PHPackages                             mindtwo/wordpress-monitoring - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Logging & Monitoring](/categories/logging)
4. /
5. mindtwo/wordpress-monitoring

ActiveWordpress-plugin[Logging & Monitoring](/categories/logging)

mindtwo/wordpress-monitoring
============================

WordPress plugin of the mindtwo monitoring suite: CMS-specific collectors, WP-Cron push and a signed pull endpoint on top of mindtwo/base-monitoring.

04[1 PRs](https://github.com/mindtwo/wordpress-monitoring/pulls)PHPCI passing

Since Jun 22Pushed 1mo agoCompare

[ Source](https://github.com/mindtwo/wordpress-monitoring)[ Packagist](https://packagist.org/packages/mindtwo/wordpress-monitoring)[ RSS](/packages/mindtwo-wordpress-monitoring/feed)WikiDiscussions main Synced 2w ago

READMEChangelogDependenciesVersions (2)Used By (0)

mindtwo/wordpress-monitoring
============================

[](#mindtwowordpress-monitoring)

[![Tests](https://github.com/mindtwo/wordpress-monitoring/actions/workflows/tests.yml/badge.svg)](https://github.com/mindtwo/wordpress-monitoring/actions/workflows/tests.yml)[![PHPStan Level 8](https://camo.githubusercontent.com/ff3c7f8c8667ce643f47e74532748f673482a5f95d7d4269f925f2eebbe5117e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d6c6576656c253230382d627269676874677265656e)](phpstan.neon.dist)[![PHP 8.0+](https://camo.githubusercontent.com/911a83e2aa6fe73660ab613629a95c76622bf03049a7344e80c5ea72d4ef9c7d/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f7068702d253545382e302d626c7565)](composer.json)[![License: MIT](https://camo.githubusercontent.com/be07a68b57a673af622198c336264f89d82bf4cd5d87bc0cb3f7b6ae47cc43ea/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d6c6967687467726579)](LICENSE.md)

WordPress plugin of the mindtwo monitoring suite. On top of [`mindtwo/base-monitoring`](https://github.com/mindtwo/base-monitoring) — which collects OS, web server, database, Node.js, system stats, Composer/npm packages, security audits, licenses and git status — this plugin adds:

- **WordPress collectors** — core version (matched against endoflife.date), installed plugins and themes with versions, activity state and **available updates**, plus operational state (environment type, debug flags, multisite, language).
- **Push** — a WP-Cron scheduled push of signed snapshots to the central endpoint.
- **Pull** — a signed `GET /api/app-monitoring` endpoint with rate limiting, optional IP allow-listing and transient-cached snapshots.
- **Settings screen** — Settings → Monitoring, with the spec'd priority chain: admin backend → `MONITORING_*` constants/environment variables → secure defaults.

Installation
------------

[](#installation)

### Composer-based WordPress (Bedrock & co.)

[](#composer-based-wordpress-bedrock--co)

```
composer require mindtwo/wordpress-monitoring
wp plugin activate wordpress-monitoring
```

### Configuration

[](#configuration)

Preferred: constants in `wp-config.php` (or environment variables) so secrets never live in the database:

```
define('MONITORING_PROJECT_KEY', 'prj_live_8f3a…');
define('MONITORING_SECRET', getenv('MONITORING_SECRET'));
```

Alternatively use the **Settings → Monitoring** screen. Backend values win over constants; blank backend fields fall through. Every setting is overridable:

Key (option / constant)DefaultPurpose`enabled` / `MONITORING_ENABLED``true`Master switch`project_key` / `MONITORING_PROJECT_KEY`–Project key from the dashboard`secret` / `MONITORING_SECRET`–Shared secret (never transmitted)`endpoint` / `MONITORING_ENDPOINT`central endpointPush target`ip_allow_list` / `MONITORING_IP_ALLOW_LIST`–Comma-separated IPs / CIDR ranges`route_enabled` / `MONITORING_ROUTE_ENABLED``true`Expose the pull endpoint`schedule_enabled` / `MONITORING_SCHEDULE_ENABLED``true`WP-Cron push`MONITORING_SCHEDULE_RECURRENCE``daily`Any registered cron recurrence`MONITORING_ROUTE_CACHE``300`Pull snapshot cache seconds (`0` disables)`MONITORING_RATE_LIMIT``10`Pull requests per minute per IP`MONITORING_SIGNATURE_TOLERANCE``300`Signature timestamp window (seconds)`MONITORING_PROJECT_ROOT`autoWhere composer.lock & git live (auto-detects Bedrock layouts)The pull endpoint
-----------------

[](#the-pull-endpoint)

`GET /api/app-monitoring` returns the current snapshot as JSON. Requests must be signed exactly like every endpoint of the suite:

```
X-Monitoring-Key:
X-Monitoring-Timestamp:
X-Monitoring-Signature: hex( hmac_sha256( ".", secret ) )

```

Request order: rate limit (429) → IP allow-list (403) → configuration guard (503) → signature + replay window (401) → cached snapshot (200). The endpoint is registered through a rewrite rule — it is flushed automatically on activation/deactivation.

> Behind a proxy/load balancer make sure `REMOTE_ADDR` carries the real client IP before relying on the allow-list.

How pushing works
-----------------

[](#how-pushing-works)

On activation (and kept in sync on every request) a `mindtwo_monitoring_push` event is scheduled via WP-Cron. When it fires, a snapshot is built — every collector individually fault-isolated — signed, and POSTed to the configured endpoint.

WP-Cron only runs on traffic; for reliably timed pushes on low-traffic sites use a [real cron for wp-cron.php](https://developer.wordpress.org/plugins/cron/hooking-wp-cron-into-the-system-task-scheduler/).

Architecture note
-----------------

[](#architecture-note)

All logic is unit-tested against a `WordPressApi` interface — `get_option`, plugin lists, transients, cron calls all pass through it, with a guarded native implementation. The WordPress glue ([`Plugin`](src/Plugin.php), the settings screen) only wires hooks.

Development
-----------

[](#development)

```
composer install
composer check    # pint --test + phpstan (level 8, wordpress-stubs) + pest
```

Security
--------

[](#security)

If you discover a security issue, please email instead of opening a public issue.

License
-------

[](#license)

The MIT License (MIT). See [LICENSE.md](LICENSE.md).

###  Health Score

22

—

LowBetter than 21% of packages

Maintenance61

Regular maintenance activity

Popularity5

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity13

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

### Community

Maintainers

![](https://www.gravatar.com/avatar/4cc86fe6179314d204b14d1c81eb09a87ef84b0bcf2360dcd981171d1346c077?d=identicon)[mindtwo](/maintainers/mindtwo)

---

Top Contributors

[![jonasemde](https://avatars.githubusercontent.com/u/5083193?v=4)](https://github.com/jonasemde "jonasemde (3 commits)")

### Embed Badge

![Health badge](/badges/mindtwo-wordpress-monitoring/health.svg)

```
[![Health](https://phpackages.com/badges/mindtwo-wordpress-monitoring/health.svg)](https://phpackages.com/packages/mindtwo-wordpress-monitoring)
```

###  Alternatives

[psr/log

Common interface for logging libraries

10.4k1.2B12.0k](/packages/psr-log)[open-telemetry/api

API for OpenTelemetry PHP.

2041.5M292](/packages/open-telemetry-api)[open-telemetry/sdk

SDK for OpenTelemetry PHP.

2428.5M361](/packages/open-telemetry-sdk)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)