Agency portfolio Pro
See every client site on one screen, straight from their WordPress. There's no external service: your own WordPress site is the hub, and it reads each client site's summary directly over its REST API. Go to Accessibility → Portfolio (administrators only).
Client sites only need the free Lumtera plugin. They don't need Pro or a license.
Connect a client site
On the client site:
- Install and activate the free Lumtera plugin.
- Go to Users → Add New and create a user with the role Lumtera Reporter. This role can only read the accessibility summary, nothing else.
- Edit that user. Under Application Passwords, enter a name such as "Agency hub" and click Add New Application Password.
- Copy the password. WordPress shows it only once.
On your site (the hub), under Connect a client site:
- Enter the Site address, for example
https://client.example.com. - Enter the Username and paste the Application Password.
- Click Connect site. You'll see "client.example.com is connected."
The password is stored encrypted with your site's secret keys, and it's only used to read the site's accessibility summary. It's never shown again.
Requirements for client sites
- HTTPS. WordPress only allows Application Passwords over HTTPS.
- A public address. Local and private network addresses are refused.
- The final address. If the site redirects (for example from
wwwto non-www), connect it using the address it redirects to.
The portfolio dashboard
- Tiles: Average score across all sites, Errors, Sites with errors and Sites in portfolio.
- The Sites table: each site's Score, Errors, Needs review and how much content has been Checked (for example "40 of 52"), with when it last synced. Your own site is always the first row, marked (this site). Click a site's name to open its Lumtera overview in a new tab.
Sites sync twice a day in the background. Use Refresh all, or Refresh on one site, to sync now.
To change a site's username or password, click Edit connection on its row, then use Update a site's connection and click Update connection. The new details are tested before they're saved. For security, the Application Password is never kept in the form: enter it again. Remove takes a site out of your portfolio. Revoke its Application Password on the client site too.
Troubleshooting connections
| Message | Fix |
|---|---|
| The username or Application Password was not accepted… | Check the username and paste the Application Password again. The user needs the Lumtera Reporter role, or to be an editor or administrator. |
| Lumtera is not active on that site… | Install and activate the free Lumtera plugin on the client site. |
| The site redirects to … | Connect the site with its final address. |
| Client sites must use https://… | Connect over HTTPS. |
| That address cannot be reached from this site… | Use the site's public address. Local and private network addresses are refused. |
| That is this site's own address… | Your own site is already the first row. Connect client sites only. |
| The saved application password can no longer be read… | Your site's secret keys changed (for example, the salts were regenerated). Use Update a site's connection to enter the password again. To stop this happening, define LUMTERA_PRO_ENCRYPTION_KEY in wp-config.php. |
How it works
The hub requests /?rest_route=/lumtera/v1/site-summary on each client site, using the username and Application Password. The ?rest_route= form works under every permalink setting. The request never follows redirects. The client site returns a summary only: its score, errors, items to review, coverage, and its most common issues and worst pages. No content is copied. See REST API.
If your plan changes to one without the portfolio, syncing stops, but your connected sites stay saved.