DomainWarn Monitoring

Description

A site is not only broken when the page stays white. It is also broken when no order confirmation has gone out for
three days because WP-Cron has stalled. Or when the certificate expires in two weeks and nobody read the issuer’s
email. Or when a plugin has been carrying a known vulnerability for months.

DomainWarn monitors your domains from the outside – availability, redirects, TLS
certificate, DNS, SPF, DKIM, DMARC, blacklists, domain expiry. This plugin adds the inside view that nobody can see
from outside.

What the plugin does

• Adds the addresses of this site to monitoring. In a network, every site.
• Reports what is invisible from outside: the exact WordPress and PHP version, plugins and themes with a pending
  update, the mail setup – sender address and server. Together with the DNS records this yields the finding “your
  site sends through a server that is not in the SPF record”, which neither the site nor an outside check can reach
  on its own.
• Notices when WP-Cron stalls. A scheduled run reports in every 15 minutes. If it stops, WP-Cron has stalled:
  the site still answers, but no mail goes out and nothing is processed. DomainWarn then opens an incident and sends
  it to your channels – email, Slack, Teams or webhook.
• Works from the command line as well: wp domainwarn test, wp domainwarn sync, wp domainwarn report.

Which data is transmitted

The plugin sends to DomainWarn: the addresses of the site, the WordPress and PHP version, the names and versions of
installed plugins and themes, the sender address and mail server, and whether maintenance mode is on.

Not transmitted are users, posts, comments, orders or any content of the site. The API token is stored on the
site only and never reaches the browser. The plugin works with a DomainWarn account only; the processing is
described in DomainWarn’s privacy policy.

External service

This plugin connects to the DomainWarn API at https://api.domainwarn.com (operated by Wigandt Technology,
Germany). Without an API token that you create yourself, the plugin stays idle and contacts nothing. The API
address is configurable, DomainWarn can also be self-hosted.

Technical details