=== Stackbrace ===
Contributors: stackbrace
Tags: monitoring, security, agency, registry
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.5.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Reports this site's versions and health to Stackbrace. It only talks outward.

== Description ==

**This plugin sends data to Stackbrace, a service you choose to use.** Every hour it posts a signed report to the Stackbrace account that issued the key you paste in: the versions of WordPress, PHP and every plugin and theme; which core files differ from WordPress.org's copy and which files changed lately; who can administer the site and when they last logged in; which backup plugins run; and the error lines of the debug log, cleaned of secrets. What is sent and kept is set out at https://stackbrace.com/privacy. It sends nothing until a key is saved.

Stackbrace keeps the record of who holds every layer of every site an agency looks after, checks each site from outside every day, and sends one alert that names the broken layer and who can fix it.

This plugin reports what no outside check can see: exact versions, update state, changed files, backups. It only talks outward. It opens no endpoint on the site, accepts no instructions, makes no updates, changes no files, and runs nothing on request. Stackbrace never holds a key to the site.

== External services ==

This plugin connects to Stackbrace (https://stackbrace.com), a site registry and monitoring service, to report on this site. It sends nothing until a key from a Stackbrace account is saved under Settings → Stackbrace, and it only sends to the address saved there (https://app.stackbrace.com unless changed). Stackbrace is a paid service: the plugin works with an account on the Agency plan or above (https://stackbrace.com/pricing).

Once a key is saved, every hour, and when "Send a report now" is chosen, it posts to /api/plugin/report: the site's addresses and time zone, whether it is a multisite and whether WP-Cron is switched off, the versions of WordPress, PHP and the database, every plugin and theme with its version, update and automatic-update state, whether debug output is shown, core files that differ from WordPress.org's checksums, files changed in the last 7 days and PHP files in uploads (paths, dates and sizes, never contents), the number of users per role, each administrator's login name, registration date and last login, the backup plugins installed and when each last completed, and up to 20 error lines from the debug log with addresses, tokens and passwords removed. With traps switched on, a use of either trap is reported at once with the visitor's IP address and user agent.

Stackbrace's terms of use: https://stackbrace.com/terms
Stackbrace's privacy policy: https://stackbrace.com/privacy

The plugin also asks WordPress.org for the checksums of this version of WordPress, through WordPress's own get_core_checksums().

== Installation ==

1. In Stackbrace, open the site's registry and, under Application, choose "Stackbrace plugin", then "Connect". Copy the key.
2. Upload and activate this plugin.
3. Under Settings → Stackbrace, paste the key and save. Choose "Send a report now" to see it arrive.

Deleting the plugin from the Plugins screen removes everything it stored, the key and the trap account included.

== Changelog ==

= 0.5.1 =
* Folders are found through WordPress's functions and each backup plugin's own settings, so sites that moved their content, uploads or backup folders are read correctly. Backup Migration's backups are found in the folder it writes them to.
* Messages on the settings page are escaped, including the Stackbrace server's reply, and shown once after saving.
* The readme sets out the external service, what is sent and when, with links to its terms and privacy policy.
* Deleting the plugin removes everything it stored: its settings and key, the trap account it made, and the login times it recorded.
* Nothing is gathered until a key is saved.

= 0.5.0 =
* Backups and the log: which backup plugins are installed and when each last completed a backup, and the last lines of the debug log, hourly.

= 0.4.0 =
* The users: who can administer the site and when they last logged in, hourly. Optional traps: a trap account and a hidden address, each reported at once when used.

= 0.3.0 =
* The files: core compared to WordPress.org's checksums, changes under wp-content in the last 7 days, and PHP in uploads, hourly.

= 0.2.0 =
* The inventory: every plugin and theme with its exact version, whether it is active, updates waiting, automatic-update settings, debug output, hourly.

= 0.1.0 =
* The heartbeat: plugin, WordPress and PHP versions, hourly.
