FALKEN'S MAZE / WORDPRESS PLUGIN

The Plugin Recon WordPress plugin

From the outside, Plugin Recon can only check the plugins and theme your home page loads. Many plugins never show up there: admin tools, form plugins on other pages, and anything switched off but still installed. The Plugin Recon WordPress plugin reports the full list, so Joshua can check every installed plugin and theme at its exact version, along with your PHP version and two risky settings.

It's optional. Plugin Recon keeps working without it, from what your site shows publicly.

What the plugin sends

Your site's address

To match the report to the domain in your account.

WordPress version, and whether automatic core updates are on

To tell you when WordPress needs updating, and whether security releases install themselves.

PHP version

To warn you when your PHP version no longer gets security fixes.

Each installed plugin: folder name, name, version, whether it's active and whether it updates automatically

To compare every plugin, including inactive ones, with WordPress.org and flag outdated or closed plugins.

Each installed theme: folder name, name, version, whether it's in use, its parent theme and whether it updates automatically

To compare your themes with WordPress.org and flag outdated ones, including the parent of a child theme.

Whether PHP errors are shown to visitors (WP_DEBUG_DISPLAY) and whether the built-in file editor is on (DISALLOW_FILE_EDIT)

Two settings attackers look for: errors leak file paths, and the editor lets a stolen login run code.

The plugin's own version

So we know which fields to expect.

What it never sends

Usernames, email addresses or any other information about your users or visitors
Posts, pages, comments, orders, form entries or any other content
Passwords, API keys, database details or the contents of wp-config.php
Your server's files, logs or IP addresses
Your theme's settings, customizations or files

How it works

Once a day, and shortly after you add, update or remove a plugin or theme, the plugin sends one HTTPS request to Joshua with the information listed here. Joshua never connects to your WordPress admin, never logs in, and can't change anything on your site. We keep only the latest report for each domain, and delete it when you disconnect the plugin or remove the domain. Like any plugin, it also lets WordPress check for new versions of it, at plugins.falkensmaze.dev rather than WordPress.org.

Nothing is sent until a site administrator pastes the key and ticks the box agreeing to send it.
The plugin's settings page shows the exact report, word for word, before you connect.
In the portal, "See the data we hold" shows exactly what we stored from your site.
A report older than 7 days isn't used. Scans go back to what the site shows publicly.
Disconnecting in the portal stops the key working and deletes the stored report at once.

Install it

In the portal, open your domain and choose Connect WordPress. You'll see this list again, then get a key. It needs the Plugin Recon add-on.
Download the plugin and upload it under Plugins → Add New → Upload Plugin, then activate it.
WordPress opens Settings → Plugin Recon. Paste the key, tick the box and press Connect.

Questions about your data? Read the privacy policy, or see how Falken's Maze works.