Title: GOOSEC
Author: goosec
Published: <strong>September 17, 2026</strong>
Last modified: September 17, 2026

---

Search plugins

![](https://ps.w.org/goosec/assets/banner-772x250.png?rev=3699713)

![](https://ps.w.org/goosec/assets/icon-128x128.png?rev=3699859)

# GOOSEC

 By [goosec](https://profiles.wordpress.org/goosec/)

[Download](https://downloads.wordpress.org/plugin/goosec.1.5.5.zip)

 * [Details](https://wordpress.org/plugins/goosec/#description)
 * [Reviews](https://wordpress.org/plugins/goosec/#reviews)
 *  [Installation](https://wordpress.org/plugins/goosec/#installation)
 * [Development](https://wordpress.org/plugins/goosec/#developers)

 [Support](https://wordpress.org/support/plugin/goosec/)

## Description

**GOOSEC** collects the external resources (script, link, iframe, img) that your
pages load, and lists them in one place. It tells you when a new destination appears,
and when the structure of your front page changes.

Tag managers, ads, analytics, payment services — most sites load scripts that the
site owner never explicitly reviewed. Knowing what is actually loaded today is the
starting point.

#### What it does

 * **Lists external destinations** — Extracts `script`, `link`, `iframe` and `img`
   sources from the HTML of your pages. You can scan several pages, and sites behind
   HTTP Basic authentication are supported.
 * **Marks what is new** — Compares against the previous scan and flags destinations
   that appear for the first time.
 * **Shows a three-level risk hint** — Domains in the plugin’s built-in trust list(
   73 entries) or in your own list are shown as low. Direct requests to IP addresses,
   free top-level domains and URL shorteners are shown as high. Everything else 
   is shown as unverified.
 * **Detects front page tampering** — Compares the tag structure, the resources 
   it loads and the contents of inline scripts against a baseline you approve. Editing
   article text does not trigger a notification.
 * **Sends email** — Notifies you about new destinations, high-risk destinations
   and structural changes. The same state is never reported twice.
 * **Runs daily** — One scheduled scan per day, plus a manual scan button.
 * **Keeps history** — Scan history is kept for 365 days; a daily job removes anything
   older.

#### About the risk levels

High, unverified and low are **a hint about what to look at first, not a verdict
about safety**. They are decided from the shape of the domain and from whether it
appears in a trust list. The plugin does not inspect the content of any request.
A destination shown as low is not guaranteed to be safe.

The 73 built-in entries can be reviewed in full on the settings screen. You cannot
edit that list, but you can add your own domains, and the reason column tells you
which list a domain matched.

#### What it cannot see

The plugin fetches the HTML of your pages from the server and parses it. **Requests
that only appear while a visitor’s browser is running the page — for example scripts
injected through a tag manager — are not visible this way.** If you need those, 
see the optional paid service below.

#### Optional paid service

Everything described above works on its own and contacts no third-party service.

If you subscribe to GOOSEC Lite, you can upload the configuration file we issue,
and the plugin will show detections made in your visitors’ browsers. **This is entirely
optional. No request leaves your site until you upload that file.** The destinations
and the data involved are listed under “External services” below.

See https://www.goosec.site/ for details.

### External services

**With the free features only, this plugin does not connect to any third-party service.**
Everything it collects is stored in your own WordPress database. It does fetch your
own pages over HTTP in order to scan them.

Note for reviewers: `includes/class-risk.php` contains a static list of domain names(
Google, CDNs, payment providers and so on). It is a classification allow-list compared
as plain strings against URLs found while scanning the site owner’s own pages. The
plugin never connects to, enqueues or loads anything from those domains.

If you subscribe to GOOSEC Lite and upload `goosec_config.js` from the settings 
screen, the plugin connects to the following services.

**1. GOOSEC API (api.goosec.jp) — retrieving detections**

 * **Sent**: the license key, scenario ID and read key issued when you subscribe,
   plus the date range being requested.
 * **Not sent**: your site’s content, your posts, or any personal data about your
   visitors.
 * **When**: when an administrator opens the plugin dashboard, and once per day 
   in the background.

**2. GOOSEC detection script (your own subdomain of goosec.jp, and assets.goosec.
jp)**

 * Once enabled, **a script tag is added to every page of your site**.
 * **Your visitors’ browsers** send information about outbound requests occurring
   on the page (destination URL, page URL, timestamp) to GOOSEC servers.
 * This is part of the subscribed service and requires a paid plan.

All of the above services are operated by GIV Inc., the author of this plugin. A
paid subscription is required; no data is sent unless you subscribe and upload `
goosec_config.js` yourself.

