Frequently Asked Questions

Looking for a step-by-step walkthrough instead? Jump to our Quick-Start Guide — first site connected in under 2 minutes.

---

1. How do I connect my WordPress site? {#connect-wordpress}

Three steps:

1. In the Hubbee dashboard (app.hubbee.io), click Add Site → copy the connection code.
2. On your WordPress site: install the Hubbee plugin from the WordPress.org plugin directory (or upload the ZIP from your dashboard), activate it.
3. Open Hubbee → Settings in WP-Admin, paste the connection code, click Connect.

Your site appears in the Hubbee dashboard within a second. From now on, every content push, every health update, every activity entry flows automatically.

---

2. What is a token push? {#token-push}

A token is a piece of content (a headline, a description, a CTA-button text, an image URL) that you store centrally in Hubbee and render dynamically on your WordPress site via Elementor Dynamic Tags or our shortcode/block.

A push is the act of writing the central value into the token store on one or more WordPress sites. Pushes are:

• HMAC-SHA256 signed — only your site, with its unique secret, accepts them
• Versioned — every push increments the token’s version; lower-version pushes are skipped (no out-of-order overwrites)
• Idempotent — a request_id prevents double-processing if the same push is retried
• Logged — the Activity Stream records who, what, when, to which site

Edit a token once, push to 30 sites in one click.

---

3. Workspace vs. Site — what’s the difference? {#workspace-vs-site}

A Workspace is your top-level container — your agency, your team, your project group. It holds:

• One or more Sites (each a connected WordPress installation)
• Members (with admin or member roles)
• Subscription, billing, branding

A Site is a single WordPress installation that the Hubbee plugin agent runs on. Each site has:

• Its own connection (api_secret, site_id)
• Its own local copy of the tokens you’ve pushed
• Its own health status, activity log

You can move sites between workspaces (Agency plan), invite members per workspace, and set per-workspace defaults.

---

4. Plan limits explained {#plan-limits}

Limit	Free	Pro	Agency
Workspaces	1	1	up to 10
Sites	3	25	100
Members per workspace	1	up to 6	up to 16
Heartbeat interval	— (no scheduled checks)	5 min	2 min
Scheduled health check	—	every 5 min	every 5 min
Real-time updates	—	✓	✓
Analytics retention	7 days	90 days	365 days
Health-report deep level	—	basic	full inventory

Live, current limits and prices: /pricing. Pricing is read directly from our database, so this page can drift behind — /pricing is canonical.

---

5. Where is my data stored? {#data-storage}

Your WordPress content stays on your WordPress site. The Hubbee plugin stores token values in wp_bz_tokens in your own WordPress database — same database as your posts.

Hubbee Cloud stores:

• Account + workspace metadata (you, your team, billing email)
• Token definitions (the keys + structure of your content tokens, not post content)
• Activity log (who pushed what, when)
• Site metadata (URL, WP/PHP version, last heartbeat, plan-update inventory)
• Asset chunks (compiled JavaScript for visual effects you’ve assigned)

Hubbee Cloud does NOT store:

• Your post content, comments, customer data
• Your WP user database
• Your custom plugin/theme code

EU-hosted: a self-hosted Supabase stack on Hetzner Online GmbH infrastructure in Germany. See /legal/datenschutz and Sub-Processors.

---

6. Can I disable telemetry / heartbeats? {#disable-telemetry}

Yes. Add this to a mu-plugin (wp-content/mu-plugins/hubbee-no-telemetry.php):

<?php
add_filter( 'hubbee_heartbeat_enabled', '__return_false' );
add_filter( 'hubbee_health_report_enabled', '__return_false' );

The plugin will then make no telemetry calls. Token-push triggered from the dashboard still works — the SaaS-to-plugin direction is HMAC-authenticated and unrelated to outbound telemetry.

You can also disconnect the site entirely: Hubbee → Settings → Disconnect. Disconnect drops the api_secret; the plugin halts all outbound calls.

---

7. How do I cancel my subscription? {#cancel-subscription}

In the dashboard: Subscription → Manage → Cancel. Effective at end of current billing period — no early-termination fees.

