{"id":362145,"date":"2026-09-01T07:51:47","date_gmt":"2026-09-01T07:51:47","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/boros-watchtower-client\/"},"modified":"2026-09-03T10:32:42","modified_gmt":"2026-09-03T10:32:42","slug":"boros-vigilon-client","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/boros-vigilon-client\/","author":23558633,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.7.0","stable_tag":"1.7.0","tested":"7.1","requires":"5.9","requires_php":"8.0","requires_plugins":null,"header_name":"BOROS Vigilon Client","header_author":"BOROS GmbH","header_description":"Client plugin for the BOROS Vigilon monitoring service. Exposes system and instance information as JSON via a REST API endpoint.","assets_banners_color":"1f3255","last_updated":"2026-09-03 10:32:42","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/wordpress.org\/plugins\/boros-vigilon-client\/","header_author_uri":"https:\/\/www.boros.de","rating":0,"author_block_rating":0,"active_installs":0,"downloads":67,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.6.2":{"tag":"1.6.2","author":"crocus99","date":"2026-09-01 07:51:37","revision":3675583},"1.7.0":{"tag":"1.7.0","author":"crocus99","date":"2026-09-03 10:32:42","revision":3679564}},"upgrade_notice":{"1.6.0":"

REST routes moved to \/wp-json\/boros-vigilon\/v1\/<\/code> and the HMAC headers are now\n X-Boros-Vigilon-*; reconfigure your monitoring server first. WordPress sees the\nrename as a separate plugin: deactivate the old one, install this and activate it.\nSecret and settings carry over.<\/p>","1.5.0":"

The plugin directory changed, so WordPress sees this as a separate plugin. Deactivate the\nold one, install this one and activate it. Your secret and settings are kept.<\/p>","1.3.0":"

Recent debug.log<\/code> entries are now always included in the status payload. Review what your\ndebug log contains before updating.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3676889,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3676889,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.jpg":{"filename":"banner-1544x500.jpg","revision":3676889,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.jpg":{"filename":"banner-772x250.jpg","revision":3676889,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.6.2","1.7.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[5603,23853,55682,151481,29148],"plugin_category":[54],"plugin_contributors":[278615],"plugin_business_model":[],"class_list":["post-362145","plugin","type-plugin","status-publish","hentry","plugin_tags-monitoring","plugin_tags-rest-api","plugin_tags-server-status","plugin_tags-site-health","plugin_tags-uptime","plugin_category-security-and-spam-protection","plugin_contributors-crocus99","plugin_committers-crocus99"],"banners":{"banner":"https:\/\/ps.w.org\/boros-vigilon-client\/assets\/banner-772x250.jpg?rev=3676889","banner_2x":"https:\/\/ps.w.org\/boros-vigilon-client\/assets\/banner-1544x500.jpg?rev=3676889","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/boros-vigilon-client\/assets\/icon-128x128.png?rev=3676889","icon_2x":"https:\/\/ps.w.org\/boros-vigilon-client\/assets\/icon-256x256.png?rev=3676889","generated":false},"screenshots":[],"raw_content":"\n

BOROS Vigilon Client turns a WordPress installation into a monitored endpoint. It adds two\nauthenticated REST routes that return a structured JSON report about the server, the\nWordPress installation and its current health. A monitoring server polls those routes; the\nplugin itself never initiates outbound connections to a third party.<\/p>\n\n

The plugin is passive by design. It stores no data of its own beyond its settings and a\ncached Site Health report, and it answers only requests that carry a valid signature.<\/p>\n\n

Reported data<\/h4>\n\n
    \n
  • Server information: PHP version, web server, operating system, disk and memory usage, load average and uptime.<\/li>\n
  • WordPress information: core version and update status, installed plugins with version, slug and update status, active theme.<\/li>\n
  • Site Health: the results of the WordPress Site Health tests, collected by a twice-daily cron job and served from cache.<\/li>\n
  • Database: total size, per-table data, index and reclaimable bytes, row counts, plus cleanup candidates such as expired transients, autoloaded options, post revisions, trashed posts and spam comments.<\/li>\n
  • Error log: the ten most recent PHP error entries from debug.log<\/code>, when the file is readable.<\/li>\n
  • Log files: the size and age of the log files the installation writes, in wp-content<\/code>, in the plugin log directories below uploads<\/code>, and at the configured WP_DEBUG_LOG<\/code> and PHP error_log<\/code> paths. Metadata only, no log content.<\/li>\n
  • Composer: whether the installation is Composer-managed, and the installed package versions.<\/li>\n
  • Realtime resource usage: a lightweight CPU, memory and load snapshot on a separate route.<\/li>\n<\/ul>\n\n

