Plugin updates

The Cayve plugin updates from Cayve’s own release channel, the same way plugins from WordPress.org do: new versions appear on Dashboard → Updates and on the Plugins screen.

Automatic updates

Automatic updates are switched on for Cayve the first time the plugin runs. After that, the choice is yours: switch them off on the Plugins screen or under Cayve → Settings → Install Cayve updates automatically.

A release marked critical (a security fix) installs even when automatic updates are off. We use this rarely and only for security.

Every release is signed

Each release is signed on Cayve’s release machine. Before WordPress unpacks an update, the plugin checks that:

1. the download is the exact file Cayve published (its SHA-256 checksum matches), and
2. the signature over the version and checksum is valid for Cayve’s public key, which is built into the plugin.

If either check fails, the update is refused and your site keeps the version it has. Nobody who gets hold of the download address, or changes the file on the way, can put code on your site.

Updating by hand

Download the latest plugin from your dashboard and upload it under Plugins → Add New → Upload Plugin. WordPress offers to replace the installed version; your settings and messages are kept.