Do I need a Sorank account?
Yes. This plugin is a connector to the Sorank SEO platform. Without a Sorank account, the Connect button cannot complete the pairing. You can create a free account at https://www.sorank.com.
Does the plugin store my password?
No. The pairing flow never transmits your WordPress password to Sorank. Sorank only receives a bearer token issued specifically for this connection. The local copy is encrypted with a random per-install secret stored in your WordPress database with autoload disabled.
How do I disconnect?
Two options:
- In your WordPress admin, open the Sorank page and click Disconnect . The plugin notifies Sorank and deletes the stored token.
- In your Sorank dashboard, open the WordPress integration and click Disconnect . Sorank notifies the plugin and the token is removed from your site.
If your WordPress site is temporarily unreachable when Sorank tries to disconnect, Sorank still removes the integration from its side; the stored token on your WordPress site can be deleted by clicking Disconnect again from the Sorank admin page once your site is back online.
I see “Could not encrypt the Sorank token”
This means PHP’s openssl extension or random_bytes function is unavailable on your host. Check with your hosting provider that the OpenSSL extension is enabled. If you previously upgraded from 2.0.4 or earlier and your AUTH_KEY was empty, paste a fresh set of keys from https://api.wordpress.org/secret-key/1.1/salt/ into wp-config.php and try pairing again.
Why does the plugin keep disconnecting every few days?
Pre-2.0.5 versions of the plugin encrypted the token with a key derived from your site AUTH_KEY . Some security plugins (iThemes Security, Wordfence, …) rotate the WordPress salts on a schedule, which made the encrypted token unreadable and forced you to re-pair. Update to 2.0.5+ to switch to a per-install secret that survives salt rotations. After updating, your existing token is migrated transparently on the next API call; no action required.
Sorank says my site is connected, but publishing fails with “Missing Authorization header.”
Some hosts (typically Apache running PHP as CGI/FastCGI) remove the standard HTTP Authorization header before WordPress can read it. Pairing still succeeds, but every request Sorank sends afterwards is rejected, so disconnecting and reconnecting does not help.
- 01Update the Sorank plugin to version 2.1.5 or later. Sorank also sends the token in an X-Sorank-Authorization header, which these hosts forward, so no server change is needed.
- 02If it still fails, add this line at the top of the .htaccess file at the root of your WordPress site, above # BEGIN WordPress : SetEnvIf Authorization “(.*)” HTTP_AUTHORIZATION=$1
- 03If you cannot edit .htaccess (for example on Nginx or managed hosting), send this to your hosting support: “Please forward the HTTP Authorization header to PHP for requests to /wp-json/ on my site (for example with CGIPassAuth On, or SetEnvIf Authorization “(.*)” HTTP_AUTHORIZATION=$1 on Apache). The Sorank plugin uses it to authenticate publishing requests.”
Sorank cannot sync categories or publish on a site protected by All-In-One Security (AIOS)
AIOS’s “Disallow unauthorized REST requests” option rejects every REST request that does not come from a logged-in WordPress user, including Sorank’s server-to-server calls. Since version 2.1.6 the plugin adds its sorank/v1 routes to the AIOS REST allow-list automatically, so you can keep that option enabled. Every Sorank route still requires the Sorank access token. Update the plugin, then retry from Sorank.
My SEO meta description / focus keyword is empty after publishing
The plugin writes both Yoast SEO and Rank Math meta keys on every publish, but you need the corresponding SEO plugin (Yoast or Rank Math) to be active and at least one of them to be selected in your Sorank publishing settings.
Does the plugin work with Elementor?
Yes. The plugin includes Elementor compatibility: published posts render correctly both on Elementor-powered blog pages and on sites using Elementor Pro Theme Builder “Single Post” templates. The behavior is controlled by the Elementor Theme Builder compatibility option on the Sorank settings page.
Does the plugin send anything when I am not publishing?
No. Outbound calls to Sorank only happen during pairing (initiated by you) and disconnect (initiated by you). Article publishing requests are inbound calls from Sorank to your site, not the other way around.