 * Service provider: GIV Inc. (https://www.giv.co.jp/)
 * Service site: https://www.goosec.site/
 * Terms of service: https://www.goosec.site/terms
 * Privacy policy: https://www.goosec.site/privacy

## Screenshots

[⌊Dashboard — how many external destinations were found, the risk breakdown, and
the state of front page tampering detection⌉⌊Dashboard — how many external destinations
were found, the risk breakdown, and the state of front page tampering detection⌉[

Dashboard — how many external destinations were found, the risk breakdown, and the
state of front page tampering detection

[⌊Destination list — domain, type, risk, the reason for that level, and the URL.
Newly appeared destinations are marked NEW⌉⌊Destination list — domain, type, risk,
the reason for that level, and the URL. Newly appeared destinations are marked NEW⌉[

Destination list — domain, type, risk, the reason for that level, and the URL. Newly
appeared destinations are marked NEW

[⌊Scan history — past scans in chronological order⌉⌊Scan history — past scans in
chronological order⌉[

Scan history — past scans in chronological order

[⌊Settings — pages to scan, HTTP Basic authentication, and front page tampering 
detection⌉⌊Settings — pages to scan, HTTP Basic authentication, and front page tampering
detection⌉[

Settings — pages to scan, HTTP Basic authentication, and front page tampering detection

[⌊Trusted domains — the 73 built-in entries can be reviewed in full on the settings
screen⌉⌊Trusted domains — the 73 built-in entries can be reviewed in full on the
settings screen⌉[

Trusted domains — the 73 built-in entries can be reviewed in full on the settings
screen

## Installation

 1. In your WordPress admin, go to Plugins > Add New and search for GOOSEC.
 2. Click Install Now.
 3. Click Activate.
 4. A GOOSEC entry is added to the admin menu.
 5. Open it and press “Scan now” to run the first scan.

## FAQ

### Is it free?

Yes. Everything listed under “What it does” is free, and none of it contacts a third-
party service.

### How is this different from a WAF or a file integrity monitor?

They protect different layers. A WAF detects and blocks attacks against your server,
such as SQL injection or XSS. A file integrity monitor detects changes to files 
on your server. This plugin lists the external destinations written into your pages
and tells you when they change. Use them together.

### Does it slow down my site?

No. The free scan runs in the background on the server, once a day, and does not
affect page rendering for visitors. If you enable the optional paid detection, a
script tag is added to every page.

### A domain is shown as high risk. What should I do?

First check whether it is a service you added yourself. If it is, add it to your
trusted list. If you do not recognise it, look into the script that loads it. The
level is decided from the shape of the domain alone, so **high does not by itself
mean the destination is malicious**.

### A domain is shown as low. Does that mean it is safe?

No. Low only means the domain is in the built-in trust list or in your own list.
The plugin does not inspect what is being sent. Treat the levels as an order in 
which to look, nothing more.

### Front page tampering is reported when I simply update my site.

Structural updates, such as adding a page or changing the design, are reported. 
Editing article text is not. After an intended change, press “Set the current state
as the new baseline” on the dashboard. The same state is never reported twice.

### Can it detect scripts that are loaded dynamically, for example through a tag manager?

Not with the free features. The plugin fetches your page’s HTML from the server,
and scripts that are added while the page runs in a browser do not appear in that
HTML. If you need those, consider the paid plan.

### Where is the collected information stored?

Destinations and scan history are stored **only in your own WordPress database**.
Nothing is sent anywhere else.

The HTTP Basic authentication password, and the read key used by the paid plan, 
are **stored encrypted** using a key derived from your wp-config.php salts, and 
are never printed on screen. Note that anyone who can read wp-config.php can decrypt
them; the purpose is to prevent them being read in plain text if the database contents
alone are exposed.

### If I delete the plugin, is the data removed?

Yes. Using Delete in WordPress removes the scan history tables, the settings and
the uploaded configuration file. **This cannot be undone.** Deactivating does not
remove anything, so use Deactivate if you only want to pause.

### Where is goosec_config.js stored?

In `wp-content/uploads/goosec/`. It does not appear in the Media Library, because
that list shows files registered as attachments and this file is not registered 
as one.

Before 1.4.3 the file was stored inside the plugin folder, so updating the plugin
could delete it. Updating to 1.4.3 or later moves an existing file to the new location
automatically.

## Reviews

There are no reviews for this plugin.

## Contributors & Developers

“GOOSEC” is open source software. The following people have contributed to this 
plugin.

Contributors

 *   [ goosec ](https://profiles.wordpress.org/goosec/)

[Translate “GOOSEC” into your language.](https://translate.wordpress.org/projects/wp-plugins/goosec)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/goosec/), check out
the [SVN repository](https://plugins.svn.wordpress.org/goosec/), or subscribe to
the [development log](https://plugins.trac.wordpress.org/log/goosec/) by [RSS](https://plugins.trac.wordpress.org/log/goosec/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.5.5

 * Rejects configuration files containing a closing script tag, since the configuration
   is now printed inline.
 * Skips the one-time migration lookup once it has run, so sites that do not use
   the paid features no longer check the filesystem on every page load.
 * No longer writes the uploaded configuration to the uploads directory. The configuration
   is stored in the database and printed with `wp_add_inline_script()`. Existing
   installations are migrated automatically and the old file is removed.
 * Moved the two remaining inline `<script>` blocks in the admin screens to separate
   files loaded with `wp_enqueue_script()`.
 * Documented the terms of service alongside the privacy policy in “External services”.

