The plugin is now named GOOSEC. No action is required.<\/p>","1.4.5":"
Hardening changes. If you were scanning an internal address such as 127.0.0.1, that target can no longer be fetched.<\/p>","1.4.4":"
Stored credentials are encrypted automatically. SSL verification is enabled when scanning, so check your setup if you scan a site with a self-signed certificate.<\/p>","1.4.3":"
The configuration file moves to a new location automatically. No action is required.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3699859,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3699713,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3699713,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.5.5"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3699581,"resolution":"1","location":"assets","locale":"","width":1326,"height":896},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3699581,"resolution":"2","location":"assets","locale":"","width":1511,"height":794},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3699581,"resolution":"3","location":"assets","locale":"","width":1399,"height":868},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3699581,"resolution":"4","location":"assets","locale":"","width":1399,"height":868},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3699581,"resolution":"5","location":"assets","locale":"","width":1567,"height":609}},"screenshots":{"1":"Dashboard \u2014 how many external destinations were found, the risk breakdown, and the state of front page tampering detection","2":"Destination list \u2014 domain, type, risk, the reason for that level, and the URL. Newly appeared destinations are marked NEW","3":"Scan history \u2014 past scans in chronological order","4":"Settings \u2014 pages to scan, HTTP Basic authentication, and front page tampering detection","5":"Trusted domains \u2014 the 73 built-in entries can be reviewed in full on the settings screen"}},"plugin_section":[],"plugin_tags":[282,5603,396,600,281187],"plugin_category":[45,54],"plugin_contributors":[281188],"plugin_business_model":[],"class_list":["post-367249","plugin","type-plugin","status-publish","hentry","plugin_tags-ecommerce","plugin_tags-monitoring","plugin_tags-privacy","plugin_tags-security","plugin_tags-third-party-scripts","plugin_category-ecommerce","plugin_category-security-and-spam-protection","plugin_contributors-goosec","plugin_committers-goosec"],"banners":{"banner":"https:\/\/ps.w.org\/goosec\/assets\/banner-772x250.png?rev=3699713","banner_2x":"https:\/\/ps.w.org\/goosec\/assets\/banner-1544x500.png?rev=3699713","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/goosec\/assets\/icon-128x128.png?rev=3699859","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/goosec\/assets\/screenshot-1.png?rev=3699581","caption":"Dashboard \u2014 how many external destinations were found, the risk breakdown, and the state of front page tampering detection"},{"src":"https:\/\/ps.w.org\/goosec\/assets\/screenshot-2.png?rev=3699581","caption":"Destination list \u2014 domain, type, risk, the reason for that level, and the URL. Newly appeared destinations are marked NEW"},{"src":"https:\/\/ps.w.org\/goosec\/assets\/screenshot-3.png?rev=3699581","caption":"Scan history \u2014 past scans in chronological order"},{"src":"https:\/\/ps.w.org\/goosec\/assets\/screenshot-4.png?rev=3699581","caption":"Settings \u2014 pages to scan, HTTP Basic authentication, and front page tampering detection"},{"src":"https:\/\/ps.w.org\/goosec\/assets\/screenshot-5.png?rev=3699581","caption":"Trusted domains \u2014 the 73 built-in entries can be reviewed in full on the settings screen"}],"raw_content":"\n
GOOSEC<\/strong> collects the external resources (script, link, iframe, img) that your pages load, and lists them in one place. It tells you when a new destination appears, and when the structure of your front page changes.<\/p>\n\n Tag managers, ads, analytics, payment services \u2014 most sites load scripts that the site owner never explicitly reviewed. Knowing what is actually loaded today is the starting point.<\/p>\n\n High, unverified and low are a hint about what to look at first, not a verdict about safety<\/strong>. They are decided from the shape of the domain and from whether it appears in a trust list. The plugin does not inspect the content of any request. A destination shown as low is not guaranteed to be safe.<\/p>\n\n The 73 built-in entries can be reviewed in full on the settings screen. You cannot edit that list, but you can add your own domains, and the reason column tells you which list a domain matched.<\/p>\n\n The plugin fetches the HTML of your pages from the server and parses it. Requests that only appear while a visitor's browser is running the page \u2014 for example scripts injected through a tag manager \u2014 are not visible this way.<\/strong> If you need those, see the optional paid service below.<\/p>\n\n Everything described above works on its own and contacts no third-party service.<\/p>\n\n If you subscribe to GOOSEC Lite, you can upload the configuration file we issue, and the plugin will show detections made in your visitors' browsers. This is entirely optional. No request leaves your site until you upload that file.<\/strong> The destinations and the data involved are listed under \"External services\" below.<\/p>\n\n See https:\/\/www.goosec.site\/ for details.<\/p>\n\n With the free features only, this plugin does not connect to any third-party service.<\/strong> Everything it collects is stored in your own WordPress database. It does fetch your own pages over HTTP in order to scan them.