missing, database not running in Local, etc.) with what to do about it. The Cancel button stops a running job. Nothing in this app can delete a backup automatically — only you can, from the Backups tab.

For the curious

• Settings live in ~/.ploypress/profiles.json (contains your local DB password and paths — treat it like any credentials file).
• Files sync via macOS's built-in rsync over ssh; remote databases via wp-cli on the server; the local database is spoken to directly, so nothing extra needs installing on your Mac beyond Node.js.
• npm run smoke-test runs a self-check that touches no real sites.