Edward Stoever

<p>Imagine opening your mobile device and immediately viewing messages sent from your WordPress server with important information about what is happening right now. Stay informed on uptime, downtime, backups, memory usage, disk usage, intrusion attempts, sign-ups, or anything that matters to you!</p>
<p>With the Monitor.chat plugin, you will stay informed about:</p>
<ul>
<li>Logins, including failed login attempts</li>
<li>New posts</li>
<li>New comments</li>
<li>Software updates including core, plugins, and themes</li>
<li>File system space available</li>
<li>Server memory usage</li>
</ul>
<p>The Monitor.chat plugin will notify you by instant message on events and scheduled reports from the following plugins:</p>
<ul>
<li>Akismet Anti-Spam</li>
<li>Updraft Backups</li>
<li>Gwolle Guestbook</li>
<li>Woocommerce</li>
<li>WP-Statistics </li>
</ul>
<p>The Monitor.chat plugin relies on an external service. Messages are posted by the Monitor.chat plugin along with an API key to an external server. The external server converts the API key into the correct recipient(s) and sends the message as an XMPP instant message.<br />
* Website: https://monitor.chat<br />
* Policies of Monitor.chat: https://monitor.chat/documentation/policies/</p>


Monitor.chat – Monitor WordPress with Instant Messages

Your WordPress server will keep you informed in real-time with instant messages that you receive on your mobile device.

Jehan

<p>This plugin has two main features:</p>
<ul>
<li>any reader on your website can comment if one has an Instant Messaging<br />
address (XMPP protocol, otherwise called Jabber. A Gmail or a LiveJournal<br />
account for instance are such standard IM identifiers as well);</li>
<li>a subscribed user (whatever its role) can authenticate with one’s IM<br />
address if they set their IM address.</li>
</ul>
<p>This plugin is still in experimental state but is usable.</p>
<h4>Detailed Process</h4>
<p>The authentication part is something like openID, except that it uses your<br />
existing IM address: you ask for authentication on a website, and it pops-up a<br />
confirmation via IM (that you can accept, or refuse).</p>
<p>Considering that the IM protocol (XMPP) is very secure,<br />
all the infrastructure to securely exchange an authentication request is<br />
there. No need to make any new account, no need a special client, nor a<br />
identity third party provider, and that’s really instantaneous (as <em>instant</em><br />
messaging) and more secure than HTTP or SMTP protocols.</p>
<h4>Spam Protection</h4>
<p>It adds an additional layer to protect against Spam by verifying an<br />
identity using a very secure and modern protocol (XMPP), which also is instant,<br />
hence much more reliable in any way than email for instance.</p>
<h4>Secure and Easy Login</h4>
<p>Many reasons to use such a plugin for login:</p>
<ul>
<li>not to have to remember a new password (password-login can be disabled in<br />
your profile, on a per-user choice);</li>
<li>you are in a very insecure environment (for instance a cybercafe) and consider<br />
only your IM account to be a minimum securized. Or better, you run an IM<br />
client on your smartphone (or a similar tool), so you would receive the query<br />
on this personal item while never typing any kind of password on the insecure<br />
platform where you log.</li>
<li>And so on.</li>
</ul>
<h3>Configuration</h3>
<h4>Publishing Account</h4>
<p>This section contains the connection parameters of the account which will be<br />
used as a wordpress bot. I would personnaly advice to create a dedicated account<br />
just for it (you may also use your personal account of course, as the plugin’s<br />
bot will create a resource identifier unique for every connection) and to<br />
configure it to refuse any contact and communication (as noone will have to<br />
add it to one’s roster, except you maybe for test or debugging purpose?).<br />
The fields are:</p>
<ul>
<li>The bot address (bare jid form: mybotname@myserveraddress);</li>
<li>the password.</li>
</ul>
<h4>Advanced Connection Parameters</h4>
<p>By default xmpp-auth can use SRV records which is a recommended way to<br />
advertize server and port from a domain name (see for instance<br />
http://dns.vanrein.org/srv/ for details).</p>
<p>This is an advanced section in case your server does not use SRV AND uses a server<br />
which is not the same as the domain from the jid or a port different from the<br />
default one (5222).</p>
<p>Hence there will be very very few cases where you will have to fill this<br />
section and if you don’t understand all what I say here, just don’t fill<br />
anything there (if you fill even only one field, then it will be used instead<br />
of SRV and default values).</p>
<p>The default values will be used if the fields are empty and no SRV is configured on<br />
the Jabber server:</p>
<ul>
<li>the XMPP server (often the same as ‘myseveraddress’ of the jid);</li>
<li>the XMPP port (usually 5222).</li>
</ul>
<h3>TODO</h3>
<p>Features I am considering:</p>
<ul>
<li>check quickstart (http://xmpp.org/extensions/inbox/quickstart.html). In<br />
particular, I should at least cache DNS lookups now.</li>
<li>deactivate IM features when plugin not configured.</li>
<li>For comments, use the IM avatar of the commenter instead of gravatar;</li>
<li>Make various notifications usually done by email be done by IM instead (if<br />
adequate);</li>
<li>Display the comment’s JID on the admin page (as we display the email<br />
address, obviously only for administrators);</li>
<li>Add Scram-* to SASL package;</li>
<li>Make the generic XMPP part a PEAR package.</li>
<li>Subscribe with XMPP JID.</li>
<li>Login with JID or username (both possible).</li>
<li>If password is disabled, it also cannot be resetted.</li>
<li>Make user choose to receive password reset or other notification through IM<br />
instead of email.</li>
</ul>
<h3>XMPP Features</h3>
<p>Full Secure XML Stream with:</p>
<ul>
<li>TLS (with real certificate verification, so confidentiality and<br />
authentication);</li>
<li>SASL (Digest-MD5, CRAM-MD5 and PLAIN only for now);</li>
<li>SRV records “randomization” algorithm.</li>
</ul>
<h3>Contacts</h3>
<p>You can have some news about this plugin on <a href="http://jehan.zemarmot.net" title="my public diary" rel="nofollow ugc">my freedom<br />
haven</a>.<br />
You can also drop me an instant message on “hysseo” at zemarmot.net.</p>
<p>Have a nice life!</p>


XMPP Authentication

Allows users to authenticate without password via XMPP and for visitors to be filtered by XMPP verification.

Monitor.chat – Monitor WordPress with Instant Messages vs XMPP Authentication