    Authentication<\/h4>\n\n

    Requests are authenticated with an HMAC-SHA256 signature over timestamp:nonce:route<\/code>,\nsent in the X-Boros-Vigilon-Timestamp<\/code>, X-Boros-Vigilon-Nonce<\/code> and X-Boros-Vigilon-Signature<\/code>\nheaders, or as Authorization: Bearer<\/code>. A nonce may only be used once inside the signature\nvalidity window, so captured requests cannot be replayed. A 64-character secret is\ngenerated on activation.<\/p>\n\n

    Access can additionally be limited to a list of IP addresses, and the status route is rate\nlimited per endpoint and remote IP.<\/p>\n\n

    Privacy<\/h4>\n\n

    The plugin transmits no data on its own. It answers requests from whoever holds the shared\nsecret, and the response may contain PHP error messages from debug.log<\/code>, file paths and\nserver details. Review what your debug.log<\/code> contains, restrict Allowed IPs<\/code> to your\nmonitoring server, and treat the secret like a password.<\/p>\n\n\n

      \n
    1. Install and activate the plugin.<\/li>\n
    2. Open Settings > BOROS Vigilon Client<\/strong>. A 64-character API secret is generated on activation.<\/li>\n
    3. Set Allowed IPs<\/strong> to the address of your monitoring server. The default *<\/code> allows every address.<\/li>\n
    4. Copy the secret and the endpoint URLs into your monitoring server.<\/li>\n<\/ol>\n\n

      The endpoints are:<\/p>\n\n

        \n
      • \/wp-json\/boros-vigilon\/v1\/status<\/code><\/li>\n
      • \/wp-json\/boros-vigilon\/v1\/realtime<\/code><\/li>\n<\/ul>\n\n\n
        \n

        Does the plugin send data anywhere by itself?<\/h3><\/dt>\n

        No. It only responds to authenticated incoming requests. The one outbound request it makes\nis a loopback request to your own site, which is part of the WordPress Site Health tests.<\/p><\/dd>\n

        Can I use it without the BOROS Vigilon monitoring server?<\/h3><\/dt>\n

        Yes. The routes return plain JSON and can be consumed by any client that can compute the\nHMAC signature, for example a cron script, Zabbix, Icinga or a custom dashboard.<\/p><\/dd>\n

        Why is my request rejected with a 403?<\/h3><\/dt>\n

        Either the signature is wrong, the timestamp is outside the validity window, the nonce was\nreused, or the calling IP is not in the allowlist. Enable Enable Debug Output<\/strong> in the\nsettings temporarily to see the reason, and disable it again afterwards.<\/p><\/dd>\n

        Does the Site Health data slow down my requests?<\/h3><\/dt>\n

        No. Site Health tests run in a twice-daily cron job and the status route serves the cached\nresult.<\/p><\/dd>\n\n<\/dl>\n\n\n

        1.7.0<\/h4>\n\n
          \n
        • Added: a logFiles<\/code> section reporting the size and modification time of the log files the installation writes, so a log growing without bound is visible before it fills the disk. Only file metadata is read, no log content.<\/li>\n
        • Changed: payload schemaVersion<\/code> raised to 1.5.<\/li>\n<\/ul>\n\n

          1.6.2<\/h4>\n\n
            \n
          • Changed: the readme no longer lists a screenshot. The image is added in a later release.<\/li>\n<\/ul>\n\n

            1.6.1<\/h4>\n\n
              \n
            • Changed: the debug log is read through SplFileObject, and the leftover pre-1.2.0 rate limit directory is removed through WP_Filesystem. No change to what either one reports or deletes.<\/li>\n
            • Changed: the uninstall handler and the admin bootstrap no longer leave variables in the global scope.<\/li>\n
            • Changed: the options cleanup query is built from literals instead of assembled from variables. The SQL it produces is unchanged.<\/li>\n<\/ul>\n\n

