DomainWarn Monitoring

A site is not only broken when the page stays white. It is also broken when no order confirmation has gone out for
three days because WP-Cron has stalled. Or when the certificate expires in two weeks and nobody read the issuer’s
email. Or when a plugin has been carrying a known vulnerability for months.

DomainWarn monitors your domains from the outside – availability, redirects, TLS
certificate, DNS, SPF, DKIM, DMARC, blacklists, domain expiry. This plugin adds the inside view that nobody can see
from outside.

What the plugin does

• Adds the addresses of this site to monitoring. In a network, every site.
• Reports what is invisible from outside: the exact WordPress and PHP version, plugins and themes with a pending
  update, the mail setup – sender address and server. Together with the DNS records this yields the finding “your
  site sends through a server that is not in the SPF record”, which neither the site nor an outside check can reach
  on its own.
• Notices when WP-Cron stalls. A scheduled run reports in every 15 minutes. If it stops, WP-Cron has stalled:
  the site still answers, but no mail goes out and nothing is processed. DomainWarn then opens an incident and sends
  it to your channels – email, Slack, Teams or webhook.
• Serves security.txt via DomainWarn (optional, off by default). If DomainWarn hosts the security.txt of your
  domain, the site fetches it from there and serves it itself at /.well-known/security.txt – no redirect – and the
  mandatory Expires field stays current by itself. The file is kept for an hour; while DomainWarn cannot be reached,
  the site serves the last good copy as long as it has not expired. Only at the domain itself or with www in front
  of it, only from DomainWarn, and never over a security.txt that is already there: a file in the web root or
  another plugin is shown as a conflict instead of being overridden.
• Shows the state of the site on the dashboard: a “DomainWarn” widget with availability over 30 days, the
  response time of the last 7 days as a small chart, certificate and domain expiry and open incidents – for every
  domain of the site, with a link to it in DomainWarn. The figures are refreshed by the scheduled run at most once
  an hour; opening the dashboard never contacts DomainWarn.
• Works from the command line as well: wp domainwarn test, wp domainwarn sync, wp domainwarn report.

Which data is transmitted

The plugin sends to DomainWarn: the addresses of the site, the WordPress and PHP version, the names and versions of
installed plugins and themes, the sender address and mail server, whether maintenance mode is on, and the environment
(PHP settings such as memory limit and OPcache, loaded PHP extensions, database and web server version, and switches
such as error display, automatic updates, XML-RPC and WP-Cron) – only versions, sizes and on/off values. The
environment can be switched off with “Report platform health” on the settings page.

Not transmitted are users, posts, comments, orders or any content of the site. The API token is stored on the
site only and never reaches the browser. The plugin works with a DomainWarn account only; the processing is
described in DomainWarn’s privacy policy.

External service

This plugin connects to the DomainWarn API at https://api.domainwarn.com (operated by Wigandt Technology,
Germany). Without an API token that you create yourself, the plugin stays idle and contacts nothing. The API
address is configurable, DomainWarn can also be self-hosted.

If you switch on “Serve security.txt via DomainWarn”, the site fetches the file from
https://domainwarn.com/security-txt/… when someone requests /.well-known/security.txt – at most once an hour – and
serves it itself. Normal page views never contact DomainWarn: the address of the file is stored on the site and
refreshed by the scheduled run.