Sarcio Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Your visitors tell you what is broken and Sarcio drafts the fix. You ask for everyday changes in plain words and the assistant makes them. Every fix and every change is previewed on your real site, approved by you and undoable, from your WordPress admin. No developer, no theme or plugin files touched, nothing to install on your host.
How it works
- A Report a bug button sits on your site. A visitor says what went wrong in their own words and can point at the broken part; a screenshot comes along.
- Sarcio drafts a small, safe fix, explained in plain words, into Sarcio Inbox in wp-admin, with a count on the menu and boxes on your Dashboard.
- Preview shows the fix on your live site to you alone. Approve, and every visitor gets it. Keep this fix saves it on your site, where it keeps working even without Sarcio; turn it off or remove it under Sarcio Kept fixes.
What it fixes
- What visitors see: a greyed-out button, a hidden field, a wrong label, a broken link, fixed in the visitor’s browser.
- How your site answers forms and checkouts: a postcode wrongly refused, a coupon that will not apply, a field an update started requiring, fixed as the request runs, on any host. If Sarcio is unreachable the site runs as if the plugin were deactivated.
- Sarcio never writes to your theme, plugins or files. Every fix is a small, signed change, verified against your account’s own key.
Set up in a minute
Install, activate, open Sarcio in the left menu and click Connect to Sarcio (or Create your workspace). You sign in, confirm the site and come back connected, with nothing to copy. Each reviewer clicks Connect your Sarcio account once. Approving a fix always asks for your Sarcio password, so nobody can take a fix live from WordPress alone.
Ask for everyday changes
Sarcio Assistant is where you ask for the small changes a site needs all the time: change the footer phone number, add an About link to the menu, make the headings dark green, put a product on sale. The assistant lays each change over a preview only you see, in a panel beside the chat that flips any page between your changes and the live site. Nothing is live until you apply, and every change can be undone in one click. Where administrators apply, others send requests (Sarcio Requests). A preview can be scheduled, once or repeating, with a time to change it back. Sarcio Report sums up a month for a client and can email it monthly.
It changes pages, posts and products (Elementor and Divi text, synced patterns), menus, a block theme’s header, footer and site styles, a classic theme’s options, style rules for one element, widgets, WooCommerce settings, coupons and orders (never a refund), alt text, Yoast SEO or Rank Math titles and descriptions, other plugins’ settings through their own checks, comments, categories and tags, redirects, Gravity Forms entries, and users (invitations and removals confirmed first). An agency can send one change to several sites, where an administrator applies it, or work a MainWP portfolio; a preview can be shared by link with pinned notes. It can restore a page or the site styles to an earlier version, schedule a draft, read Site Health, check for missing alt text and broken links, turn plugins on and off, install one from WordPress.org only when you tick the box, update plugins and themes with checks and an automatic way back, and clear page caches after every change. Each can be switched off under Settings Sarcio. It never touches theme or plugin files, writes CSS or other code, changes page-builder layouts, or installs anything from outside WordPress.org, and can only do what the person’s WordPress role allows.
Looking after sites for clients? One Sarcio account covers every client site, each with its own Inbox in its own wp-admin; a risky fix can wait for a second person, and one change can wait on every site at once for its administrator.
For developers
- Who sees the reporter is a setting (editors, every signed-in user, or everyone); the button’s look is yours.
- Server-side fixes apply on the REST API,
admin-ajax.phpand page loads as structured, in-memory operations (default or strip a field, set a header, skip a validation, override a config value, reshape a JSON response, gate a route). - The settings page shows the connection, the last check and this month’s AI usage. Keys can be pinned in
wp-config.php; a host that can run a service can add the optional Sarcio sidecar for fixes within seconds.
A Sarcio subscription is required; plans start at $19 a month for one site. See https://www.sarcio.io/wordpress.
