About this plugin
TalktoMonitor connects your WordPress site to the TalkToWP platform for continuous AI-powered health monitoring.
Local security and health scanning run on your own site and need no account at all. Plain-English explanations, AI diagnostics, and the hosted dashboard are produced on the TalkToWP servers and require a free TalkToWP account. See the External services section below for exactly what is sent, when, and under which terms.
org checksum API is contacted automatically, with or without a key, to check core file integrity.
Once connected, TalkToWP watches your site around the clock and uses AI to:
- Detect and explain plugin conflicts, PHP errors, and security threats
- Monitor performance, uptime, and SSL certificate health
- Identify SEO spam injections and hidden malicious links
- Scan for unauthorized admin accounts and changed homepage content
- Send email alerts when critical issues are found
What data is collected?
The plugin transmits technical metrics — WordPress version, PHP version, active plugins, available updates, database health, server memory usage, error log counts, and security scan results — and, in some cases, small pieces of your site’s content: recent PHP error-log lines, the usernames and registration dates of administrator accounts flagged as unrecognised, and post IDs, titles and short excerpts from database scan findings.
Error-log lines can contain server file paths and occasionally values from the request that caused the error. The External services section below lists exactly what is sent.
Features include:
- Adaptive heartbeat monitoring (3-minute lightweight pulse + daily full snapshot)
- Security scan: SEO spam, hidden links, suspicious admin accounts, homepage integrity
- Google PageSpeed Insights integration (via TalkToWP dashboard)
- Plugin vulnerability detection
- WP-Cron health monitoring
- AI Chat: ask questions about your site in plain English
- Debug log detection, with copyable wp-config.php instructions when it’s off
External services
This plugin is the site-side agent for TalkToWP, a hosted WordPress monitoring
service operated by Beyondt Consultancy & Services Pvt. Ltd. Local security
scanning and site health checks run entirely on your own server and require no
account. Plain-English explanations, AI diagnostics, and the hosted dashboard are
produced on the TalkToWP servers and require a free TalkToWP account.
1. com) — required for AI diagnostics and the dashboard
What it is used for: storing and analysing your site’s health data, generating the
AI diagnostics and incidents shown in your TalkToWP dashboard, and sending alerts.
Nothing is transmitted to TalkToWP until you paste a TalkToWP API key on
Settings → TalkToWP and save. Removing the key stops all transmission to
TalkToWP. (The plugin’s local security scans still run without a key — see
)
Once a key is saved, the plugin sends:
- POST https://app.talktowp.com/api/plugin/heartbeat — every 3 minutes via
WP-Cron. Sends a timestamp, the change in PHP error count, memory usage
percentage, a hash representing your plugin/theme/core versions, and the HTTP
status code of your own homepage.
- POST https://app.talktowp.com/api/plugin/health — once daily via WP-Cron, and
also when you save your API key, press “Test Connection”, switch themes, or
update WordPress core. Sends your site URL and the full technical snapshot:
WordPress and PHP versions, active plugins and themes with their versions,
available updates, database size and table status, server memory and disk usage,
error-log line counts and recent error-log lines, WP-Cron status, SSL certificate
status, and security scan results. The next paragraphs list the parts of that
snapshot that are more than counts. You can inspect the exact payload before it
is ever sent using the “Preview Data Sent for Analysis” button on the settings page.
- POST https://app.talktowp.com/api/plugin/uninstall — once, when you delete the
plugin. Sends only your site URL, so TalkToWP can close open incidents and mark
the site as disconnected.
The daily snapshot contains the following in addition to technical metrics:
- Up to 20 recent PHP error-log lines, each cut to 500 characters, plus fatal-error
lines that name an active plugin. These lines are sent as they appear in your
log, so they can contain server file paths and occasionally values from the
request that caused the error.
- The usernames and registration dates of administrator accounts the scan flags as
unrecognised. Administrator email addresses are not sent.
- For database scan findings in posts: the post ID, the post title, and an excerpt
of up to 120 characters of the post content. For findings in wp_options: the
option name and a SHA-256 hash of the matched text, not the value itself.
- For SEO-spam and hidden-link findings: post IDs and SHA-256 hashes of the
matched text.
The plugin does not deliberately collect passwords or visitor data, but anything
an error-log line happens to contain is sent with it. The plugin never reads
env files, or private keys.
The plugin registers three REST routes under /wp-json/talktowp/v1/:
- health-data (GET) — returns the same technical snapshot described above. It
changes nothing.
- reset-homepage-hash (POST) — fetches your homepage, stores a new fingerprint of
its text in place of the old one, and clears the recorded “homepage changed”
time, so the homepage-change check starts again from the current page.
-
push-now (POST) — sends a fresh health snapshot to TalkToWP and, when the
request asks for it, first runs a new security scan and stores the result.
health-data and reset-homepage-hash require your API key in an X-API-Key
request header. push-now requires an HMAC-SHA256 signature derived from your API
key, with a ±5-minute window and replay protection. The only things these routes
write are the plugin’s own options in your WordPress database, such as the
homepage fingerprint and the last scan result. None of them install, update,
activate or deactivate anything, and none modify plugin, theme, core or any other
site files.
com/terms
com/privacy
2. org) — automatic, no account required
What it is used for: the core file integrity scan. To tell whether a WordPress
core file has been modified, the plugin fetches the official checksums for your
WordPress version from
version=&locale=en_US
and compares them against the files on disk locally. This runs as part of the
daily local security scan whether or not a TalkToWP API key is saved.
What is sent and when: your WordPress version number only, at most once per day
(the response is cached in a transient). No site URL, no personal data. This is
org service that WordPress core itself uses.
org/about/privacy/