=== Stackbrace ===
Contributors: stackbrace
Tags: monitoring, security, agency, uptime, maintenance
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.6.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Reports versions, changed files, administrators and backups to your Stackbrace account. Takes no commands. Needs a paid plan.

== Description ==

**This plugin sends data to Stackbrace, a service you choose to use.** Every hour it posts a signed report to the Stackbrace account that issued the key you paste in: the versions of WordPress, PHP and every plugin and theme; which core and plugin files differ from WordPress.org's copy and which files changed lately; who can administer the site and when they last logged in, and whether anyone may register; which backup plugins run; whether email is failing to send and how full the disk is; and the error lines of the debug log, cleaned of secrets. What is sent and kept is set out at https://stackbrace.com/privacy. It sends nothing until a key is saved.

Stackbrace keeps the record of who holds every layer of every site an agency looks after, checks each site from outside every day, and sends one alert that names the broken layer and who can fix it.

The plugin is free. It needs a Stackbrace account on a paid plan: Business, $19 a month for 5 sites, or Agency, $79 a month for 25. More at https://stackbrace.com/wordpress.

This plugin reports what no outside check can see: exact versions, update state, changed files, new administrators, backups, email that fails to send. It only talks outward. It opens no endpoint on the site, accepts no instructions, makes no updates, changes no files, and runs nothing on request. Stackbrace never holds a key to the site.

== External services ==

This plugin connects to Stackbrace (https://stackbrace.com), a site registry and monitoring service, to report on this site. It sends nothing until a key from a Stackbrace account is saved under Settings → Stackbrace, and it only sends to the address saved there (https://app.stackbrace.com unless changed). Stackbrace is a paid service: the plugin works with an account on the Business plan or above (https://stackbrace.com/pricing).

Once a key is saved, every hour, and when "Send a report now" is chosen, it posts to /api/plugin/report: the site's addresses and time zone, whether it is a multisite and whether WP-Cron is switched off, the versions of WordPress, PHP and the database, every plugin and theme with its version, update and automatic-update state, the must-use plugins and drop-ins (file names and versions), whether debug output is shown, core files that differ from WordPress.org's checksums, plugin files that differ from WordPress.org's checksums for that plugin's version and PHP files in a plugin's folder that WordPress.org does not list, files changed in the last 7 days and PHP files in uploads (paths, dates and sizes, never contents), the number of users per role, each administrator's login name, registration date and last login, whether anyone may register and the role a new user is given, the backup plugins installed and when each last completed, how many emails WordPress could not send in the last day with the time and the reason given for the last one (addresses, tokens and passwords removed; nothing of a message, its subject or who it was for), the free and total space on the disk the site is on where the host lets PHP ask, and up to 20 error lines from the debug log with addresses, tokens and passwords removed. With traps switched on, a use of either trap is reported at once with the visitor's IP address and user agent.

Stackbrace's terms of use: https://stackbrace.com/terms
Stackbrace's privacy policy: https://stackbrace.com/privacy

The plugin also asks WordPress.org (https://wordpress.org) for checksums, to compare the site's files with: those of this version of WordPress, through WordPress's own get_core_checksums(), and those of each installed plugin's version, from https://downloads.wordpress.org/plugin-checksums/. A few plugins are asked about each hour, once a key is saved; each request carries that plugin's folder name and version and nothing else about the site. WordPress.org's privacy policy: https://wordpress.org/about/privacy/

== Installation ==

1. In Stackbrace, open the site's registry and, under Application, choose "Stackbrace plugin", then "Connect". Copy the key.
2. Upload and activate this plugin.
3. Under Settings → Stackbrace, paste the key and save. Choose "Send a report now" to see it arrive.

Deleting the plugin from the Plugins screen removes everything it stored, the key and the trap account included.

== Frequently Asked Questions ==

= Does it need a paid account? =

Yes. The plugin is free, and it reports to a Stackbrace account on a paid plan: Business, $19 a month for 5 sites, or Agency, $79 a month for 25 (https://stackbrace.com/pricing). It sends nothing until a key from that account is saved. Without the plugin, any Stackbrace plan, the free one included, watches the same site from outside.

