sitesignal

<p>SiteSignal is a powerful WordPress monitoring plugin that provides comprehensive insights into your website’s security, performance, and integrity.</p>
<p><strong>External Services</strong>: This plugin connects to external services including ip-api.com for IP geolocation, api.wordpress.org for WordPress core information, and api.github.com for enhanced plugin analysis. See the “External Services” section below for complete details about data transmission and privacy.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Login Monitoring</strong> – Track successful and failed login attempts with detailed information including IP addresses, user agents, and geographic data</li>
<li><strong>WordPress Core Status</strong> – Monitor WordPress version and check for available updates</li>
<li><strong>Plugin Monitoring</strong> – Track active plugins, their versions, and available updates with intermediate version information</li>
<li><strong>Theme Monitoring</strong> – Monitor active theme status and available updates</li>
<li><strong>File Integrity Checking</strong> – Verify WordPress core files against official checksums to detect unauthorized modifications</li>
<li><strong>WooCommerce Integration</strong> – Monitor recent orders when WooCommerce is active</li>
<li><strong>REST API Support</strong> – External access to monitoring data via secure API endpoints</li>
<li><strong>Sync Functionality</strong> – Incremental data synchronization with external monitoring systems</li>
</ul>
<h4>Security Features</h4>
<ul>
<li>API key verification with external monitoring systems</li>
<li>Secure authentication for REST API endpoints</li>
<li>Input sanitization and validation</li>
<li>File integrity monitoring with checksum verification</li>
<li>Login attempt tracking with geographic information</li>
<li>Nonce protection for form submissions</li>
</ul>
<h4>REST API Endpoints</h4>
<p>When an API key is configured, the following endpoints are available:</p>
<ul>
<li><code>/wp-site-monitor/v1/site-info</code> – General site information</li>
<li><code>/wp-site-monitor/v1/logins</code> – Login attempt logs</li>
<li><code>/wp-site-monitor/v1/logins/sync</code> – Incremental login data sync</li>
<li><code>/wp-site-monitor/v1/core-version</code> – WordPress core version status</li>
<li><code>/wp-site-monitor/v1/plugins</code> – Active plugins information</li>
<li><code>/wp-site-monitor/v1/themes</code> – Theme information</li>
<li><code>/wp-site-monitor/v1/integrity</code> – File integrity check results</li>
<li><code>/wp-site-monitor/v1/orders</code> – WooCommerce orders (if WooCommerce is active)</li>
</ul>
<h4>Use Cases</h4>
<ul>
<li><strong>Website Security Monitoring</strong> – Track login attempts and detect suspicious activity</li>
<li><strong>Maintenance Management</strong> – Monitor WordPress core, plugin, and theme updates across multiple sites</li>
<li><strong>File Integrity Verification</strong> – Detect unauthorized changes to WordPress core files</li>
<li><strong>External Monitoring Integration</strong> – Connect with external monitoring systems via REST API</li>
<li><strong>WooCommerce Store Monitoring</strong> – Keep track of recent orders and store activity</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>WordPress 5.0 or higher</li>
<li>PHP 7.4 or higher</li>
<li>Optional: WooCommerce plugin for order monitoring features</li>
</ul>
<h3>External Services</h3>
<p>This plugin connects to the following external services to provide its functionality:</p>
<h4>IP Geolocation Service (ip-api.com)</h4>
<ul>
<li><strong>Purpose</strong>: Obtain geographical location information for login monitoring and security analysis</li>
<li><strong>Data sent</strong>: User’s IP address only</li>
<li><strong>When</strong>: Each time a user logs in to your WordPress site (if geolocation is enabled)</li>
<li><strong>Frequency</strong>: Once per login attempt</li>
<li><strong>Data retention</strong>: This plugin does not store data from this service permanently</li>
<li><strong>Privacy Policy</strong>: http://ip-api.com/docs/legal</li>
<li><strong>Terms of Service</strong>: http://ip-api.com/docs/legal</li>
<li><strong>User Control</strong>: Site administrators can disable geolocation in plugin settings</li>
</ul>
<h4>WordPress Core API (api.wordpress.org)</h4>
<ul>
<li><strong>Purpose</strong>: Check for available WordPress core updates, plugin information, and core file checksums</li>
<li><strong>Data sent</strong>: Current WordPress version, site URL (as User-Agent header), plugin slugs, and locale information</li>
<li><strong>When</strong>: During scheduled update checks and plugin analysis (typically daily)</li>
<li><strong>Frequency</strong>: Multiple times per day during normal plugin operation</li>
<li><strong>Data retention</strong>: This plugin does not store data from this service permanently</li>
<li><strong>Privacy Policy</strong>: https://wordpress.org/about/privacy/</li>
<li><strong>Terms of Service</strong>: https://wordpress.org/about/gpl/</li>
<li><strong>User Control</strong>: This is essential for plugin functionality and cannot be disabled</li>
</ul>
<h4>GitHub API (api.github.com)</h4>
<ul>
<li><strong>Purpose</strong>: Analyze plugin update information from GitHub repositories for enhanced update type detection</li>
<li><strong>Data sent</strong>: Repository information and release data requests</li>
<li><strong>When</strong>: During plugin update analysis (when available)</li>
<li><strong>Frequency</strong>: During plugin update checks (typically daily)</li>
<li><strong>Data retention</strong>: This plugin caches repository information temporarily (24 hours)</li>
<li><strong>Privacy Policy</strong>: https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement</li>
<li><strong>Terms of Service</strong>: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service</li>
<li><strong>User Control</strong>: This is part of the enhanced plugin analysis feature</li>
</ul>
<h4>Data Handling and Privacy</h4>
<ul>
<li><strong>Local Storage</strong>: All monitoring data is stored locally in your WordPress database</li>
<li><strong>No Personal Data</strong>: The plugin does not collect personal user information beyond what’s necessary for monitoring</li>
<li><strong>Data Retention</strong>: Login logs are automatically deleted based on your configured retention period (default: 90 days)</li>
<li><strong>External Transmission</strong>: Data is only sent to external services as described above</li>
<li><strong>User Rights</strong>: Site administrators can clear all plugin data at any time</li>
</ul>
<h4>GDPR Compliance</h4>
<p>This plugin respects user privacy and GDPR guidelines:<br />
* IP address geolocation is optional and can be disabled<br />
* Login monitoring data is stored locally and automatically purged<br />
* No personal data is transmitted to external services beyond IP addresses for geolocation<br />
* Users can request deletion of their monitoring data through the site administrator</p>
<h4>Disabling External Services</h4>
<ul>
<li><strong>Geolocation</strong>: Can be disabled in plugin settings (Settings > Geolocation)</li>
<li><strong>WordPress API</strong>: Cannot be disabled as it’s essential for core functionality</li>
<li><strong>GitHub API</strong>: Used automatically when available, no separate disable option</li>
</ul>
<h3>Privacy Policy</h3>
<h4>Data Collection</h4>
<p>SiteSignal collects and stores the following information locally in your WordPress database:</p>
<ul>
<li><strong>Login Attempts</strong>: Usernames, IP addresses, user agents, timestamps, and login success/failure status</li>
<li><strong>System Information</strong>: WordPress version, plugin/theme information, file checksums</li>
<li><strong>WooCommerce Data</strong>: Order information if WooCommerce is active (order IDs, customer names, amounts, status)</li>
</ul>
<h4>External Services</h4>
<p>This plugin connects to external services as detailed in the “External Services” section above:<br />
* IP geolocation via ip-api.com (optional)<br />
* WordPress core information via api.wordpress.org (required)<br />
* GitHub repository analysis via api.github.com (automatic)</p>
<h4>Data Retention</h4>
<ul>
<li>Login logs are automatically deleted based on your configured retention period (default: 90 days)</li>
<li>System monitoring data is refreshed during each check</li>
<li>External service data is not stored permanently</li>
</ul>
<h4>User Rights</h4>
<ul>
<li>Site administrators can clear all plugin data at any time</li>
<li>Geolocation can be disabled in plugin settings</li>
<li>Users can request deletion of their login attempt data through the site administrator</li>
</ul>
<h4>GDPR Compliance</h4>
<p>This plugin respects user privacy and follows GDPR guidelines. No personal data is transmitted to external services except IP addresses for optional geolocation purposes.</p>


