shadowscan

<p>ShadowScan Security Link pairs your site to the ShadowScan portal and keeps it in sync with heartbeat status, Guard Layer signals, login abuse detection, and security commands.</p>
<p>ShadowScan does not install, activate, or configure third-party security tools. If another security plugin is present, the connector only records its presence as metadata.</p>
<h3>External services</h3>
<p>This plugin connects to external services to sync status, process security workflows, and support optional diagnostics.</p>
<ul>
<li>Service: ShadowScan API (hosted at Supabase Edge Functions)</li>
<li>URL: https://foemwjtosslaiynduiyt.supabase.co/functions/v1/</li>
<li>Used for: site pairing, heartbeat sync, command polling, command-result upload, subscription/policy sync, and support contact submissions.</li>
<li>Data sent and when: site URL, WordPress version, PHP version, connector version, Guard Layer/control status, heartbeat timestamps, and command execution metadata whenever the connector syncs with ShadowScan; contact form fields only when an admin submits support contact.</li>
<li>Terms: https://shadowscan.com.au/terms</li>
<li>
<p>Privacy: https://shadowscan.com.au/privacy</p>
</li>
<li>
<p>Service: Have I Been Pwned Passwords API</p>
</li>
<li>URL: https://api.pwnedpasswords.com</li>
<li>Used for: optional breached-password checks in password policy enforcement.</li>
<li>Data sent and when: k-anonymity password hash prefix (first 5 SHA-1 characters, no raw passwords) only when a password is checked by the policy flow.</li>
<li>Terms: https://haveibeenpwned.com/TermsOfUse</li>
<li>
<p>Privacy: https://haveibeenpwned.com/Privacy</p>
</li>
<li>
<p>Service: Sentry</p>
</li>
<li>URL: https://sentry.io</li>
<li>Used for: optional error and fatal-event telemetry to assist troubleshooting.</li>
<li>Data sent and when: error event metadata (such as exception messages, stack traces, and runtime context) only after an admin explicitly enables Sentry telemetry in plugin settings and a Sentry DSN is configured; the optional MU diagnostics helper can send early-startup fatal errors only while both Sentry telemetry and remote diagnostics are enabled.</li>
<li>Terms: https://sentry.io/terms/</li>
<li>Privacy: https://sentry.io/privacy/</li>
</ul>
<h3>Third-Party Libraries</h3>
<p>This plugin bundles:<br />
* pragmarx/google2fa (MIT License)<br />
* bacon/bacon-qr-code (BSD-2-Clause; Copyright (c) 2017-present, Ben Scholzen “DASPRiD”)</p>
<h3>Hooks</h3>
<p>shadowscan_log<br />
Fires when the plugin emits an internal log message. You can hook this in a must‑use plugin or theme if you want to capture logs.</p>


ShadowScan Security Link

Connects your WordPress site to the ShadowScan portal for heartbeats, guard signals, and security commands.

aaronhsieh

<p>Site Add-on Watchdog keeps an eye on your site’s plugins and warns you when:</p>
<ul>
<li>Your installed version is two or more minor releases behind the directory build.</li>
<li>The official changelog mentions security or vulnerability fixes.</li>
<li>(Optional) WPScan lists open CVEs for the plugin when you provide your own API key.</li>
</ul>
<p>The plugin runs on a schedule you control—choose daily, weekly, a twenty-minute testing cadence, or rely on manual scans—and stores results locally. Nothing leaves your site unless you explicitly configure outgoing notifications.</p>
<h3>Privacy first</h3>
<ul>
<li>No plugin inventory or telemetry is ever sent off-site by default.</li>
<li>Optional webhooks are opt-in and only post the detected risks.</li>
<li>WPScan lookups only run when you add your personal API token.</li>
</ul>
<h3>Admin tools</h3>
<ul>
<li>Dashboard page with the current risk list and manual scan button.</li>
<li>Ignore list to suppress noisy plugins.</li>
<li>Notification settings for email, Discord, Slack, Microsoft Teams, or a generic webhook.</li>
</ul>
<h3>Notifications</h3>
<ul>
<li>Email: send to one or more recipients (comma separated).</li>
<li>Discord: post to a channel via webhook.</li>
<li>Slack: connect via an incoming webhook to post alerts into any workspace channel.</li>
<li>Microsoft Teams: send adaptive card style notices through an incoming webhook connector.</li>
<li>Generic webhook: post JSON payload to any endpoint you control, with optional HMAC signatures. Failed deliveries are logged and highlighted on the Watchdog admin screen so you can reconfigure or resend manually.</li>
</ul>
<h3>Troubleshooting</h3>
<h3>Scheduled scans are not running</h3>
<p>Watchdog relies on WP-Cron to trigger scheduled scans and notifications. If you have set <code>DISABLE_WP_CRON</code> to <code>true</code> or your site receives very little traffic (so WP-Cron rarely runs), configure a system cron job to call either <code>wp-cron.php</code> or the plugin’s REST endpoint. The admin <strong>Delivery health</strong> panel lists the REST URL you can target; a typical example looks like this:</p>
<pre><code>curl -X POST https://example.com/wp-json/site-add-on-watchdog/v1/cron
</code></pre>
<p>Testing-mode notifications also rely on this trigger, so be sure your cron job is running when validating delivery.</p>
<h3>CLI Usage</h3>
<p>Watchdog bundles a WP-CLI command so you can run scans outside of the WordPress admin. All examples below assume the command is executed from a shell where <code>wp</code> (WP-CLI) is available.</p>
<pre><code>wp watchdog scan [--notify=<bool>]
</code></pre>
<ul>
<li><code>--notify</code> (optional): Accepts <code>true</code> or <code>false</code> (defaults to <code>true</code>). When set to <code>false</code>, Watchdog will skip any configured email or webhook notifications and only record the scan locally.</li>
</ul>
<p>Examples:</p>
<ul>
<li>Run a scan and send notifications (default): <code>wp watchdog scan</code></li>
<li>Run a scan silently (skip notifications): <code>wp watchdog scan --notify=false</code></li>
</ul>
<p>Recommended workflow: on CI/CD platforms, add a job step that boots your WordPress/WP-CLI container, runs pending database migrations if needed, and then calls <code>wp watchdog scan --notify=false</code> to verify the plugin state without spamming production channels. Promote to production by rerunning the same command with notifications enabled when you are ready to alert your team.</p>
<h3>Development</h3>
<p>The development repository is available on GitHub: https://github.com/happyloa/Site-Add-on-Watchdog. Clone it locally to review the source or run the test suite.</p>


Site Add-on Watchdog

Monitor installed plugins for security notices, outdated releases, and WPScan disclosures without leaking your site's plugin inventory.

ShadowScan Security Link vs Site Add-on Watchdog