Description
Marukin HG Site Reporter provides a read-only REST endpoint for authorized monitoring clients. You can use any server-side HTTP client; no proprietary management app, hosted service, account, subscription or payment is required.
An administrator must issue a key and configure the client. Activating this plugin alone does not authorize access or send site information anywhere.
Languages
English and Japanese are included. Settings, notices and error messages are displayed in Japanese when the applicable WordPress site or user language is Japanese (ja), without downloading a language pack. WordPress.org language packs take precedence when available. API field names and authentication headers remain unchanged.
Reported information
- Site title and home URL.
- WordPress and web-server PHP versions.
- Database type (MySQL or MariaDB) and version, when identifiable.
- Installed standard plugins: identifiers, names, versions, activation states and cached update status.
- WordPress update status and last update-check timestamps.
- The most recent publication or modification timestamp among published, non-password-protected posts, pages and public custom post types.
No post bodies, user accounts, passwords, database credentials, download URLs, themes, must-use plugins or drop-ins are returned. Database server metadata may be cached for up to five minutes. Update status uses existing WordPress cache data; checks older than 24 hours are reported as unknown rather than current.
API
Use the API URL displayed under Settings > Marukin HG Site Reporter. A typical request is:
GET /wp-json/hg-site-reporter/v1/status
X-HG-Site-Reporter-Key: YOUR_64_CHARACTER_KEY
Accept: application/json
Send this request over HTTPS from your server-side client. The JSON response has schema_version 1. Bearer credentials and the old X-WP-Site-Reporter-Key header are not accepted. Existing keys can be kept when upgrading.
The endpoint is read-only. It cannot edit content, install updates, delete files or execute commands. Ordinary WordPress login credentials do not replace the API key. Optional IPv4/IPv6 source-IP restrictions use exact addresses, not CIDR ranges.
Privacy and external services
This plugin does not initiate monitoring requests to an external service, include analytics or load remote assets. It responds only to incoming requests that pass HTTPS, API key and optional IP checks. The receiving client obtains the site information listed above and controls its own retention. Configure only clients you trust, and protect any stored keys and reports.
No additional third-party service is required. Normal WordPress update checks are managed by WordPress itself; this plugin reads their cached results.
REST API restrictions
This plugin respects REST API restrictions imposed by other plugins and does not override them. If a security plugin blocks this endpoint, configure an appropriate exception in that plugin. For SiteGuard WP Plugin 1.8.10, add hg-site-reporter/v1 to its REST API exclusion namespaces. If using the retained legacy URL, also add wp-site-reporter/v1. API key, HTTPS and optional IP checks still apply after an exception.
Security and operation
- Keep keys out of URLs, public client-side code, logs and version control.
- Exclude both the current and legacy API URLs, including rest_route query URLs, from CDN and page caches.
- Do not log the X-HG-Site-Reporter-Key header.
- If HTTP Basic authentication protects the site, configure server-level access separately. This plugin does not bypass Basic authentication or WAF rules.
- Behind a CDN or proxy, configure trusted-proxy handling on the server for HTTPS and REMOTE_ADDR. Forwarded headers are not trusted directly.
- Rate limiting and request audit logs are not provided. Configure them at the web-server or WAF layer as needed.
- Revoke or rotate a key immediately if it may have been disclosed.
The minimum versions preserve compatibility with older installations; they are not security recommendations. Use maintained WordPress and PHP releases.
Installation
- Upload marukin-hg-site-reporter.zip through Plugins > Add New > Upload Plugin, or copy its folder to wp-content/plugins/.
- Activate Marukin HG Site Reporter.
- Open Settings > Marukin HG Site Reporter over HTTPS.
- Issue an API key. It is shown once; copy and store it securely.
- Copy the displayed API URL and configure your trusted HTTP client with the X-HG-Site-Reporter-Key header.
- Optionally restrict the client’s public source IP and verify a successful JSON response.
PHP 7.0 or later is required. Keys are generated using random_bytes(); if secure randomness is unavailable, issuing a key fails safely.
Upgrading from HG Site Reporter, WP Site Reporter or Company Monitor
Back up the site, then deactivate the old plugin before installing Marukin HG Site Reporter. Do not run both together. The folder and main file names have changed. Replace the old plugin files without using the WordPress Delete action: deleting an old version through WordPress runs its uninstall handler and removes shared key settings. If you already deleted it, issue a new key and update your client. Existing key hashes and allowed IP settings in the same WordPress site are migrated; issuing a new key is not required.
The old /wp-json/wp-site-reporter/v1/status URL is retained, but uses the same X-HG-Site-Reporter-Key authentication. Company Monitor’s older URL is not registered. Update clients that cannot send the current header. REST API restrictions must be configured in the security plugin or server that applies them.
FAQ
-
Can I use this without a particular management app?
-
Yes. Any HTTPS client that sends the documented header can read the JSON endpoint. No registration or proprietary app is necessary.
-
Can I display an existing API key again?
-
No. Only its SHA-256 hash is stored. Rotate the key if it is lost and update your client. Select the displayed API URL or the key at issuance to copy it manually.
-
Why does the API return 401, 403 or 404?
-
Check the current key, allowed source IP, HTTPS detection, plugin activation and the exact API URL. A missing or invalid key normally returns 401; HTTPS failures return 403. A server, WAF or another plugin may return its own status. Ensure the custom header reaches WordPress. A status code alone does not identify every cause.
-
What happens on deactivation or deletion?
-
Deactivation stops the endpoint but keeps settings for reactivation. Deleting through the WordPress Plugins screen removes current and legacy key hashes, allowed IPs and any retired plugin settings. On multisite, every site’s plugin settings are removed. Reinstalling requires a new key. Other plugins’ settings and site content are not removed.
Deleting files directly with FTP does not run the uninstall handler; revoke the key first. Reports and credentials saved in your external client are not deleted remotely.
-
Is multisite supported?
-
Yes. API settings and keys are per site; settings changes require a super administrator. Plugin inventory can include plugins shared across the network.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Marukin HG Site Reporter” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Marukin HG Site Reporter” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.9.3
- Bundle Japanese translations for settings, notices, error messages and the plugin description.
- Register the bundled language directory on init, while preserving WordPress.org language pack priority.
- Keep API URLs, response fields, authentication headers and saved credentials unchanged.
1.9.2
- Rename the plugin and text domain to Marukin HG Site Reporter (marukin-hg-site-reporter).
- Require PHP 7.0 or later and use native secure key generation.
- Use WordPress.org language packs instead of bundled translations and manual text-domain loading.
- Preserve existing API URLs, authentication headers, keys and allowed IP addresses.
1.9.1
- Remove the API URL and API key copy buttons and their JavaScript.
- Remove the REST API compatibility setting and its authentication-filter exception.
- Remove the retired option while preserving existing keys and allowed IP addresses.
- Restore the concise settings layout and Japanese wording, and add more space around section headings.
1.9.0
- Add translatable interface strings and bundled Japanese translations.
- Make the rest_disabled exception an explicit administrator opt-in, disabled by default.
- Validate settings input types and document standalone API usage and data handling.
- Standardize directory metadata and remove standalone development examples from the release package.
1.8.2
- Add API URL and one-time API key copy buttons.
1.8.1
- Remove current and legacy key settings on uninstall, including multisite.
1.8.0
- Authenticate exclusively through X-HG-Site-Reporter-Key.