              1.6.0<\/h4>\n\n
                \n
              • Changed: the plugin is now BOROS Vigilon Client. The slug, text domain, option keys, filter names, REST namespace and HMAC header names all changed with it, so a monitoring server has to be reconfigured before upgrading.<\/li>\n
              • Security: the rate limiter and the nonce replay check no longer read a transient and write it back in a second step. Each is a single atomic statement now, so concurrent requests can neither exceed the configured limit nor replay the same captured request twice.<\/li>\n
              • Security: two provider files were missing the guard that aborts when a file is loaded outside WordPress.<\/li>\n
              • Added: settings, the cached Site Health report and the cron schedule are carried over from the old names on the first request after the upgrade.<\/li>\n
              • Changed: the rate limit window is capped at 24 hours.<\/li>\n<\/ul>\n\n

                1.5.0<\/h4>\n\n
                  \n
                • Changed: the plugin directory and text domain were renamed, because WordPress.org rejects plugin names that begin with \"WP\".<\/li>\n<\/ul>\n\n

                  1.4.1<\/h4>\n\n
                    \n
                  • Security: every file under includes\/<\/code> now aborts when loaded outside WordPress.<\/li>\n
                  • Added: readme.txt<\/code> and LICENSE.txt<\/code> with the full GPL-2.0 text.<\/li>\n
                  • Changed: text domain renamed to match the plugin slug.<\/li>\n
                  • Changed: admin settings strings are translatable.<\/li>\n<\/ul>\n\n

                    1.4.0<\/h4>\n\n
                      \n
                    • Added: a databaseSize<\/code> section with total database size and per-table data, index and reclaimable bytes plus row counts.<\/li>\n
                    • Added: tables are classified as cache, log, history, session, index, content or other, and disposable ones are flagged as cleanup candidates.<\/li>\n
                    • Added: a cleanup<\/code> section reporting expired transients, autoloaded options and their size, post revisions, trashed and auto-draft posts, spam and trashed comments.<\/li>\n
                    • Changed: payload schemaVersion<\/code> raised to 1.4.<\/li>\n<\/ul>\n\n

                      1.3.0<\/h4>\n\n
                        \n
                      • Removed: the enableErrorLogProvider<\/code> setting. Recent debug.log<\/code> entries are now always part of the status payload.<\/li>\n
                      • Fixed: the realtime endpoint is no longer rate limited, so a five-minute polling interval is no longer throttled.<\/li>\n
                      • Added: each plugin entry carries an explicit slug<\/code> field.<\/li>\n<\/ul>\n\n

                        1.2.0<\/h4>\n\n
                          \n
                        • Security: nonce replay protection inside the signature validity window.<\/li>\n
                        • Security: support for passing the signature via the Authorization: Bearer<\/code> header.<\/li>\n
                        • Security: the deprecated ?secret=...<\/code> query authentication is opt-in and disabled by default.<\/li>\n
                        • Security: minimum secret length raised from 5 to 32 characters.<\/li>\n
                        • Security: uninstalling removes options, scheduled events, transients and rate limiter state.<\/li>\n
                        • Changed: the rate limiter is a sliding window scoped per endpoint and remote IP.<\/li>\n
                        • Fixed: php_version<\/code> and plugin_version<\/code> are no longer skipped during Site Health collection.<\/li>\n<\/ul>\n\n

                          1.1.1<\/h4>\n\n
                            \n
                          • Fixed: Site Health test callables are resolved correctly, and theme_version<\/code> and plugin_theme_auto_updates<\/code> are retained.<\/li>\n
                          • Fixed: wp-config.php<\/code> path and loopback request URL detection.<\/li>\n<\/ul>\n\n

                            1.1.0<\/h4>\n\n
                              \n
                            • Added: Site Health metrics are collected by a twice-daily cron job and served from a cache.<\/li>\n<\/ul>\n\n

                              1.0.2<\/h4>\n\n
                                \n
                              • Added: HMAC signature verification.<\/li>\n
                              • Added: update status fields for the core and plugin providers.<\/li>\n<\/ul>\n\n

                                1.0.1<\/h4>\n\n
                                  \n
                                • Maintenance release; no functional changes.<\/li>\n<\/ul>\n\n

                                  1.0.0<\/h4>\n\n
                                    \n
                                  • Initial release.<\/li>\n<\/ul>","raw_excerpt":"Exposes server, WordPress and Site Health information as authenticated JSON, so a central monitoring server can watch many installations.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/362145","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=362145"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/crocus99"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=362145"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=362145"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=362145"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=362145"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=362145"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=362145"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}