SiteSignal

WordPress monitoring solution that tracks login attempts, core status, plugin updates, theme status, and file integrity.

zfir

<p><strong>Auto SRI</strong> automatically adds Subresource Integrity (SRI) attributes to scripts and styles loaded from external sources.</p>
<p>This improves security, protects against tampering, and enables strict Content Security Policy (CSP) setups.</p>
<h3>Features</h3>
<ul>
<li>✔ Adds SRI to all external <code><script></code> and <code><link></code> tags  </li>
<li>✔ Supports WordPress-enqueued assets and raw HTML tags  </li>
<li>✔ Supports async, defer, crossorigin, and multiline script tags  </li>
<li>✔ Caches all hashes for performance  </li>
<li>✔ Excludes admin panel (wp-admin) to prevent conflicts</li>
<li>✔ Automatically skips non-SRI-compatible providers:
<ul>
<li>Google reCAPTCHA  </li>
<li>Google Fonts (fonts.googleapis.com / fonts.gstatic.com)  </li>
<li>WordPress.com widgets (widgets.wp.com)</li>
<li>Dynamic concatenated resources</li>
<li>Dynamic script loaders and runtime-inserted scripts  </li>
</ul>
</li>
<li>✔ Safe for Elementor, WooCommerce, CookieYes, Jetpack, GoDaddy hosting, etc.</li>
</ul>
<h3>Why some scripts are excluded</h3>
<p>This plugin automatically excludes:</p>
<ul>
<li>Google reCAPTCHA (<code>google.com/recaptcha</code>)  </li>
<li>Google Fonts stylesheets (<code>fonts.googleapis.com</code>)  </li>
<li>Google Fonts font files (<code>fonts.gstatic.com</code>)  </li>
<li>WordPress.com widgets (<code>widgets.wp.com</code>)</li>
<li>Dynamic concatenated resources (<code>/_static/??</code>)</li>
<li>Other dynamic inline loaders (CookieYes, wsimg, ywxi, etc.)</li>
</ul>
<p>Want to whitelist a dynamic provider? Contact us at izafirsk@gmail.com.<br />
* Other dynamic inline loaders (CookieYes, wsimg, ywxi, etc.)</p>
<p>Want to whitelist a dynamic provider? Contact us at izafirsk@gmail.com.</p>
<p>These exclusions prevent:</p>
<ul>
<li>CORS failures  </li>
<li>Integrity mismatch blocking  </li>
<li>Google reCAPTCHA from breaking  </li>
<li>Google Fonts from disappearing  </li>
<li>Layout shifts caused by blocked assets</li>
</ul>


Auto SRI

Automatically adds Subresource Integrity (SRI) to external scripts/styles and safely excludes Google reCAPTCHA and Google Fonts.

SiteSignal vs Auto SRI