About this plugin
If you look after more than a handful of WordPress sites, Wordfence findings
arrive as one email per site per scan, in as many inboxes as you have sites.
This connector sends each completed scan to a single WPSecureOps dashboard
instead, where findings from every site queue up in one place, keep their
history, and can be acknowledged or ignored once rather than again on every
re-scan.
The plugin does not scan anything itself and does not change how Wordfence
behaves. It reads the results of scans Wordfence has already finished.
Setup is one click. Activate the plugin, open Settings → WPSecureOps,
press Connect now. The site registers itself, an operator approves it in the
dashboard, and it collects its own key. There is nothing to copy or paste and no
switch to remember to turn on: once a site is connected, every completed scan is
forwarded automatically. Pressing Disconnect is how you stop it.
What is sent
- Site name, public URL, and the WordPress, Wordfence and connector versions.
- Scan completion time, and whether the scan succeeded or failed.
- For each finding: issue type, severity, and a redacted title and description.
- A check-in every 30 minutes carrying the versions above, whether Wordfence is
still active and scanning, and how many reports are waiting in the local
queue. This is what lets the dashboard tell “no findings” apart from “this
site stopped talking to us” — silence otherwise looks identical to health.
What is not sent
Usernames, passwords, API credentials, file contents, database contents, visitor
data and the raw Wordfence issue structure never leave the site. Absolute server
paths are rewritten to [site-root]/ before a report is queued, so a finding
cannot leak your directory layout.
Reliability
Reports go into a queue in your own database and are delivered by WP-Cron with
exponential backoff, so a dashboard outage or a network blip cannot lose a scan.
Every report carries a deterministic id derived from the installation and the
scan, so a retry can never create a duplicate entry in the dashboard. A report
that can never be delivered is dropped at the end of the retry ladder rather
than growing the queue forever.
External services
com — the
service the plugin exists to talk to, and the only external service it contacts.
It sends data at these points, and no others:
- When you press “Connect now” — the site name, home URL, WordPress and
Wordfence versions, a locally generated installation id, and the hash of a
locally generated claim secret. Nothing is sent before you press it: installing
and activating the plugin contacts nothing at all.
- As part of that registration, WPSecureOps fetches your home URL once to
confirm you control it, and the plugin answers with a one-time nonce.
- After a Wordfence scan completes, one report as described under “What is
sent” above.
- Every 30 minutes while connected, one check-in as described above. The
dashboard may change this rate; the plugin clamps whatever it is told to a
range between 5 minutes and 6 hours.
Nothing is sent once you press Disconnect, and nothing is sent by a site that has
never been connected.
com/privacy
Self-hosters can point the connector at their own install with the
wpso_connector_endpoint filter or the advanced field on the settings screen.
Credits
Created by Guido Schad, author of
Lockora Security Audit
and Who Changed It? – Activity Log & Audit Trail.