#### 1.5.3

 * Set distinct Plugin URI and Author URI in the plugin header

#### 1.5.2

 * Escaped the table names passed to direct database queries

#### 1.5.1

 * Rewrote the readme in English
 * Replaced forbidden and discouraged file functions with the WordPress filesystem
   API
 * Escaped badge output through wp_kses_post()
 * Documented the direct queries against the plugin’s own tables
 * Prefixed the variables used in uninstall.php

#### 1.5.0

 * Renamed the plugin to GOOSEC
 * Reworded on-screen and email text to match what the plugin actually does
 * Replaced forbidden and discouraged file functions with the WordPress filesystem
   API
 * Escaped badge output, and documented the direct database queries against the 
   plugin’s own tables

#### 1.4.9

 * Removed icons that were still present in email headings

#### 1.4.8

 * Reworded the dashboard subtitle to match what the plugin actually does
 * Fixed the action column in the destination list wrapping and breaking row heights

#### 1.4.7

 * Confirmed compatibility with WordPress 7.1

#### 1.4.6

 * Included the full GPLv2 licence text
 * Removed an unused Domain Path declaration
 * Corrected the readme tags (the plugin does not perform malware detection)

#### 1.4.5

 * Validated the format of the detection token and hardened its escaping when written
   to a page
 * HTTP Basic credentials are now sent only when the scan target is your own site
   (
   use the `goosec_basic_auth_hosts` filter if another host is required)
 * Scans now use `wp_safe_remote_get()`, so loopback and internal addresses cannot
   be targeted
 * Uploaded files are checked to confirm they are a GOOSEC configuration file

#### 1.4.4

 * The HTTP Basic password and the read key are now stored encrypted
    (existing 
   values are encrypted automatically on update)
 * The HTTP Basic password is no longer printed into the settings screen
 * Fixed passwords containing quotes or backslashes being stored incorrectly
 * SSL certificates are now verified when scanning
    (use the `goosec_scan_sslverify`
   filter if you must disable this, for example for self-signed certificates)

#### 1.4.3

 * Moved `goosec_config.js` to `wp-content/uploads/goosec/`
    (it was stored inside
   the plugin folder, so updating the plugin could delete it. An existing file is
   moved automatically on update)
 * The admin screen now tells you when the configuration file is missing
 * Scan history is now pruned by a daily job
    (previously it only happened when 
   the history screen was opened)
 * Deleting the plugin now removes its tables, settings and uploaded file

#### 1.4.2

 * Removed icons from screen titles and email headings
 * Fixed the notification email referring to a button name that no longer existed
   on screen

#### 1.4.1

 * Fixed column widths in the destination list
 * Fixed long URLs not using the available width, and the three-line clamp not applying

#### 1.4.0

 * Fixed front page tampering being reported every day for the same unchanged state
 * Front page tampering is no longer reported for article text edits
    (the plugin
   now compares tag structure, loaded resources and inline script contents, including
   the head)
 * The dashboard and the email now say what the baseline is and which button resets
   it
 * The reason column now says whether a domain is trusted by the built-in list or
   by your own list
 * The built-in trust list can be reviewed in full on the settings screen
 * With the paid plan enabled, the plugin no longer shows its own risk levels
    (
   detection results come from GOOSEC, so two different verdicts are never shown
   for one destination)
 * With the paid plan enabled, a link to the GOOSEC console is shown

#### 1.3.1

 * Fixed the detection type column wrapping mid-word
 * Fixed row heights breaking when a URL was long
 * The summary now says which numbers it is counting

#### 1.3.0

 * Detection names and priorities now follow the GOOSEC service

#### 1.2.0

 * Added front page tampering detection
 * Added email notifications

#### 1.1.0

 * Added scan history

#### 1.0.0

 * First release

## Meta

 *  Version **1.5.5**
 *  Last updated **15 hours ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 5.8 or higher **
 *  Tested up to **7.1**
 *  PHP version ** 7.4 or higher **
 * Tags
 * [ecommerce](https://wordpress.org/plugins/tags/ecommerce/)[monitoring](https://wordpress.org/plugins/tags/monitoring/)
   [privacy](https://wordpress.org/plugins/tags/privacy/)[security](https://wordpress.org/plugins/tags/security/)
 *  [Advanced View](https://wordpress.org/plugins/goosec/advanced/)

## Ratings

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/goosec/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/goosec/reviews/)

## Contributors

 *   [ goosec ](https://profiles.wordpress.org/goosec/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/goosec/)