=== Benchnode Connection Monitor ===
Contributors: benchnode
Tags: privacy, gdpr, http requests, monitoring, telemetry
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

See which plugins phone home, what they send, and who accesses your site's interfaces from outside. Everything stays on your server.

== Description ==

Plugins talk to outside servers all the time: license checks, update checks, usage statistics, AI services, fonts. Most of it is harmless, some of it is not, and almost none of it is visible. Connection Monitor makes it visible.

**Outgoing connections**

* Every request that goes through the WordPress HTTP API (`wp_remote_get`, `wp_remote_post` and friends)
* Which plugin or theme made it, and which plugin triggered it
* Server, address, method, status, duration, size, and whether page loads had to wait
* What kind of data was sent: site address, admin email, versions, plugin list, license key and more
* What came back: content type and structure of the answer (field names, values redacted)
* A best guess why: license check, update, telemetry, fonts, API (always marked as a guess)

**Incoming access**

* Calls to the REST API, XML-RPC, Ajax for visitors and wp-cron.php from outside
* Which plugin the interface belongs to, whether the caller was signed in, and the sender if it says so
* Normal page views are not logged

**Page scan**

* Loads a page like a visitor and lists everything the browser would fetch from outside servers: scripts, fonts, iframes, images

**Measurements**

* Start a named measurement before you install or configure a plugin, and export exactly that part as CSV

**Privacy by design**

* The plugin itself never connects anywhere. No update server of its own, no statistics, no account.
* Secrets (keys, tokens, passwords) are never stored. Email and IP addresses are masked.
* Visitor IP addresses are shortened before storing. Entries are deleted after 30 days (adjustable).

**Limits**

Requests a plugin sends past WordPress (its own cURL calls, sockets, `file_get_contents` with a URL) cannot be caught reliably from PHP. The page scan only sees what is in the HTML, not what a cookie banner or JavaScript adds later.

Built by [Benchnode](https://benchnode.net/), where we measure WordPress plugins under real conditions.

== Installation ==

1. Upload the plugin and activate it.
2. Go to Tools → Connections.
3. Use your site as usual. Connections appear as soon as they happen.

== Frequently Asked Questions ==

= Does it slow down my site? =

It only does work when a request actually leaves your server or something calls an interface from outside. Entries are written once at the end of the request.

= Does it send data anywhere? =

No. Everything stays in one table in your own database. Uninstalling the plugin removes the table and all settings.

= Can it block connections? =

Not in version 1.0. It shows what happens, so you can decide what to do.

== Changelog ==

= 1.1.0 =
* Records what outside servers send back: content type, structure of JSON answers (secrets redacted), kinds of data contained.
* Correct size for streamed downloads (for example fonts saved with download_url).

= 1.0.0 =
* First release: outgoing and incoming connections, data kinds, page scan, measurements, CSV export. English, German, Spanish.