= Can Stackbrace update or change my site through it? =

No. The plugin only talks outward. It opens no address on the site and accepts no instructions: there is no REST route that takes commands. It makes no updates, changes no files, runs nothing on request and logs nobody in.

= What exactly is sent? =

Every hour: the versions of WordPress, PHP, the database and every plugin and theme, with the updates waiting, and the must-use plugins and drop-ins; core and plugin files that differ from WordPress.org's copy, files changed under wp-content in the last 7 days and PHP files in uploads (paths, dates and sizes, never the contents of a file); how many users have each role, each administrator's login name, registration date and last login, and whether anyone may register and as what; which backup plugins are installed and when each last completed a backup; how many emails could not be sent in the last day and the reason given; how full the disk is; and the last 20 error lines of the debug log, with addresses, tokens and passwords removed. The full list is under "External services" above, and https://stackbrace.com/privacy says how long it is kept.

= How is this different from ManageWP or MainWP? =

Those manage sites: they update plugins, run backups and log in for you, which is what they are for, and to do it they hold a way in to each site. This plugin does none of that. It reports and takes no commands, and its key lets its holder post reports about one site and nothing else, so nobody who broke into Stackbrace could use it to reach a site. Many agencies run a management tool and Stackbrace side by side: one does the work, the other keeps the record of who holds each site's domain, DNS, hosting and backups, and says when something is wrong.

= What are the traps? =

An option, off until you tick its box. It sets two things nobody honest has a reason to use: an account nobody is told about, with no rights and a password nobody knows, and a hidden address named only in robots.txt, where someone looking for backups would look. Either being used is reported at once, with the address and browser that did it. Unticking the box removes both.

= What happens when I delete it? =

Deleting the plugin from the Plugins screen removes everything it stored: its settings and key, the trap account it made, the login times it recorded, and what it remembered about failed email and plugin files. In Stackbrace, "Disconnect" refuses any further report from that key.

== Screenshots ==

1. The plugin's one settings page: the key from your Stackbrace account, the option to set traps, and when the last report went.
2. The site's record in Stackbrace, with what the plugin's reports wrote: versions, changed core files, and who the administrators are. The agency and the site are made up.
3. A changed WordPress core file as Stackbrace shows it: marked urgent, with why it matters and what to do.

== Changelog ==

= 0.6.0 =
* Plugin files: each plugin from WordPress.org is compared with the checksums WordPress.org keeps for its version, a few each hour. A changed file, or a PHP file its author did not ship, is reported.
* Registration: whether anyone may register and the role a new user is given, so a site where a stranger becomes an administrator is caught.
* Email: how many messages WordPress could not send in the last day, and the reason given for the last, cleaned as log lines are.
* Disk: the free and total space on the disk the site is on, where the host lets PHP ask.
* Must-use plugins and drop-ins are listed, since they run on every page and the Plugins screen does not show them.
* Works with a Stackbrace account on the Business plan as well as Agency.

= 0.5.1 =
* Folders are found through WordPress's functions and each backup plugin's own settings, so sites that moved their content, uploads or backup folders are read correctly. Backup Migration's backups are found in the folder it writes them to.
* Messages on the settings page are escaped, including the Stackbrace server's reply, and shown once after saving.
* The readme sets out the external service, what is sent and when, with links to its terms and privacy policy.
* Deleting the plugin removes everything it stored: its settings and key, the trap account it made, and the login times it recorded.
* Nothing is gathered until a key is saved.

= 0.5.0 =
* Backups and the log: which backup plugins are installed and when each last completed a backup, and the last lines of the debug log, hourly.

= 0.4.0 =
* The users: who can administer the site and when they last logged in, hourly. Optional traps: a trap account and a hidden address, each reported at once when used.

= 0.3.0 =
* The files: core compared to WordPress.org's checksums, changes under wp-content in the last 7 days, and PHP in uploads, hourly.

= 0.2.0 =
* The inventory: every plugin and theme with its exact version, whether it is active, updates waiting, automatic-update settings, debug output, hourly.

= 0.1.0 =
* The heartbeat: plugin, WordPress and PHP versions, hourly.
