=== UpHeron Vulnerability Monitoring ===
Contributors: symelo
Tags: security, vulnerability, vulnerability scanner, monitoring, uptime
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Uptime, response time and vulnerability monitoring, with alerts in wp-admin and by email and a status shortcode for visitors. No account needed.

== Description ==

Know when your site goes down, slows down, or runs a plugin or theme with a known vulnerability. Most hacked WordPress sites run one that was already fixed: UpHeron tells you as soon as it's published, and what to do.

Activate the plugin and UpHeron starts watching the site: no account, no sign-up, free. Every five minutes it checks from the internet that the site is online and how fast it answers. Every day, and right after you install or update something, it compares WordPress, every installed plugin and theme, PHP, the database server and the web server with the main vulnerability databases.

= Uptime and response time =

* Settings → UpHeron → Uptime shows whether the site is up, its uptime over 24 hours, 7, 30 and 90 days, the response time of the last check and over the last day, a chart of the last 24 hours and a bar per day for 90 days.
* Every outage, with when it started, how long it lasted and why (a timeout, an error page, a refused connection).
* When the site's TLS certificate and domain expire.
* An email when the site goes down and when it's back.
* A box at the top of the wp-admin Dashboard: online or not, ping, uptime over 24 hours and 30 days, the last 24 hours' response times, a bar per day and the open security alerts.

= Status for your visitors =

Add `[upheron_status]` to a page, a post or a widget to show visitors whether the site is online, its uptime and a bar per day, like a status page. Choose what it shows and how it looks on the Uptime tab, with a live preview: online status, uptime, the bars and how many days, response time, recent outages, a heading, and a card or one line for a header or footer.

The widget also shows the UpHeron logo with a link to the site's public status page on upheron.com, so visitors can check the site from outside it, even while it's down. Turn "Show link to status page on upheron.com" off on the Uptime tab if you'd rather not.

The shortcode reads a copy the plugin keeps, so it never slows a page down, and shows nothing until UpHeron has measured the site.

= Alerts at the top of wp-admin =

* One bar lists every open issue, most urgent first: actively exploited vulnerabilities, then releases that no longer get security fixes, then by severity.
* Open any alert for the details: what is affected, which version fixes it, the severity score, when it was published and when attackers started exploiting it, with a link to the advisory.
* An "Update to …" button when WordPress already offers the fixed version.
* Hide alerts one by one, or all at once, with Undo. Hiding is per user, and a hidden alert comes back by itself if it gets worse (a higher severity, or attackers start exploiting it).
* Collapse the bar to one line, choose which screens it appears on and the lowest severity it shows.
* Known vulnerabilities are also shown under the affected plugins on the Plugins screen.
* Settings → UpHeron lists every open issue, the hidden ones, the site's uptime and when it was last checked.

= Alerts by email =

UpHeron emails the site's admin address once you confirm it (UpHeron sends a confirmation email first, and every alert has an unsubscribe link). Change the address, the lowest severity worth an email, or turn downtime emails off in Settings → UpHeron. UpHeron also checks that the site is up every five minutes.

Want Slack, Microsoft Teams, Discord, webhooks, status pages or your other sites in one place? Add the site to a free UpHeron account whenever you like, with its history. It's optional.

= What is checked =

* WordPress core, including releases that no longer get security fixes
* Every installed plugin and theme, active or not (an inactive plugin's files are still on the server), premium ones included
* PHP, MySQL or MariaDB, and the web server (Apache, nginx, LiteSpeed and others)

Vulnerability data comes from WPVulnerability, WordPress's own security advisories, the CVE Program, NVD, OSV, CISA's catalog of exploited vulnerabilities and endoflife.date.

= Light on your site =

Nothing runs on your site's front end, except the status shortcode where you add it, which prints a stored copy of the uptime. wp-admin and the shortcode never wait for UpHeron; reports, checks and refreshing the copies run in the background with WP-Cron.

= External services =

This plugin is the WordPress side of **UpHeron** (https://upheron.com), a monitoring service operated by Symelo LTD. When the plugin is activated on a production site, it starts using UpHeron by itself: activating the plugin is how you agree to it. On staging, development and local sites (`wp_get_environment_type()`), on network sites other than the main one, and when `UPHERON_AUTO_REGISTER` is `false`, nothing is sent until an administrator presses "Start monitoring" in Settings → UpHeron. All requests go from your server to `upheron.com/api/v1/wordpress` over HTTPS and identify themselves with an `UpHeron-WordPress/<version>` user agent that includes your site's address.

