DomainWarn Monitoring

Description

A site is not only broken when the page stays white. It is also broken when no order confirmation has gone out for
three days because WP-Cron has stalled. Or when the certificate expires in two weeks and nobody read the issuer’s
email. Or when a plugin has been carrying a known vulnerability for months.

DomainWarn monitors your domains from the outside – availability, redirects, TLS
certificate, DNS, SPF, DKIM, DMARC, blacklists, domain expiry. This plugin adds the inside view that nobody can see
from outside.

What the plugin does

• Adds the addresses of this site to monitoring. In a network, every site.
• Reports what is invisible from outside: the exact WordPress and PHP version, plugins and themes with a pending
  update, the mail setup – sender address and server. Together with the DNS records this yields the finding “your
  site sends through a server that is not in the SPF record”, which neither the site nor an outside check can reach
  on its own.
• Notices when WP-Cron stalls. A scheduled run reports in every 15 minutes. If it stops, WP-Cron has stalled:
  the site still answers, but no mail goes out and nothing is processed. DomainWarn then opens an incident and sends
  it to your channels – email, Slack, Teams or webhook.
• Serves security.txt via DomainWarn (optional, off by default). If DomainWarn hosts the security.txt of your
  domain, the site answers /.well-known/security.txt with a redirect to it – RFC 9116 allows that – and the
  mandatory Expires field stays current by itself. Only at the domain itself or with www in front of it, only to
  DomainWarn, and never over a security.txt that is already there: a file in the web root or another plugin is
  shown as a conflict instead of being overridden.
• Shows what DomainWarn hosts for the domain: the state of security.txt, MTA-STS and the BIMI logo, the DNS
  records to copy, and a link to the page in DomainWarn where they are set up with one click.
• Works from the command line as well: wp domainwarn test, wp domainwarn sync, wp domainwarn report.

Which data is transmitted

The plugin sends to DomainWarn: the addresses of the site, the WordPress and PHP version, the names and versions of
installed plugins and themes, the sender address and mail server, and whether maintenance mode is on.

Not transmitted are users, posts, comments, orders or any content of the site. The API token is stored on the
site only and never reaches the browser. The plugin works with a DomainWarn account only; the processing is
described in DomainWarn’s privacy policy.

External service

This plugin connects to the DomainWarn API at https://api.domainwarn.com (operated by Wigandt Technology,
Germany). Without an API token that you create yourself, the plugin stays idle and contacts nothing. The API
address is configurable, DomainWarn can also be self-hosted.

If you switch on “Serve security.txt via DomainWarn”, visitors who request /.well-known/security.txt are
redirected to https://domainwarn.com/security-txt/…, where DomainWarn serves the file. Normal page views never
contact DomainWarn: the redirect target is stored on the site and refreshed by the scheduled run.