What goes on a new WordPress build, in install order, and where each licence is supposed to live. Install the bridge first: every later step is driven through it.
This page is public. The dashboard has no authentication — it answers
to anyone with the URL. So it names the .env key and how to read it, never the
licence value. Put Cloudflare Access in front of the Pages project before that changes.
| Tool | Licence | Get it | Key |
|---|---|---|---|
| Xcelerate Bridge Our REST bridge: page building, maintenance, diagnostics. Install FIRST — everything else is driven through it. | Ours, private | ~/xcelerate-bridge/dist/xcelerate-bridge.zipPrivate IP. Build with scripts/build-plugin.sh, push with scripts/deploy-to-site.sh. Never link publicly. | no licence needed |
| Beaver Builder Page builder. The default for XDS WordPress builds. | Paid — Agency | www.wpbeaverbuilder.com | BEAVER_BUILDER_LICENSE_KEYread with scripts/envkey.sh BEAVER_BUILDER_LICENSE_KEYstored in .env |
| Beaver Themer Themer layouts: archives, singles, site chrome. Needed for any templated page set. | Included | www.wpbeaverbuilder.com/beaver-themer | covered by the Beaver Builder Agency licence |
| Ultimate Addons for Beaver Builder UABB module pack — the extra modules the core builder does not ship. | Paid — Agency | www.ultimatebeaver.com | UABB_LICENSE_KEYread with scripts/envkey.sh UABB_LICENSE_KEYstored in .env |
| PowerPack for Beaver Builder Second Beaver module pack. Between them, UABB and PowerPack are why most sections can be built native rather than raw HTML. | Paid — Agency | wpbeaveraddons.com | POWERPACK_BB_LICENSE_KEYread with scripts/envkey.sh POWERPACK_BB_LICENSE_KEYstored in .env |
| Elementor Pro Page builder. Used where the client is already on Elementor. Licensed PER CLIENT, not agency-wide — the licence belongs to their account, so it is never a shared key. | Paid — per client | elementor.com/pro | <CLIENT>_ELEMENTOR_PRO_LICENSE_KEYone per client, e.g. ACME_ELEMENTOR_PRO_LICENSE_KEY |
| UpdraftPlus Backups. Free tier is the standard everywhere — split archives at 100MB. | Free | en-au.wordpress.org/plugins/updraftplus | no licence needed |
| Wordfence Security scanning and firewall. Free tier. | Free | en-au.wordpress.org/plugins/wordfence | no licence needed |
| Yoast SEO On-page SEO and meta. The bridge writes Yoast meta directly. | Free | en-au.wordpress.org/plugins/wordpress-seo | no licence needed |
| Tool | Licence | Get it | Key |
|---|---|---|---|
| Advanced Custom Fields Custom field groups, e.g. the suburb CPT on Tropical Skips. Free tier only — we do not buy ACF Pro, so anything needing Pro-only fields (repeater, flexible content) has to be solved another way. | Free | en-au.wordpress.org/plugins/advanced-custom-fields | no licence needed |
| Gravity Forms Forms where the client needs conditional logic or feeds. REST v2 is OFF by default — enable it via the bridge options route. | Paid | www.gravityforms.com | GRAVITY_FORMS_LICENSE_KEYread with scripts/envkey.sh GRAVITY_FORMS_LICENSE_KEYstored in .env |
| Rank Math SEO alternative to Yoast. In use on Tropical Skips. | Free | en-au.wordpress.org/plugins/seo-by-rank-math | no licence needed |
| UptimeRobot Uptime monitoring. A service, not a plugin — set up at REGISTER. | Free tier | uptimerobot.com | UPTIMEROBOT_API_KEYread with scripts/envkey.sh UPTIMEROBOT_API_KEYnot in .env yet |
No plugin licence is stored in ~/Business/.env today.
The workspace rule is that every key we obtain goes there so it survives a laptop rebuild.
The paid licences above are still only in vendor accounts and inboxes. The key names in the
last column are the ones to use when they are added.
<CLIENT>_BRIDGE_TOKEN and the URL as
<CLIENT>_BRIDGE_URL in ~/Business/.env.GET /wp-json/xcelerate-bridge/v1/maintenance/report →
plugin_version. The repo version is not the site version.POST /maintenance/update/guard) before any
plugin update — without it a plugin that fatals on load cannot be rescued.