PatchOn Agent

PatchOn is an AI service that runs WordPress plugin, theme, and core updates for you. It reproduces your production setup in a staging environment, inspects the updates there — including a screenshot comparison — and lets AI judge whether anything breaks. Only updates that pass every check are applied to production. You can also enable scheduled automatic updates (weekly on paid plans, an opt-in monthly run on Free), and if an update ever fails, one click restores your site. This plugin acts as the connector between your WordPress site and PatchOn.

This plugin requires the PatchOn service (patchon.jp) and does not function on its own. No account is required to get started. Immediately after activation it performs no external communication and does not redirect you. Opening PatchOn shows a welcome screen that introduces the service and lists updates detected locally on your site. Outbound communication with PatchOn begins only after the user explicitly clicks “Start PatchOn” and then confirms with “Agree and Start” in the consent dialog, which registers the site anonymously and, if updates are available, starts the first inspect-and-update run. A PatchOn account is needed only to view detailed inspection results in the dashboard, configure automatic updates, or upgrade to a paid plan.

Main Features

• Pre-inspection — in a staging environment, AI compares before / after screenshots of your site to catch layout breakage and fatal errors, with results displayed in your dashboard
• Inspect and update — a manual run goes from inspection to production rollout in one action, applying only updates that passed every check
• Automatic updates with inspection (opt-in) — the site is inspected on a schedule and only updates that passed every check are applied
• Backups — taken automatically right before each update and downloadable for a plan-based retention period
• One-click restore — if an applied update fails, one click puts your site back to the pre-update backup

This plugin (the free distribution on WordPress.org) does not write patched code to your site files (wp-content, mu-plugins, theme directories, etc.), even when it detects a problem. AI auto-repair, which writes patched code to mu-plugins or the active child theme, is provided by the separately distributed PatchOn Agent Pro extension plugin (available to PatchOn Standard / Business plan subscribers). Apart from applying the updates themselves through the standard WordPress upgrader, the only case in which this plugin writes to your site files is the one-click restore: run only on your explicit request after a failed update, it writes your own backed-up plugins, themes, MU plugins, and wp-content drop-ins (and your database) back to the site.

Data Sent

After the user has consented on the consent screen, when they run a “Pre-inspection” or “Apply update” operation, the plugin sends the following data to PatchOn and related external services. See the Privacy Policy for details.

• Site URL / WordPress version / PHP version / DB version
• List and versions of installed plugins, themes, and MU plugins
• List of available updates (names and versions of plugins, themes, and WordPress core). While the site is connected, this is sent automatically once a day (daily check-in).
• Site files prior to update application, used for the pre-update backup: wp-config.php, active and to-be-updated plugins and themes, MU plugins, and wp-content drop-ins (such as object-cache.php)
• Contents of WordPress debug.log (used to detect issues)
• A full copy of your site’s database (taken at pre-inspection time and reused as the restore base before updates). It may include personal data stored on your site, such as member accounts or contact-form submissions; see the Privacy Policy.

A manual “inspect and update” run applies updates that passed every check to production after a backup has been created; on your first run, nothing is applied until you review the results and confirm the inspected URLs on the results screen.

If you enable automatic updates, the plugin runs the pre-inspection automatically on the configured schedule and sends the same inspection data (site files and database copy) at that time. When the apply mode is set to automatic, updates that passed every check are applied to production after a backup has been created; updates that needed AI repair or require review are never applied automatically. Automatic updates can be turned off at any time.

External services

This plugin depends on the following external services. No external communication is performed merely by activating the plugin. Communication starts only after the user explicitly clicks the “Agree and Start” button on the consent screen shown on first use.

PatchOn API (https://patchon.jp and its subdomains)

The backend for all inspection, repair, update, and database-dump operations. Two host names are used, both operated by Rocketa Inc. and routed to PatchOn’s infrastructure:

• https://patchon.jp/api/* — site registration, pre-inspection control, apply-update control, billing
• https://dump.patchon.jp/* — database-dump control endpoints and signed-URL chunk uploads used during pre-inspection and when creating the pre-update backup (the database dump is excluded from the data sent over patchon.jp/api/*)

Provider: Rocketa Inc. (rocketa.co.jp)

When data is sent:

• On click of the “Agree and Start” consent button (one-time): anonymous site registration and UUID issuance
• Once a day while connected (daily check-in): the list of available updates and plugin version
• When the user runs a “Pre-inspection”, or when automatic updates run their scheduled inspection: list of plugins / themes, debug.log, full database copy
• When the user runs an “Apply update”, or when automatic updates apply an update that passed every check: a backup (site files and a full database copy) and the application result
• When the user runs the one-click restore after a failed update: restore control requests and progress status (the backed-up files and database themselves are downloaded from cloud storage at that time, not sent)

What is sent: see the “Data Sent” section above

• Terms of Service: https://patchon.jp/terms
• Privacy Policy: https://patchon.jp/privacy-policy
• Subprocessors: https://patchon.jp/subprocessors

AWS S3 (Tokyo region, accessed via PatchOn)

Storage destination for the site backup (zip) and the database copy (uploaded in chunks). Uploads and downloads are performed only against pre-signed URLs issued by PatchOn on a per-request basis. The customer site does not hold any S3 credentials. During a one-click restore, the backed-up site files and database chunks are downloaded from S3 in the same way.

• Provider: Amazon Web Services, Inc.
• Endpoint: https://*.s3.ap-northeast-1.amazonaws.com (pre-signed URLs only)
• When data is sent: when the user runs a “Pre-inspection” (database copy) or an “Apply update” (backup: site files and database copy)
• What is sent: site files (zip) and a full copy of the database
• AWS Privacy: https://aws.amazon.com/privacy/