Manage Amazon links without editing every post

What is sent outside your site

The link scanner runs locally. Click statistics record total and unique clicks, link performance and Amazon product activity. Unique counts use a hash of the visitor's IP address and browser user agent, kept for 30 minutes; the raw values are not stored in click statistics.

The DevDome Dashboard fetches the plugin catalog from https://devdome.com/wp-plugins/catalog.json at most once every 12 hours. This request sends only the bundled core version, with no site or visitor data.

Hosted Link Radar at https://api.devdome.com/amazon-404-oos-checker sends scanned ASINs and their Amazon domains to /check-batch when you press Check Now or, with Auto Re-Scan enabled, once an hour for a batch of up to 20 products. A fresh installation that has never scanned makes no status-check request. Replacement searches send a keyword built from a product title or metadata to /search only when enabled per-status recovery handles a click; the bulk Replace ASIN tool takes an ASIN you enter and sends no search. Both requests include the site domain and secret token for usage metering, with no visitor data. For dead-link recovery searches, the keyword can contain up to six words from the linking post's title or product metadata.

Geo-localization contacts https://api.devdome.com/geo-resolve only when enabled. Each /go click sends the visitor's IP address, destination ASIN and domain, and the site domain and secret token. The IP address is used only for country lookup and cached briefly.

DevDome account connections use https://api.devdome.com/plugin/account, https://api.devdome.com/plugin/disconnect and https://analytics.devdome.com/api/plugin/connect/*. No account request is made until you press Connect, save an Account ID or complete a connection. Account checks send the site domain and secret token and receive the Account ID and account email address. Starting a connection also sends the wp-admin return address; completing it adds the one-time request token and nonce. The connect/start request registers the site domain and token, and connect/claim adds the request handle to collect the Account ID server-to-server. Disconnect sends the site domain and token only when you press Disconnect. The Account ID and token do not travel in the browser URL; https://devdome.com/connect/ is a sign-in link you open in your browser.

When you connect through the DevDome Tools dashboard card that discloses this sharing, account checks also send the slug and version of each active DevDome plugin, plus the bundled library, WordPress and PHP versions. This supports the account's site and plugin listing, support and update notices. The list excludes other plugins, users, email addresses, content and visitors. Previously connected sites and connections through buttons without that disclosure do not send the list; disconnecting stops it.

At click time, /go requests the destination URL from Amazon server-side with a generic user agent, using HEAD or GET if HEAD is refused. It follows up to seven redirects on Amazon hosts to resolve and validate the final destination, caching the result for 12 hours per destination. The plugin sends no visitor data to Amazon in this request.

The plugin sends no error reports. The "Report a bug" link on its screen opens the bug form on devdome.com in your browser.

This WordPress.org build does not contact the DevDome bot-protection signature feeds at https://api.devdome.com/bot-protection/ or the self-hosted update service at https://api.devdome.com/plugin-updates/. Click Protection uses a built-in bot list. Passwords, password hashes and visitor form input, names or email addresses are never sent. WordPress content is not sent apart from the title or metadata words used for replacement searches described above.

How updates work

Updates come from WordPress.org like any other directory plugin. The self-hosted updater is disabled in this build.

Uninstalling and your data

Deleting the plugin removes its settings, the click counters (per tag and per rule, including unique-visitor counts), the Link Radar link index and product statuses, the recovery journal of interrupted bulk replacements, scheduled events and transients. Content changes made with bulk Replace ASIN are not reversed. Deactivating keeps everything.

If something looks wrong

Link Radar checks, replacement searches or geo-localization are unavailable: connect a free DevDome account from DevDome Tools. No API key is needed, and tagging, keyword linking, exclusions, buy buttons, click tracking and Click Protection work without an account.

Visitors keep the original Amazon destination: geo-localization only routes to stores you have added an Associates tag for. Enable geo-localization and connect your DevDome account; if the visitor's local store has no configured tag, the original link and its existing affiliate tag are preserved.

A discontinued product still needs an alternative destination: enable recovery so affected clicks can go to a live replacement product or an Amazon search results page.

Unique-click counts use a temporary hash of the visitor's IP address and browser user agent for 30 minutes. Click Protection filters known bots using its built-in list, and click statistics do not store the raw IP address or user agent.