Updates

Updates, and what they send

Unapp is not distributed through the WordPress.org theme directory, so it brings its own update check. It uses the hook WordPress added for exactly this in version 6.1 rather than a bespoke updater, which means updates arrive where you already look for them.

How it works

A theme that declares an Update URI header has update_themes_{hostname} filtered during WordPress's normal twice-daily update check. Anything that filter returns flows into:

• Dashboard → Updates
• the Appearance → Themes update notice
• auto-updates, if you turn them on for Unapp

There is no extra cron job, no nag screen and no separate updater panel. When a new version is out, Unapp looks exactly like a theme from the directory.

The companion Starter Library plugin does the same through update_plugins_{hostname}.

What each check sends

The update request is also the only install count there is. In full, it carries:

site is hash_hmac( 'sha256', home_url(), wp_salt( 'auth' ) ), truncated. It uses your install's own salt, so it cannot be reversed into a URL by whoever receives it, and no two sites collide.

No site name, no email address, no IP address and no personal data is sent or stored. Nothing about your content, your users or your traffic leaves your server.

Unapp also states all of this on its own screen, under Appearance → Starter Sites, so you never have to read the source to find out what leaves your server.

Sending less, or nothing

Two filters control it. Put either in a child theme's functions.php or a small plugin.

Send only what an update check strictly needs:

add_filter( 'unapp_update_payload', function () {
	return array(
		'theme'   => 'unapp',
		'version' => wp_get_theme()->get( 'Version' ),
	);
} );

Or switch the check off entirely:

add_filter( 'unapp_check_for_updates', '__return_false' );

The same unapp_check_for_updates filter covers the companion plugin, so one line opts the whole product out.

Caching and failure

The response is cached for twelve hours, and a failure is cached for one. A dead endpoint therefore costs one request an hour, not one per admin page load, and never blocks a page from rendering.

Why not WordPress.org?

The Update URI header and a WordPress.org listing are mutually exclusive — a theme in the directory must not carry the header, and Theme Check correctly reports it as an error for that reason.

If Unapp is ever submitted to the directory, the header comes out of style.css and the update code stops doing anything at all, because WordPress will not fire the hook. Nothing else has to change, and nothing would need to be sent.