Stackbrace

This plugin sends data to Stackbrace, a service you choose to use. Every hour it posts a signed report to the Stackbrace account that issued the key you paste in: the versions of WordPress, PHP and every plugin and theme; which core and plugin files differ from WordPress.org’s copy and which files changed lately; who can administer the site and when they last logged in, and whether anyone may register; which backup plugins run; whether email is failing to send and how full the disk is; and the error lines of the debug log, cleaned of secrets. What is sent and kept is set out at https://stackbrace.com/privacy. It sends nothing until a key is saved.

Stackbrace keeps the record of who holds every layer of every site an agency looks after, checks each site from outside every day, and sends one alert that names the broken layer and who can fix it.

The plugin is free. It needs a Stackbrace account on a paid plan: Business, $19 a month for 5 sites, or Agency, $79 a month for 25. More at https://stackbrace.com/wordpress.

This plugin reports what no outside check can see: exact versions, update state, changed files, new administrators, backups, email that fails to send. It only talks outward. It opens no endpoint on the site, accepts no instructions, makes no updates, changes no files, and runs nothing on request. Stackbrace never holds a key to the site.

External services

This plugin connects to Stackbrace (https://stackbrace.com), a site registry and monitoring service, to report on this site. It sends nothing until a key from a Stackbrace account is saved under Settings → Stackbrace, and it only sends to the address saved there (https://app.stackbrace.com unless changed). Stackbrace is a paid service: the plugin works with an account on the Business plan or above (https://stackbrace.com/pricing).

Once a key is saved, every hour, and when “Send a report now” is chosen, it posts to /api/plugin/report: the site’s addresses and time zone, whether it is a multisite and whether WP-Cron is switched off, the versions of WordPress, PHP and the database, every plugin and theme with its version, update and automatic-update state, the must-use plugins and drop-ins (file names and versions), whether debug output is shown, core files that differ from WordPress.org’s checksums, plugin files that differ from WordPress.org’s checksums for that plugin’s version and PHP files in a plugin’s folder that WordPress.org does not list, files changed in the last 7 days and PHP files in uploads (paths, dates and sizes, never contents), the number of users per role, each administrator’s login name, registration date and last login, whether anyone may register and the role a new user is given, the backup plugins installed and when each last completed, how many emails WordPress could not send in the last day with the time and the reason given for the last one (addresses, tokens and passwords removed; nothing of a message, its subject or who it was for), the free and total space on the disk the site is on where the host lets PHP ask, and up to 20 error lines from the debug log with addresses, tokens and passwords removed. With traps switched on, a use of either trap is reported at once with the visitor’s IP address and user agent.

Stackbrace’s terms of use: https://stackbrace.com/terms
Stackbrace’s privacy policy: https://stackbrace.com/privacy

The plugin also asks WordPress.org (https://wordpress.org) for checksums, to compare the site’s files with: those of this version of WordPress, through WordPress’s own get_core_checksums(), and those of each installed plugin’s version, from https://downloads.wordpress.org/plugin-checksums/. A few plugins are asked about each hour, once a key is saved; each request carries that plugin’s folder name and version and nothing else about the site. WordPress.org’s privacy policy: https://wordpress.org/about/privacy/