* **Registering.** A few seconds after activation (or after "Start monitoring"), the plugin sends your site's address and name, the site's admin email address (for the alerts), the address of the plugin's verify route, and the versions of WordPress, PHP and the plugin. UpHeron then reads a one-time code from `/wp-json/upheron/v1/verify` on your site, which proves the request came from your site, and the plugin collects the site's access token. If the site moves to another address, the plugin registers the new one.
* **Reports.** Right after registering, a minute after plugins, themes or WordPress are installed, updated, activated, deactivated or deleted, and once a day, the plugin sends: your site's address and name, the plugin's version, the versions of WordPress, PHP, the database server and the web server, and the folder name, file name, name, version and active state of every installed plugin and theme.
* **Findings.** The plugin reads the site's open findings and status from UpHeron when its settings screen opens, a few times after a report while UpHeron checks it, and once a day. Only the site's access token is sent.
* **Uptime.** The plugin reads the site's uptime from UpHeron (its state, response times, uptime history, outages and certificate and domain expiry) when the Uptime tab opens, at most every five minutes in the background while the status shortcode or the Dashboard box is shown, and once a day. Only the site's access token is sent. The shortcode shows visitors this stored copy; their browsers never contact UpHeron.
* **Email alerts.** UpHeron emails the alert address once it is confirmed. Changing the address or the alert settings in Settings → UpHeron sends them to UpHeron. "Manage in the UpHeron dashboard" opens upheron.com, where you can add the site to an account.
* **Stopping.** Pressing Stop monitoring, or deleting the plugin, tells UpHeron to stop accepting the token. A site without an UpHeron account is then deleted at UpHeron with its history; a site in an account keeps its monitor there. Deactivating the plugin sends nothing.
* **Status page.** Right after registering (and once a day until it exists), the plugin asks UpHeron to publish the site's status page on upheron.com, which shows the site's name, whether it's online and its uptime; the status widget links to it. Turn off "Show link to status page on upheron.com" on the Uptime tab before it's published to keep it unpublished, or press "Remove" next to it on the Settings tab to delete it.
* **Uptime checks.** While UpHeron watches the site, its own servers request your site's address every five minutes to check that it is up and how fast it answers. This doesn't involve the plugin.

The plugin never sends your content, users, customers, orders, settings or passwords. The vulnerability databases are queried by UpHeron, never by your site.

UpHeron [Terms of Service](https://upheron.com/terms), [Privacy Policy](https://upheron.com/privacy).

= For developers =

* `define( 'UPHERON_AUTO_REGISTER', false );` or the `upheron_auto_register` filter: don't start monitoring by itself (default: production sites, main site of a network).
* `upheron_capability` (filter): capability needed to start and stop monitoring, change alerts and see findings (default `manage_options`).
* `upheron_http_timeout` (filter): timeout of requests to UpHeron in seconds (default 15).
* `upheron_registering` (action): the plugin asked UpHeron to watch the site.
* `upheron_reported` (action): after UpHeron accepted a report.
* `upheron_connection_lost` (action, `$message`, `$in_account`): UpHeron stopped accepting the site's token (removed from its account, or by UpHeron after a month without reports).
* `upheron_more_from_symelo` (filter): products listed under "More from Symelo LTD" on the Support tab.
* `define( 'UPHERON_API', 'http://localhost:3000/api/v1/wordpress' );` points the plugin at a development copy of UpHeron.

Shortcode: `[upheron_status]`, as set on the Uptime tab. Attributes override that on one page: `days` (7 to 90), `show` (any of `status,uptime,bars,response,incidents`), `title`, `style` (`card` or `badge`) and `branding` (`yes` or `no`, the UpHeron logo with a link to the site's status page).

REST API for administrators under `/wp-json/upheron/v1/`: `status`, `findings`, `refresh`, `uptime` (`?refresh=1`), `report`, `inventory`, `alerts`, `settings`, `email-alerts`, `email-alerts/resend`, `start`, `start/collect`, `stop`, `claim`. `verify` is public: UpHeron reads the one-time code from it while the site registers.

WP-CLI: `wp upheron status`, `wp upheron uptime [--refresh]`, `wp upheron start`, `wp upheron stop`, `wp upheron report`, `wp upheron findings [--refresh]`.