After cancellation:

• Plan downgrades to Free (with Free’s lower limits — over-limit resources are protected by grandfathering for 90 days; you can manually downsize within that window)
• Sites remain connected
• Tokens remain pushed
• Activity log truncates to Free retention (30 days)

If you want to delete account + workspace entirely: dashboard → Account → Delete. Full data wipe within 30 days.

---

8. What happens to my data if I cancel? {#data-after-cancel}

• On WordPress sites: nothing happens. Your tokens stay where they are. The plugin continues to render them. You only lose the ability to push new updates from the dashboard (because Free has lower limits).
• In Hubbee Cloud:
  • Cancel only: account is preserved, plan-downgrade applies, grandfathering protects resources for 90 days.
  • Account-Delete: all workspace data + sites + activity logs + Paddle invoices are scheduled for deletion. Paddle invoices are retained 10 years for tax compliance.
• Export your data first: dashboard → Account → Data Export. Download a ZIP of all tokens, activity log, settings as JSON.

---

9. Plugin shows offline — how to debug {#plugin-offline}

Quick checks (in order):

1. Site URL reachable? Visit https://yoursite.com/wp-json/bz/v1/status — should return JSON with site_id + plugin_version. If 404 or 500: REST is broken (caching plugin? .htaccess?). Fix REST first.
2. Plugin connected? Hubbee → Settings should show Connected + the site_id. If “Not connected”: re-paste connection code.
3. Heartbeat running? SSH/CLI on your site:

   wp cron event list | grep hubbee
   

   If hubbee_heartbeat is missing → re-activate plugin or check hubbee_heartbeat_enabled filter.
4. Network reaching Hubbee Cloud? From your server:

   curl -I https://api.hubbee.io/heartbeat
   

   Expected: 200 OK (or 401 without auth — both confirm connectivity). If it hangs: firewall/DNS issue.
5. Last error: wp option get bz_last_error may show a hint.

Still stuck? Open a support ticket with wp option list --search="bz_*" output.

---

10. Token push failed — common reasons {#push-failed}

Error	Likely cause	Fix
bz_invalid_signature (401)	Site api_secret out of sync (e.g., site DB restored from backup)	Reconnect the site (re-paste connection code)
bz_stale_request (401)	WP-Server clock more than 5 min off UTC	Fix server NTP
bz_not_connected (401)	Plugin sees the request but is not bound to any site	Connect the site first
bz_invalid_payload (400)	Token field type mismatch (e.g., richtext expected, plain text sent)	Update the token-definition’s field_type
500 server error	WordPress fatal (theme conflict, memory limit)	Check wp-content/debug.log
Push completes, content doesn’t render	Page cache or CDN cache	Purge WP-Rocket / LiteSpeed / Cloudflare cache

Activity-Stream → click the failed push → see the exact error code + WP-side debug output.

---

11. Two-factor / security {#security}

Account security:

• Email-link login (passwordless) — no password to leak
• Optional WebAuthn / Passkey (in account settings)
• Session expires after 14 days inactive
• All workspace activity is audit-logged

WordPress-Plugin security:

• All SaaS-to-Plugin requests are HMAC-SHA256 signed with a per-site secret + 5-min timestamp window (prevents replay)
• All Plugin-to-SaaS calls (heartbeat, health, token-push receipts) use JWT signed with the same per-site secret
• The api_secret is stored encrypted in wp_options and never transmitted in the clear after enrollment
• Site-to-site isolation: even if Site A’s secret leaks, Site B is unaffected

Recommended hardening:

• Run WordPress 6.0+ with PHP 8.1+
• Enable HTTPS for your wp-json/ endpoints
• Restrict workspace member access to least-privilege roles

---

12. GDPR / DSGVO compliance {#gdpr}

Hubbee is built for EU operations:

• Data Processor under Art. 28 DSGVO — see our DPA (Auftragsverarbeitungsvertrag)
• EU hosting — self-hosted Supabase stack on Hetzner Online GmbH infrastructure in Germany
• Sub-Processors documented — see Sub-Processors
• No US data transfer for production data — Resend (transactional email only) uses Standard Contractual Clauses
• Right to access / portability — Account → Data Export downloads all your data as JSON
• Right to erasure — Account → Delete with full wipe within 30 days (except Paddle tax records, retained 10 years)
• Privacy Policy in plain German + English: /legal/datenschutz
• Imprint (Impressum, TMG § 5): /legal/impressum

Questions: info@hubbee.io.