Free plugin

Which plugins phone home?

Plugins talk to outside servers all the time: license checks, update checks, usage statistics, AI services. Most of it is harmless, some of it isn’t, and you see almost none of it. Connection Monitor makes it visible. We use it ourselves in every lab test.

Version 1.1.0 · ZIP, 29 KB · GPL · WordPress 6.5+ · PHP 8.1+ · English, German, Spanish

What it shows you

Outgoing

Every request a plugin sends from your server: to which server, how long it took and which plugin is behind it.

What is sent and received

Which kinds of data go out, such as your site address, admin email, versions or plugin list, and what the server sends back. Keys and passwords are never stored.

Incoming

Who accesses your site’s interfaces from outside (REST API, XML-RPC, Ajax, cron), signed in or not, and which plugin the interface belongs to.

Page scan

What your visitors’ browsers load from outside servers: scripts, fonts, iframes, images.

A real example from our lab

We installed and activated WP Rocket 3.24 in our lab with a measurement running. Result on November 7, 2026:

31 outgoing connections to three WP Rocket servers (api.wp-rocket.me, saas.wp-rocket.me, b.rucss.wp-rocket.me)
Among other things, the page addresses, the license account’s email address and the license key were sent. According to the request, the pages were handed to the service for “performance_hints”.
Some of these requests ran before the license check had succeeded.

This isn’t an accusation: these features need that exchange. But you should know it happens, for example for your privacy policy. A detailed test will follow as its own article.

What it doesn't do

It makes no outside connections of its own. No update server of its own, no statistics, no account.
It never stores license keys, tokens or passwords. Email and IP addresses are masked.
Normal page views are not logged. For interface access, IP addresses are shortened.
Everything stays in your database and is deleted after 30 days (adjustable). Uninstalling removes everything.

Getting started

Download the ZIP.
In WordPress, go to Plugins → Add New → Upload Plugin, choose the ZIP and activate it.
Open Tools → Connections to see what happens. Before a test, start a measurement under Measurements.

For the technically curious

Outgoing: filter pre_http_request (start, never changes the request) and action http_api_debug (result). Stored: server, path without parameters, method, status, duration, size, blocking yes/no.
Attribution: via debug_backtrace. “Source” is the file that calls the HTTP function. If that’s WordPress itself (update checks, for example), the plugin that started it is listed as triggered_by.
Incoming: rest_post_dispatch, xmlrpc_call, admin_init for Ajax without sign-in, init for wp-cron.php from outside IPs. The owning plugin file is found via reflection on the callback. Your own browser session and the site calling itself are hidden by default.
Data kinds: pattern matching on the sent content (site address, admin email, versions, plugin list, theme, language, server details, license key). Field names like key, token, license, password are always redacted.
Reason: a guess based on address and content, marked “probably” in the interface.
Storage: one table {prefix}bnc_log, one write per request at shutdown, daily cleanup via WP-Cron.
Limits: requests that bypass WordPress (custom cURL, sockets, file_get_contents with a URL) can’t be caught reliably by any PHP plugin. The page scan reads the HTML only, not what a cookie banner or JavaScript loads later.
ZIP checksum (SHA-256): 16644ff78d7448e773032197ea12e514f6c9fa939e6465469dfe78bdbc8e4e44