External services
This plugin connects to the Sarcio service, operated by Sarcio (Dayne Mentier) at sarcio.io: the control plane https://control.sarcio.io, https://www.sarcio.io and your workspace’s https://<workspace>.sarcio.io, built into the plugin. Nothing is sent until you click Connect to Sarcio or enter a site key.
-
Connecting. When an administrator clicks Connect to Sarcio or Create your workspace, or a user who can review patches clicks Connect your Sarcio account, their browser goes to
https://www.sarcio.io/appcarrying the site’s name, its home address, its admin address, the address to return to and, for an account connection, the site key. After they confirm in Sarcio, the browser returns with a one-time code, and your WordPress server exchanges that code with the control plane for the site key and secret key (site connections only) and a Sarcio sign-in for that WordPress user. -
Loading the reporter widget. On pages where the widget is enabled, the visitor’s browser loads the widget script from
https://control.sarcio.io/sarcio.js, which nothing in the plugin can change. The request carries the usual browser data (IP address, user agent, referring page) and your site key. - Fetching and receiving patches. The widget fetches your site’s active, signed DOM patches and your workspace’s public signing key from the control plane, and keeps a WebSocket open to receive newly approved patches. These requests carry your site key and the page origin, and no personal data.
- Submitting a bug report. Only when a person who can see the reporter presses Send report, the widget sends the report to the control plane: the description they typed, the page URL, the browser’s user agent and viewport size, an optional screenshot of the page, the selector and HTML of an element they picked (if any), and recent console errors and warnings plus metadata of recent network requests on the page (method, URL, status, duration, content type; never request or response bodies or authorization headers).
- Sarcio noticed. Only after an administrator turns it on for the site in the Sarcio dashboard (Sites Manage Sarcio noticed), the widget sends the control plane, when a visitor leaves a page on which something failed, one line per failure: the text of an error the page logged, or the method, address (without its query string) and status of a request that came back broken, and on a WooCommerce checkout page whether the checkout form and a way to pay showed. Nothing the visitor typed, no page content, no cookies, no screenshot; the request carries the site key and the usual browser data. Sarcio counts how many visitors hit the same failure and, past a few, opens a report for it in your Inbox; a broken checkout opens one sooner, marked urgent.
- Fetching server patches. When you enter the site’s secret key, your WordPress server (not the visitor’s browser) requests your site’s active, signed server patches and your workspace’s public signing key from the control plane: on WP-Cron when the cached set is older than the refresh interval (30 seconds by default), after you save the settings, when you press Check for patches now, or on
wp sarcio pull. The requests carry your site key, the secret key as a bearer token (patches only; the signing key request is anonymous) and a user agent naming the plugin’s shim version. No visitor or request data is sent. - Workspace details. Your WordPress server sends the control plane your admin’s address (scheme and host only), with the site key and the secret key, and gets back your workspace’s name, its address and its branding, which the Sarcio pages show and link to.
- Staying signed in. The Sarcio sign-in from connecting is stored for that WordPress user only, encrypted with a key derived from your site’s salts, and renewed when due (a daily WP-Cron task). While that person has the Inbox or Live fixes page open, your server uses it to read this site’s open reports, their fixes and the live fixes (and to look up this site, so nothing from another site shows), and to send what they choose: preview, approve, turn down, turn a live fix off, or ask for a different fix with their note. Approving or turning off asks for their Sarcio password or an authenticator code, passed on for that one request and never stored. The pages are drawn by WordPress, not framed. Signing out deletes the sign-in and asks the control plane to revoke it; uninstalling deletes every stored sign-in. These requests carry the sign-in and the site key, and no visitor data.
- Update checks. Only when a safe update finds a problem, your WordPress server sends the control plane the update’s name and versions, what changed on each key page it looked at (its name, address and a few words such as “server error 500”) and what it did, then the owner’s choice, with the site key and secret key. The checks themselves only open your own pages from your own server.
