=== Falken's Maze Plugin Recon ===
Contributors: falkensmaze
Tags: security, plugins, updates, vulnerability, scanner
Requires at least: 5.8
Tested up to: 6.8
Requires PHP: 7.4
Stable tag: 0.2.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Lets Falken's Maze check every plugin and theme on your site, not just the ones your pages load. Shows you exactly what it sends before it sends anything.

== Description ==

Falken's Maze scans domains for security problems. Its Plugin Recon add-on checks WordPress sites for outdated core, plugins and themes. From the outside it can only see the plugins and theme your home page loads. This plugin reports the full list, so Plugin Recon can check every installed plugin and theme, inactive ones included, plus your PHP version and a few risky settings.

You need a Falken's Maze account with Plugin Recon. Nothing is sent until you paste your key under Settings → Plugin Recon and agree to send it.

= What this plugin sends =

* Your site's address, to match the report to the domain in your account.
* The WordPress version, and whether automatic core updates are on.
* The PHP version.
* Each installed plugin: folder name, name, version, whether it's active and whether it updates automatically.
* Each installed theme: folder name, name, version, whether it's in use, its parent theme and whether it updates automatically.
* Whether PHP errors are shown to visitors, and whether the built-in file editor is on (DISALLOW_FILE_EDIT).
* The plugin's own version.

= What it never sends =

* Usernames, email addresses or any other information about your users or visitors.
* Posts, pages, comments, orders, form entries or any other content.
* Passwords, API keys, database details or the contents of wp-config.php.
* Your server's files, logs or IP addresses.
* Your theme's settings, customizations or files.

The settings page shows the exact report, word for word, before you connect.

== External services ==

This plugin connects to the Falken's Maze scan engine at https://joshua.falkensmaze.dev/api/v1/inventory. It sends the information listed above once a day, and a few minutes after a plugin or theme is activated, switched, updated or deleted. It sends nothing until a site administrator has entered a key and agreed on the settings page, and it stops when you choose Disconnect or deactivate the plugin.

Falken's Maze keeps only the latest report for each domain and deletes it when you disconnect the domain in the Falken's Maze portal.

WordPress also checks https://plugins.falkensmaze.dev for new versions of this plugin, the way it checks WordPress.org for other plugins, and downloads updates from there. Each check sends what WordPress sends WordPress.org for a plugin update check: this plugin's details (name, version, folder), your site's address, WordPress version and language. This happens whether or not you've connected the plugin.

* Terms of service: https://joshua.falkensmaze.dev/terms
* Privacy policy: https://joshua.falkensmaze.dev/privacy

== Installation ==

1. In the Falken's Maze portal, open your domain and choose Connect WordPress. Read what the plugin sends, then create a key.
2. Install and activate this plugin. WordPress opens Settings → Plugin Recon for you.
3. Paste the key, tick the box and press Connect.

== Frequently Asked Questions ==

= Can Falken's Maze change anything on my site? =

No. The plugin only sends a report. Falken's Maze never logs in to your site, and the plugin accepts no commands.

= How do I stop it? =

Choose Disconnect under Settings → Plugin Recon, or deactivate the plugin. To delete what was already sent, choose Disconnect on the domain's page in the Falken's Maze portal.

== Changelog ==

= 0.2.1 =
* Updates now come from plugins.falkensmaze.dev, so new versions show under Dashboard → Updates like any other plugin. Install 0.2.1 by hand once; later versions update in place.
* Requires WordPress 5.8 or later.

= 0.2.0 =
* Reports installed themes (folder name, name, version, whether in use, parent theme, auto-updates), so Plugin Recon can check them against WordPress.org.
* Sends a report a few minutes after you switch or delete a theme.

= 0.1.0 =
* First release.
