WPSecureOps Connector

If you look after more than a handful of WordPress sites, Wordfence findings
arrive as one email per site per scan, in as many inboxes as you have sites.
This connector sends each completed scan to a single WPSecureOps dashboard
instead, where findings from every site queue up in one place, keep their
history, and can be acknowledged or ignored once rather than again on every
re-scan.

The plugin does not scan anything itself and does not change how Wordfence
behaves. It reads the results of scans Wordfence has already finished.

Setup is one click. Activate the plugin, open Settings → WPSecureOps,
press Connect now. The site registers itself, an operator approves it in the
dashboard, and it collects its own key. There is nothing to copy or paste and no
switch to remember to turn on: once a site is connected, every completed scan is
forwarded automatically. Pressing Disconnect is how you stop it.

What is sent

• Site name, public URL, and the WordPress, Wordfence and connector versions.
• Scan completion time, and whether the scan succeeded or failed.
• For each finding: issue type, severity, and a redacted title and description.
• A check-in every 30 minutes carrying the versions above, whether Wordfence is
  still active and scanning, and how many reports are waiting in the local
  queue. This is what lets the dashboard tell “no findings” apart from “this
  site stopped talking to us” — silence otherwise looks identical to health.

What is not sent

Usernames, passwords, API credentials, file contents, database contents, visitor
data and the raw Wordfence issue structure never leave the site. Absolute server
paths are rewritten to [site-root]/ before a report is queued, so a finding
cannot leak your directory layout.

Reliability

Reports go into a queue in your own database and are delivered by WP-Cron with
exponential backoff, so a dashboard outage or a network blip cannot lose a scan.
Every report carries a deterministic id derived from the installation and the
scan, so a retry can never create a duplicate entry in the dashboard. A report
that can never be delivered is dropped at the end of the retry ladder rather
than growing the queue forever.

External services

This plugin connects to the WPSecureOps API at https://wpsecureops.com — the
service the plugin exists to talk to, and the only external service it contacts.

It sends data at these points, and no others:

• When you press “Connect now” — the site name, home URL, WordPress and
  Wordfence versions, a locally generated installation id, and the hash of a
  locally generated claim secret. Nothing is sent before you press it: installing
  and activating the plugin contacts nothing at all.
• As part of that registration, WPSecureOps fetches your home URL once to
  confirm you control it, and the plugin answers with a one-time nonce.
• After a Wordfence scan completes, one report as described under “What is
  sent” above.
• Every 30 minutes while connected, one check-in as described above. The
  dashboard may change this rate; the plugin clamps whatever it is told to a
  range between 5 minutes and 6 hours.

Nothing is sent once you press Disconnect, and nothing is sent by a site that has
never been connected.

Privacy policy: https://wpsecureops.com/privacy

Self-hosters can point the connector at their own install with the
wpso_connector_endpoint filter or the advanced field on the settings screen.

Credits

Created by Guido Schad, author of
Lockora Security Audit
and Who Changed It? – Activity Log & Audit Trail.