=== DomainWarn Monitoring ===
Contributors: wigandt
Tags: monitoring, uptime, ssl, dns, email deliverability
Requires at least: 6.3
Tested up to: 7.1
Requires PHP: 8.2
Stable tag: 1.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Monitors availability, certificate, DNS and email of your site – and reports what is invisible from outside: outdated plugins, a stalled WP-Cron.

== Description ==

A site is not only broken when the page stays white. It is also broken when no order confirmation has gone out for
three days because WP-Cron has stalled. Or when the certificate expires in two weeks and nobody read the issuer's
email. Or when a plugin has been carrying a known vulnerability for months.

[DomainWarn](https://domainwarn.com) monitors your domains from the outside – availability, redirects, TLS
certificate, DNS, SPF, DKIM, DMARC, blacklists, domain expiry. This plugin adds the inside view that nobody can see
from outside.

= What the plugin does =

* **Adds the addresses of this site** to monitoring. In a network, every site.
* **Reports what is invisible from outside**: the exact WordPress and PHP version, plugins and themes with a pending
  update, the mail setup – sender address and server. Together with the DNS records this yields the finding "your
  site sends through a server that is not in the SPF record", which neither the site nor an outside check can reach
  on its own.
* **Notices when WP-Cron stalls.** A scheduled run reports in every 15 minutes. If it stops, WP-Cron has stalled:
  the site still answers, but no mail goes out and nothing is processed. DomainWarn then opens an incident and sends
  it to your channels – email, Slack, Teams or webhook.
* **Serves security.txt via DomainWarn** (optional, off by default). If DomainWarn hosts the security.txt of your
  domain, the site answers /.well-known/security.txt with a redirect to it – RFC 9116 allows that – and the
  mandatory Expires field stays current by itself. Only at the domain itself or with www in front of it, only to
  DomainWarn, and never over a security.txt that is already there: a file in the web root or another plugin is
  shown as a conflict instead of being overridden.
* **Shows what DomainWarn hosts for the domain**: the state of security.txt, MTA-STS and the BIMI logo, the DNS
  records to copy, and a link to the page in DomainWarn where they are set up with one click.
* **Works from the command line** as well: `wp domainwarn test`, `wp domainwarn sync`, `wp domainwarn report`.

= Which data is transmitted =

The plugin sends to DomainWarn: the addresses of the site, the WordPress and PHP version, the names and versions of
installed plugins and themes, the sender address and mail server, and whether maintenance mode is on.

**Not transmitted** are users, posts, comments, orders or any content of the site. The API token is stored on the
site only and never reaches the browser. The plugin works with a DomainWarn account only; the processing is
described in DomainWarn's [privacy policy](https://domainwarn.com/legal/privacy).

= External service =

This plugin connects to the DomainWarn API at `https://api.domainwarn.com` (operated by Wigandt Technology,
Germany). Without an API token that you create yourself, the plugin stays idle and contacts nothing. The API
address is configurable, DomainWarn can also be self-hosted.

If you switch on "Serve security.txt via DomainWarn", visitors who request /.well-known/security.txt are
redirected to `https://domainwarn.com/security-txt/…`, where DomainWarn serves the file. Normal page views never
contact DomainWarn: the redirect target is stored on the site and refreshed by the scheduled run.

== Installation ==

1. Install and activate the plugin.
2. Under Settings → DomainWarn, click "Connect with DomainWarn". You confirm in DomainWarn, and the token lands
   here by itself. A free account is enough to start.
3. "Add addresses". Done.

Prefer to do it by hand? Create a token in DomainWarn under Settings → API with write scope and paste it into the
token field instead.

For the heartbeat, WP-Cron must run – which is exactly what it checks.

== Frequently Asked Questions ==

= Do I need a paid account? =

No. The plugin is free and works with the free DomainWarn account. What is charged is the monitoring service, once
more domains or shorter check intervals are needed.

= Is content of my site transmitted? =

No. Transmitted are addresses, versions, installed plugins and themes, sender address and mail server, and the
maintenance mode. No users, posts, comments or orders.

= Does the plugin work with a self-hosted DomainWarn? =

Yes. The API address can be changed on the settings page.

= Why does the plugin not redirect MTA-STS as well? =

RFC 8461 forbids following redirects when a mail server fetches the MTA-STS policy. The policy has to be served
under mta-sts.<your domain> itself – DomainWarn does that once a CNAME points to it. The plugin shows that record
and the TXT record to copy, and links to the page in DomainWarn that sets both with one click.

= Why does DomainWarn open an incident although my site is up? =

Because the heartbeat stopped. Then WP-Cron has stalled: the site still answers, but it sends no mail and processes
nothing.

== Screenshots ==

1. Settings → DomainWarn: the addresses of this site, one button to connect, and the client the domains are assigned to.
2. After the connection test: the plugin names the organization the token belongs to.

== Changelog ==

= 1.2.0 =

* New: "Serve security.txt via DomainWarn" (off by default). The site answers /.well-known/security.txt with a
  redirect to the file DomainWarn hosts – only at the domain itself or www, only to DomainWarn, never over an
  existing security.txt.
* New: "Check security.txt" fetches the address like a researcher and shows whether the redirect arrives, whether a
  valid file waits at the target and whether a file or another plugin answers as well.
* New: "Hosted by DomainWarn" shows the state of security.txt, MTA-STS and the BIMI logo with the records to copy.
* Domain names with umlauts are added in the form DomainWarn uses (Punycode) instead of being skipped.
* Requires PHP 8.2. The plugin already relied on PHP 8.2 while declaring 8.1, so on PHP 8.1 it failed with a fatal
  error. On an older PHP it now stays inactive and says so in the admin area.

= 1.1.0 =

* "Connect with DomainWarn" sets the connection up with one click – no token to copy.
* "Assign to client" is a list of your clients in DomainWarn instead of a free text field.
* The organization slug and the API address moved under "Advanced".

= 1.0.1 =

* The scheduled run is now really scheduled: on activation the 15-minute interval was not known yet, so no
  heartbeat was ever set up.
* Corrected links and contributor in this readme.

= 1.0.0 =

* First release: add addresses to monitoring, report the inside view, heartbeat against a stalled WP-Cron, settings
  page and WP-CLI commands.

== Upgrade Notice ==

= 1.2.0 =

Requires PHP 8.2 or newer. Optional: serve security.txt via DomainWarn, and see the state of MTA-STS and BIMI on
the settings page. Nothing changes until you switch it on.
