How pairing the WordPress plugin works

Open the site in SolSEO, choose Connect plugin, and copy the code. It is single use and lasts fifteen minutes. Paste it into the plugin, which exchanges it for a key it keeps and shows to nobody.

The direction of the connection

From then on the plugin polls SolSEO. SolSEO never opens a connection to your WordPress.

That is the whole security design and it is worth understanding, because it decides what can and cannot go wrong.

There is nothing to allow through a firewall. There is no webhook to register. There is no address of yours that we hold and call. If your site is behind a VPN, on a staging domain, or firewalled to your office, pairing still works, because every request starts from your side.

It also means we cannot reach into your WordPress, which is a real limit as well as a protection: a fix applied through the plugin happens because the plugin asked what to do and then did it, not because we pushed anything.

What the code is

A single-use code with a fifteen minute life. It is exchanged exactly once, for a key that lives in your WordPress and is never displayed again after the exchange.

If the code expires, generate another. Nothing is consumed by a failed attempt except the code itself.

What pairing adds

On a paired site with a paid plan:

• Tracked positions in the post editor, beside the page they are aimed at.
• The site health list in wp-admin, with the findings from your crawl.
• Fixes that close a finding. The plugin reads the page the crawler read, changes it, re-reads it and reports what it read. The finding resolves because the page changed.
• Search Console data inside wp-admin, if you have connected it.

Those are your account's own figures, which is why a plan unlocks them and a licence key on its own cannot.

What works without pairing

Everything the free plugin does on its own: page analysis in the editor, meta and social tags, sitemaps, redirects, WooCommerce product schema with one offer per variation, and the Yoast and Rank Math importer.

And everything SolSEO does from outside: tracking, crawling, scoring, reporting. Pairing is a convenience, not a requirement, and a site that is not WordPress is not missing anything structural.

One site, one pairing

A pairing belongs to one site on one account. The wp-admin widget shows that site and nothing else, so an agency install cannot show one client another client's data.

Unpairing

Disconnect from either end. In SolSEO, open the site and disconnect; in WordPress, disconnect in the plugin. The key stops working immediately, and nothing that was already collected is deleted.

Re-pairing is a new code and a new key. The old key is never reissued.

If pairing does not complete

The code was already used. Codes are single use. Generate another.

The code expired. Fifteen minutes. Generate another.

The plugin cannot reach us. The plugin makes an outbound HTTPS request to solseo.com.au. Some managed hosts block outbound requests from PHP by default, and some security plugins do the same. This is the most common cause, and the plugin says so rather than failing silently.

The site is on a plan with no seat for it. A pairing belongs to a site on your account, so the site has to exist in SolSEO first.

What the plugin stores on your site

The key, and a cache of what it last fetched so wp-admin renders without waiting on a network call. Nothing else. The key is stored in the WordPress options table and is never printed to a page, an error message or a log; anywhere it has to be identified it appears as a short hash prefix.

What we can see on a paired site

Only what the plugin sends, and it sends what the screens need: which findings were closed, and the page content it read back after closing one. It does not send your posts, your users, your orders or your customers.

The crawler is separate and sees only what any visitor sees over the public address.