Poke Monitor

Description

Poke Monitor shows you who is poking at your site and how. It records suspicious requests in your own database and lists them in a simple admin screen, one tab per type.

If your site is behind Cloudflare, Poke Monitor also tells you something few other tools do: whether anyone is reaching your server directly, skipping Cloudflare and its firewall altogether.

Poke Monitor is a log, not a firewall. It does not block, rate-limit or challenge anything. It tells you what is happening so you can decide what to do — for example, add a firewall rule at your host or in Cloudflare.

What it logs

• Cloudflare Bypass — your site is behind Cloudflare, but a request reached your server without the headers Cloudflare always adds (CF-Ray, CF-IPCountry, CF-Visitor). This usually means someone found your server’s real IP address and is skipping Cloudflare and its firewall.
• Probing — requests that end in a 404 and look for files scanners hunt for: .env, backup.sql, .git/config, wp-config.php.bak, phpinfo.php and similar. Take these events seriously, as they can drain your system resources!
• Direct PHP Access — requests for .php files inside wp-includes or your uploads folder. Visitors never need these; they are typically attempts to reach a planted backdoor.
• XML-RPC — every request to xmlrpc.php (except calls that log in successfully). The endpoint is mostly used for password guessing; the log shows the method called and the number of failed logins.
• Suspicious User Agent — requests with a missing or malformed User-Agent, or one from an HTTP library or a known scanner (curl, python-requests, Go-http-client, sqlmap, nikto and others).

One request can match several types — for example a probe for .env sent with curl. It is stored once and appears in each matching tab, and in the All tab.

For each logged request Poke Monitor stores the time, method, path, status code, client IP address, the address that actually connected to your server, User-Agent, and the Cloudflare headers if present.

Features

• Tabs for All and each error type, with request counts.
• Cloudflare card: shows whether your current request came through Cloudflare, and a switch to turn bypass detection on or off.
• Allowlist by exact IP address or exact User-Agent, for all types or selected ones — for example your uptime monitor or office IP. Each log row has buttons to allowlist its IP or User-Agent in one click.
• Clear one type, or clear the whole log.
• Automatic clean-up: entries older than 30 days are deleted daily.
• Requests from logged-in users are never logged.

What Poke Monitor cannot see

Please read this before relying on the log.

• Only requests that reach WordPress are logged. Requests for files that exist on disk, requests your web server blocks itself, and pages served from a full-page cache (for example Cloudflare APO, Varnish or a static cache plugin) never reach WordPress, so they are not in the log.
• An existing backdoor is invisible. If a malicious PHP file actually exists in wp-includes or uploads, your web server runs it directly and Poke Monitor never sees the request. Blocking PHP execution in those folders at the web server is the real protection; see the FAQ.
• Forged Cloudflare headers are not detected. Poke Monitor checks whether the Cloudflare headers are present, not whether the request really came from Cloudflare’s network. An attacker who sends fake headers directly to your server is not logged as a bypass. To close that gap, let your server accept web traffic only from Cloudflare’s IP ranges, or use Cloudflare’s Authenticated Origin Pulls.
• The client IP of a bypass can be fake. On requests that did not come through Cloudflare, the CF-Connecting-IP header is set by whoever sent the request. When the client IP differs from the address that actually connected, the log shows both; trust the connecting address when you write a firewall rule.
• Logged-in users are never logged, including requests made with a stolen account.
• Some legitimate tools will show up as Suspicious User Agent or XML-RPC — uptime monitors, server cron jobs that call wp-cron.php with wget or curl, integrations using HTTP libraries, desktop blogging apps. Add them to the allowlist.

Privacy

Poke Monitor stores IP addresses and User-Agents of the requests it logs. These are personal data under the GDPR.

• Everything stays in your own WordPress database. The plugin sends nothing to any external service.
• Entries are deleted automatically after 30 days.

You are responsible for mentioning the logging in your privacy policy — for example, that IP addresses and User-Agents of suspicious requests are stored for 30 days to protect the site. This is not legal advice.