Marukin HG Site Reporter

Marukin HG Site Reporter provides a read-only REST endpoint for authorized monitoring clients. You can use any server-side HTTP client; no proprietary management app, hosted service, account, subscription or payment is required.

An administrator must issue a key and configure the client. Activating this plugin alone does not authorize access or send site information anywhere.

Languages

English and Japanese are included. Settings, notices and error messages are displayed in Japanese when the applicable WordPress site or user language is Japanese (ja), without downloading a language pack. WordPress.org language packs take precedence when available. API field names and authentication headers remain unchanged.

Reported information

• Site title and home URL.
• WordPress and web-server PHP versions.
• Database type (MySQL or MariaDB) and version, when identifiable.
• Installed standard plugins: identifiers, names, versions, activation states and cached update status.
• WordPress update status and last update-check timestamps.
• The most recent publication or modification timestamp among published, non-password-protected posts, pages and public custom post types.

No post bodies, user accounts, passwords, database credentials, download URLs, themes, must-use plugins or drop-ins are returned. Database server metadata may be cached for up to five minutes. Update status uses existing WordPress cache data; checks older than 24 hours are reported as unknown rather than current.

API

Use the API URL displayed under Settings > Marukin HG Site Reporter. A typical request is:

GET /wp-json/hg-site-reporter/v1/status
X-HG-Site-Reporter-Key: YOUR_64_CHARACTER_KEY
Accept: application/json

Send this request over HTTPS from your server-side client. The JSON response has schema_version 1. Bearer credentials and the old X-WP-Site-Reporter-Key header are not accepted. Existing keys can be kept when upgrading.

The endpoint is read-only. It cannot edit content, install updates, delete files or execute commands. Ordinary WordPress login credentials do not replace the API key. Optional IPv4/IPv6 source-IP restrictions use exact addresses, not CIDR ranges.

Privacy and external services

This plugin does not initiate monitoring requests to an external service, include analytics or load remote assets. It responds only to incoming requests that pass HTTPS, API key and optional IP checks. The receiving client obtains the site information listed above and controls its own retention. Configure only clients you trust, and protect any stored keys and reports.

No additional third-party service is required. Normal WordPress update checks are managed by WordPress itself; this plugin reads their cached results.

REST API restrictions

This plugin respects REST API restrictions imposed by other plugins and does not override them. If a security plugin blocks this endpoint, configure an appropriate exception in that plugin. For SiteGuard WP Plugin 1.8.10, add hg-site-reporter/v1 to its REST API exclusion namespaces. If using the retained legacy URL, also add wp-site-reporter/v1. API key, HTTPS and optional IP checks still apply after an exception.

Security and operation

• Keep keys out of URLs, public client-side code, logs and version control.
• Exclude both the current and legacy API URLs, including rest_route query URLs, from CDN and page caches.
• Do not log the X-HG-Site-Reporter-Key header.
• If HTTP Basic authentication protects the site, configure server-level access separately. This plugin does not bypass Basic authentication or WAF rules.
• Behind a CDN or proxy, configure trusted-proxy handling on the server for HTTPS and REMOTE_ADDR. Forwarded headers are not trusted directly.
• Rate limiting and request audit logs are not provided. Configure them at the web-server or WAF layer as needed.
• Revoke or rotate a key immediately if it may have been disclosed.

The minimum versions preserve compatibility with older installations; they are not security recommendations. Use maintained WordPress and PHP releases.