About this plugin
A site is not only broken when the page stays white. It is also broken when no order confirmation has gone out for
three days because WP-Cron has stalled. Or when the certificate expires in two weeks and nobody read the issuer’s
email. Or when a plugin has been carrying a known vulnerability for months.
DomainWarn monitors your domains from the outside – availability, redirects, TLS
certificate, DNS, SPF, DKIM, DMARC, blacklists, domain expiry. This plugin adds the inside view that nobody can see
from outside.
What the plugin does
- Adds the addresses of this site to monitoring. In a network, every site.
- Reports what is invisible from outside: the exact WordPress and PHP version, plugins and themes with a pending
update, the mail setup – sender address and server. Together with the DNS records this yields the finding “your
site sends through a server that is not in the SPF record”, which neither the site nor an outside check can reach
on its own.
- Notices when WP-Cron stalls. A scheduled run reports in every 15 minutes. If it stops, WP-Cron has stalled:
the site still answers, but no mail goes out and nothing is processed. DomainWarn then opens an incident and sends
it to your channels – email, Slack, Teams or webhook.
- Serves security.txt via DomainWarn (optional, off by default). If DomainWarn hosts the security.txt of your
txt – no redirect – and the
mandatory Expires field stays current by itself. The file is kept for an hour; while DomainWarn cannot be reached,
the site serves the last good copy as long as it has not expired. Only at the domain itself or with www in front
txt that is already there: a file in the web root or
another plugin is shown as a conflict instead of being overridden.
- Shows the state of the site on the dashboard: a “DomainWarn” widget with availability over 30 days, the
response time of the last 7 days as a small chart, certificate and domain expiry and open incidents – for every
domain of the site, with a link to it in DomainWarn. The figures are refreshed by the scheduled run at most once
an hour; opening the dashboard never contacts DomainWarn.
- Works from the command line as well: wp domainwarn test, wp domainwarn sync, wp domainwarn report.
Which data is transmitted
The plugin sends to DomainWarn: the addresses of the site, the WordPress and PHP version, the names and versions of
installed plugins and themes, the sender address and mail server, whether maintenance mode is on, and the environment
(PHP settings such as memory limit and OPcache, loaded PHP extensions, database and web server version, and switches
such as error display, automatic updates, XML-RPC and WP-Cron) – only versions, sizes and on/off values. The
environment can be switched off with “Report platform health” on the settings page.
Not transmitted are users, posts, comments, orders or any content of the site. The API token is stored on the
site only and never reaches the browser. The plugin works with a DomainWarn account only; the processing is
described in DomainWarn’s privacy policy.
External service
com (operated by Wigandt Technology,
Germany). Without an API token that you create yourself, the plugin stays idle and contacts nothing. The API
address is configurable, DomainWarn can also be self-hosted.
txt via DomainWarn”, the site fetches the file from
txt – at most once an hour – and
serves it itself. Normal page views never contact DomainWarn: the address of the file is stored on the site and
refreshed by the scheduled run.