<\/p>\n\n Note for reviewers: If you subscribe to GOOSEC Lite and upload 1. GOOSEC API (api.goosec.jp) \u2014 retrieving detections<\/strong><\/p>\n\n 2. GOOSEC detection script (your own subdomain of goosec.jp, and assets.goosec.jp)<\/strong><\/p>\n\n All of the above services are operated by GIV Inc., the author of this plugin. A paid subscription is required; no data is sent unless you subscribe and upload Yes. Everything listed under \"What it does\" is free, and none of it contacts a third-party service.<\/p><\/dd>\n They protect different layers. A WAF detects and blocks attacks against your server, such as SQL injection or XSS. A file integrity monitor detects changes to files on your server. This plugin lists the external destinations written into your pages and tells you when they change. Use them together.<\/p><\/dd>\n No. The free scan runs in the background on the server, once a day, and does not affect page rendering for visitors. If you enable the optional paid detection, a script tag is added to every page.<\/p><\/dd>\n First check whether it is a service you added yourself. If it is, add it to your trusted list. If you do not recognise it, look into the script that loads it. The level is decided from the shape of the domain alone, so high does not by itself mean the destination is malicious<\/strong>.<\/p><\/dd>\n No. Low only means the domain is in the built-in trust list or in your own list. The plugin does not inspect what is being sent. Treat the levels as an order in which to look, nothing more.<\/p><\/dd>\n Structural updates, such as adding a page or changing the design, are reported. Editing article text is not. After an intended change, press \"Set the current state as the new baseline\" on the dashboard. The same state is never reported twice.<\/p><\/dd>\n Not with the free features. The plugin fetches your page's HTML from the server, and scripts that are added while the page runs in a browser do not appear in that HTML. If you need those, consider the paid plan.<\/p><\/dd>\n Destinations and scan history are stored only in your own WordPress database<\/strong>. Nothing is sent anywhere else.<\/p>\n\n The HTTP Basic authentication password, and the read key used by the paid plan, are stored encrypted<\/strong> using a key derived from your wp-config.php salts, and are never printed on screen. Note that anyone who can read wp-config.php can decrypt them; the purpose is to prevent them being read in plain text if the database contents alone are exposed.<\/p><\/dd>\n Yes. Using Delete in WordPress removes the scan history tables, the settings and the uploaded configuration file. This cannot be undone.<\/strong> Deactivating does not remove anything, so use Deactivate if you only want to pause.<\/p><\/dd>\n In Before 1.4.3 the file was stored inside the plugin folder, so updating the plugin could delete it. Updating to 1.4.3 or later moves an existing file to the new location automatically.<\/p><\/dd>\n\n<\/dl>\n\n\nWhat it does<\/h4>\n\n
\n
script<\/code>, link<\/code>, iframe<\/code> and img<\/code> sources from the HTML of your pages. You can scan several pages, and sites behind HTTP Basic authentication are supported.<\/li>\nAbout the risk levels<\/h4>\n\n
What it cannot see<\/h4>\n\n
Optional paid service<\/h4>\n\n
External services<\/h3>\n\n
includes\/class-risk.php<\/code> contains a static list of domain names (Google, CDNs, payment providers and so on). It is a classification allow-list compared as plain strings against URLs found while scanning the site owner's own pages. The plugin never connects to, enqueues or loads anything from those domains.<\/p>\n\ngoosec_config.js<\/code> from the settings screen, the plugin connects to the following services.<\/p>\n\n\n
\n
goosec_config.js<\/code> yourself.<\/p>\n\n\n
\n
\n
Is it free?<\/h3><\/dt>\n
How is this different from a WAF or a file integrity monitor?<\/h3><\/dt>\n
Does it slow down my site?<\/h3><\/dt>\n
A domain is shown as high risk. What should I do?<\/h3><\/dt>\n
A domain is shown as low. Does that mean it is safe?<\/h3><\/dt>\n
Front page tampering is reported when I simply update my site.<\/h3><\/dt>\n
Can it detect scripts that are loaded dynamically, for example through a tag manager?<\/h3><\/dt>\n
Where is the collected information stored?<\/h3><\/dt>\n
If I delete the plugin, is the data removed?<\/h3><\/dt>\n
Where is goosec_config.js stored?<\/h3><\/dt>\n
wp-content\/uploads\/goosec\/<\/code>. It does not appear in the Media Library, because that list shows files registered as attachments and this file is not registered as one.<\/p>\n\n1.5.5<\/h4>\n\n
\n
wp_add_inline_script()<\/code>. Existing installations are migrated automatically and the old file is removed.<\/li>\n<script><\/code> blocks in the admin screens to separate files loaded with wp_enqueue_script()<\/code>.<\/li>\n1.5.3<\/h4>\n\n
\n
1.5.2<\/h4>\n\n
\n
1.5.1<\/h4>\n\n
\n
1.5.0<\/h4>\n\n
\n
1.4.9<\/h4>\n\n
\n
1.4.8<\/h4>\n\n
\n
1.4.7<\/h4>\n\n
\n
1.4.6<\/h4>\n\n
\n
1.4.5<\/h4>\n\n
\n
goosec_basic_auth_hosts<\/code> filter if another host is required)<\/li>\nwp_safe_remote_get()<\/code>, so loopback and internal addresses cannot be targeted<\/li>\n1.4.4<\/h4>\n\n
\n
goosec_scan_sslverify<\/code> filter if you must disable this, for example for self-signed certificates)<\/li>\n<\/ul>\n\n1.4.3<\/h4>\n\n
\n
goosec_config.js<\/code> to wp-content\/uploads\/goosec\/<\/code>\n(it was stored inside the plugin folder, so updating the plugin could delete it.\nAn existing file is moved automatically on update)<\/li>\n1.4.2<\/h4>\n\n
\n
1.4.1<\/h4>\n\n
\n
1.4.0<\/h4>\n\n
\n
1.3.1<\/h4>\n\n
\n
1.3.0<\/h4>\n\n
\n
1.2.0<\/h4>\n\n
\n
1.1.0<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n