WPSecureOps Connector

If you look after more than a handful of WordPress sites, Wordfence findings arrive as one email per site per scan, in as many inboxes as you have sites. This connector sends each completed scan to a single WPSecureOps dashboard instead, where findings from every site queue up in one place, keep their history, and can be acknowledged or ignored once rather than again on every re-scan.

The plugin does not scan anything itself and does not change how Wordfence behaves. It reads the results of scans Wordfence has already finished.

Setup is one click. Activate the plugin, open Settings → WPSecureOps, press Connect now. The site registers itself, an operator approves it in the dashboard, and it collects its own key. There is nothing to copy or paste and no switch to remember to turn on: once a site is connected, every completed scan is forwarded automatically. Pressing Disconnect is how you stop it.

What is sent

• Site name, public URL, and the WordPress, Wordfence and connector versions.
• Scan completion time, and whether the scan succeeded or failed.
• For each finding: issue type, severity, and a redacted title and description.
• A check-in every 30 minutes carrying the versions above, whether Wordfence is still active and scanning, and how many reports are waiting in the local queue. This is what lets the dashboard tell “no findings” apart from “this site stopped talking to us” — silence otherwise looks identical to health.

What is not sent

Usernames, passwords, API credentials, file contents, database contents, visitor data and the raw Wordfence issue structure never leave the site. Absolute server paths are rewritten to [site-root]/ before a report is queued, so a finding cannot leak your directory layout.

Reliability

Reports go into a queue in your own database and are delivered by WP-Cron with exponential backoff, so a dashboard outage or a network blip cannot lose a scan. Every report carries a deterministic id derived from the installation and the scan, so a retry can never create a duplicate entry in the dashboard. A report that can never be delivered is dropped at the end of the retry ladder rather than growing the queue forever.

External services

This plugin connects to the WPSecureOps API at https://wpsecureops.com — the service the plugin exists to talk to, and the only external service it contacts.

It sends data at these points, and no others:

• When you press “Connect now” — the site name, home URL, WordPress and Wordfence versions, a locally generated installation id, and the hash of a locally generated claim secret. Nothing is sent before you press it: installing and activating the plugin contacts nothing at all.
• As part of that registration, WPSecureOps fetches your home URL once to confirm you control it, and the plugin answers with a one-time nonce.
• After a Wordfence scan completes, one report as described under “What is sent” above.
• Every 30 minutes while connected, one check-in as described above. The dashboard may change this rate; the plugin clamps whatever it is told to a range between 5 minutes and 6 hours.

Nothing is sent once you press Disconnect, and nothing is sent by a site that has never been connected.

Privacy policy: https://wpsecureops.com/privacy

Self-hosters can point the connector at their own install with the wpso_connector_endpoint filter or the advanced field on the settings screen.

Credits

Created by Guido Schad, author of Lockora Security Audit and Who Changed It? – Activity Log & Audit Trail.