The Stackbrace plugin for WordPress

From outside, Stackbrace sees what any visitor sees: whether the site answers, its certificate and domain, and the versions a page gives away. The plugin reports what only the site itself knows, every hour. It only talks outward: it takes no commands, and Stackbrace never holds a key to the site.

It is free and listed in WordPress’s plugin directory, where WordPress’s plugin team reviewed it. It reports to a Stackbrace account on the Agency plan, from $79 a month, or Agency Plus.

What it reports, every hour

• Exact versions. WordPress, PHP, the database and every plugin and theme, active or not, with the updates waiting and which ones update themselves. Known security holes are matched against exact versions, not the ones a page happens to show. Every version change is kept, so the site’s timeline and its monthly report list each update with the hour it happened.
• Changed files. WordPress’s core files compared to WordPress.org’s copy for that version, files changed under wp-content in the last 7 days, and any PHP file in the uploads folder. A changed core file or PHP in uploads is what a break-in looks like from inside, and alerts at once.
• Who can get in. How many users have each role, and each administrator’s login name, when they registered and when they last logged in. A guessable administrator name, too many administrators, or one who has not logged in for six months is a finding.
• Backups. Which backup plugins are installed and when each last completed a backup. Fourteen are recognised, among them UpdraftPlus, BackWPup, Duplicator, All-in-One WP Migration and WPvivid. No completed backup in 8 days is a warning.
• The error log. The last 20 PHP and database errors from the debug log, with addresses, tokens and passwords removed before they leave the site, and whether debug output is shown to visitors.

Each report lands in the site’s registry, in the Application and Backups layers, marked as coming from the plugin with the time it was sent. A plugin that has not reported for a day is a warning, since a site that stopped reporting may have stopped running.

Traps, if you want them

A box in the plugin’s settings sets two traps. One is an account nobody is told about, with no rights and a password nobody knows. The other is a hidden address named only in robots.txt, where an attacker looking for backups would look. Nobody honest has a reason to use either, so either being used is an urgent finding the moment it happens, with the address and browser that did it. Unticking the box removes both.

What it never does

• It opens no address on the site and accepts no instructions. There is no REST route that takes commands.
• It makes no updates, changes no files, runs nothing on request and logs nobody in.
• It sends file paths, dates and sizes, never the contents of a file. Paths are relative to the site, so the server’s folders stay on the server.
• It signs each report with a key that lets its holder post reports about that one site and nothing else. If Stackbrace were broken into, nobody could use it to reach a site. This is the difference from tools that update and log in to sites remotely: they need a way in, and the plugin has none.
• It sends nothing until a key is saved. Deleting it removes everything it stored, the trap account included.

The privacy policy says what each report carries and how long it is kept, and the security page how the key is kept.

Installing and connecting it

1. In Stackbrace, open the site’s registry and, under Application, choose the Stackbrace plugin, then Connect. Copy the key. It is shown once.
2. In WordPress, go to Plugins, then Add New Plugin, search for “Stackbrace”, install it and activate it.
3. Under Settings, then Stackbrace, paste the key and save. Choose “Send a report now” to see the first report arrive in the registry.

It needs WordPress 6.0 or later and PHP 7.4 or later. Reports go out on WordPress’s own schedule, which runs when the site has visitors. Updates to the plugin arrive like any other plugin’s. “New key” in the registry stops the old key at once, and “Disconnect” refuses its reports from then on.

Questions before you install it: help, or see what Agency adds beside the plugin.