== Installation ==

1. Install and activate the plugin.
2. That's it: on a production site UpHeron starts watching within seconds, and Settings → UpHeron shows the first results soon after.
3. Confirm the email UpHeron sends to the site's admin address to get alerts by email. On a staging or development site, press "Start monitoring" in Settings → UpHeron.

== Frequently Asked Questions ==

= Is it free? =

Yes, and it needs no account. A site watched by the plugin doesn't use any UpHeron plan's monitors, also once you add it to an account.

= Why does UpHeron need to reach my site? =

To check that it's up, and once while registering, to read a one-time code from the plugin's verify route. That proves the request came from your site. Sites on your computer, behind a login wall or behind a firewall that blocks unknown visitors can't be verified; Settings → UpHeron says what went wrong and tries again every day.

= Can my visitors see whether the site is up? =

Yes, if you add the `[upheron_status]` shortcode to a page: it shows the site's state, its uptime and a bar per day. Nothing is shown to visitors unless you add it. It links to the site's public status page on upheron.com unless you turn "Show link to status page on upheron.com" off on the Uptime tab.

= How often is the site checked? =

Every five minutes, from the internet, by UpHeron's servers. The Uptime tab shows the results; the uptime history goes back 90 days.

= Who sees the alerts? =

In wp-admin, users who can manage the site's options (administrators). Each of them can hide alerts for themselves, and choose in Settings → UpHeron where the alert bar appears and the lowest severity it shows. By email, the address you set in Settings → UpHeron, once it's confirmed.

= I hid an alert. How do I get it back? =

Settings → UpHeron lists the hidden alerts under the open ones, with "Show in alerts" for each and "Show all in alerts again". A hidden alert also comes back by itself if it gets worse.

= I updated the plugin, but UpHeron still lists it =

The alert disappears from the bar as soon as the fixed version is installed. The plugin then reports the update to UpHeron about a minute later, and UpHeron confirms the fix within seconds.

= Does deactivating the plugin stop monitoring? =

No, so deactivating plugins to find a problem doesn't lose the site's history. Press Stop monitoring in Settings → UpHeron, or delete the plugin. A site that sends no report for 30 days is removed by UpHeron, after an email a week before.

= What about staging copies? =

The plugin only starts by itself on production sites, so a staging copy doesn't get a monitor of its own unless you press Start monitoring. A copy at another address never uses the original site's access token.

= Does it work on multisite? =

Yes. The main site starts by itself; each other site that should be watched starts on its own, with its own monitor.

== Screenshots ==

1. The alert bar at the top of wp-admin, with one alert opened.
2. Settings → UpHeron: the site's status and every open issue.
3. A known vulnerability under the affected plugin on the Plugins screen.
4. Settings → UpHeron: email alerts and monitoring.
5. Settings → UpHeron → Uptime: uptime, response times, a bar per day and outages.
6. The `[upheron_status]` shortcode on a page.

== Changelog ==

= 1.0.2 =
* The Dashboard box sits at the top and shows the ping (the last response time), uptime over 24 hours and 30 days, the last 24 hours' response times, a bar per day and the open security alerts.
* Choose what the status shortcode shows and how it looks on the Uptime tab, with a live preview.
* The status widget shows the UpHeron logo with a link to the site's public status page on upheron.com, which the plugin publishes; turn it off on the Uptime tab.

= 1.0.1 =
* UpHeron starts watching the site when the plugin is activated: no account, no sign-up. It verifies the site by reading a one-time code from the plugin's verify route.
* New Uptime tab: the site's state, uptime over 24 hours, 7, 30 and 90 days, response times, the last 24 hours, a bar per day, outages, and certificate and domain expiry.
* The `[upheron_status]` shortcode shows visitors whether the site is online and its uptime.
* A box on the wp-admin Dashboard with the site's state, uptime and open vulnerabilities.
* Email alerts go to the site's admin address once it's confirmed; change the address, the lowest severity and downtime emails in Settings → UpHeron.
* "Manage in the UpHeron dashboard" adds the site to an UpHeron account, optionally.
* Staging, development and local sites start only when you press Start monitoring.
* A site that moved registers its new address.
* WP-CLI: `wp upheron start`, `wp upheron stop` and `wp upheron uptime`.

= 1.0.0 =
* First release.