- Keeping a fix. Only when an administrator clicks Keep this fix, your WordPress server asks the control plane for that fix’s signed details (site key and secret key) and your workspace’s public signing key, checks the signature, and saves the fix in this site’s database. From then on the fix is applied by the plugin itself, with no request to Sarcio; page fixes are applied by a small script bundled with the plugin and printed into your own pages.
- Asks across sites. Only after an administrator ticks Receive changes your agency writes for several sites under Settings Sarcio (off by default), every five minutes a connected site asks the control plane whether the agency wrote a change for it (site key and secret key). If so the assistant prepares it as a preview (the conversation request above, limited to content and design; never plugins, themes, users or settings) under Sarcio Requests and reports one line per change. Nothing, an undo included, changes until an administrator applies it. No visitor data is sent.
- Review links. Share for review makes a link on your site; anyone opening it gets a cookie for a week, sees the preview served by your own server, and can pin notes (a name they type, the note, the page and the spot). Notes stay in your site’s database and reach the control plane only when the assistant is asked about them.
- Waiting reports. While someone who can review fixes is in wp-admin, your WordPress server reads how many of the site’s reports are waiting, how many fixes are live, and (with Sarcio noticed on) which failures visitors hit this week (site key and secret key), at most once every two minutes, for the count on the Sarcio menu and the Dashboard boxes. No visitor data is sent.
- The assistant. Only when a person who can review fixes sends a message on the Sarcio Assistant page, your WordPress server sends the control plane that conversation (what they typed, the answers, and the results of what it looked up or changed, such as a page’s text), the list of changes that person is allowed to make here, and these site details: name, home and admin addresses, WordPress version, active theme, language, time zone, whether WooCommerce is active, whether plugins may be installed, and the person’s role. The request carries the stored sign-in and the site key. The control plane answers with text and the next change to look up or make; every change runs on your WordPress server, by this plugin, as that person, and never from the control plane. In a long conversation the oldest messages are sent once more to be summarised, and the summary replaces them. Installing a plugin from the assistant downloads it from WordPress.org exactly as Plugins Add New does. Conversations are saved in this site’s own database, per person, and never in Sarcio; the preview of the assistant’s changes is held on your site under a random code in a cookie for your browser alone, dropped when you apply or discard it, close the conversation, or after two hours. When you ask about them, that context can also include: other plugins’ settings (any setting whose name says it holds a key, token, password or licence is replaced by “(hidden)” before it leaves your site) and the names and descriptions of their abilities; comments (name and words, never email or address); categories, tags, earlier versions of a page and redirects; recent WooCommerce orders (first name, items and total; never addresses, emails or payment details) and what sold; Gravity Forms entries (never kept in a saved conversation); plugins with updates waiting; users (display name, login and role; never an email or password); Site Health results, widget areas, Elementor’s global colours and fonts, and links on your own pages that answered with an error (checked by your WordPress server).
- AI models. To draft fixes and answer the assistant, the control plane (never your server or your visitors’ browsers) sends the report or conversation above to an AI model through OpenRouter (https://openrouter.ai; terms https://openrouter.ai/terms, privacy https://openrouter.ai/privacy), which passes it to the model’s provider (Anthropic’s Claude models by default).
- Usage. While the settings page is open, your WordPress server reads this month’s AI usage for the site from the control plane (site key and secret key), at most once every five minutes.
- Previewing a server patch. When a browser opens the site with a preview link from Sarcio (
?sarcio_preview=), your WordPress server sends that preview token, with the site key and secret key, to fetch the patch being previewed. It applies only to that browser, through a cookie that lasts up to 15 minutes. - With the optional Sarcio sidecar (a sidecar address is set under Advanced settings), the plugin talks only to that sidecar over a local socket on your host, and the sidecar fetches the patches instead.
The screenshot library, html2canvas 1.4.1 (MIT, https://html2canvas.hertzen.com), is bundled with the plugin and served from your own site; the plugin loads nothing from a third-party CDN.
Terms of service: https://www.sarcio.io/terms
Privacy policy: https://www.sarcio.io/privacy
Screenshots
No screenshots provided
