AiutoComputerHelp Live Request Monitor is a live, administrator-only WordPress\/PHP request diagnostic tool. It observes request metadata without blocking traffic or creating a permanent access log.<\/p>\n\n
Monitoring starts only when an authorized administrator enables it. Events use short-lived WordPress transients, which may persist in the database until cleanup; IP exclusion rules are persistent. Redaction is best effort and exported metadata may contain personal data. Security indicators are heuristics, not attack verdicts. Consult Tools > Live Request Monitor Help for operating instructions, privacy information, and limitations.<\/p>\n\n
The browser-executed file is For this review revision, For maintenance, edit the readable source, then update the deployed In version 1.0.0, the IP Exclusions, Search and filters, Display settings, Export events and Capture diagnostics panels start collapsed. Click a heading to expand it. Search has an active-filter indicator; filters continue to affect the displayed table and exports even while the panel is closed. See the built-in Tools > Live Request Monitor Help for the full US English manual.<\/p><\/dd>\n No plugin-maintained historical event log is created. Requests are buffered in short-lived WordPress transients; depending on the hosting configuration, transients may use the database and expired records may remain until cleanup. A temporary, optional APCu recovery queue is best effort. IP\/CIDR exclusion settings, unlike captured events, persist until deleted or uninstall.<\/p><\/dd>\n It excludes raw request bodies and Cookie\/Authorization headers and applies bounded, best-effort redaction to selected request metadata. No external event service or telemetry is used. Redaction is not guaranteed to remove all personal data. Administrators must protect any CSV\/JSON files they download.<\/p><\/dd>\n Masked is the default browser display mode; Hidden and Full are also available to administrators. Full connection IP can remain temporarily in the active session buffer for correlation, regardless of the display mode. Proxy-declared addresses are treated as unverified. Administrators can exclude up to 256 IPv4\/IPv6 addresses or CIDR networks based on REMOTE_ADDR. Exclusion skips capture, not site access, and does not erase previously captured events.<\/p><\/dd>\n REVIEW, GET SIGNAL, Possible scanner, SCAN CONTEXT, and CHAIN are diagnostic heuristics, not attack verdicts. Standard WordPress login, Application Password, and XML-RPC authentication outcomes are reported only when supported native WordPress hooks fire. A generic HTTP 200, 302, 401, or 405 does not establish authentication success or a blocked attack.<\/p><\/dd>\n The sanitized URI preview keeps the order of inspected GET name\/value pairs, including duplicate names, subject to fixed inspection limits. No. Requests rejected by a CDN, reverse proxy, or web server before WordPress\/PHP are not visible. Buffer limits, concurrent execution, unavailable APCu, and polling interruptions may also cause gaps. Capture Diagnostics exposes aggregate best-effort indicators but cannot prove lossless capture.<\/p><\/dd>\n Pin keeps a row visible in the current browser view. CHAIN is an interactive correlation of related events. SCAN CONTEXT is a weaker, automatic association of ordinary requests near identified probe bursts, using connection IP plus User-Agent when available. Shared connections or matching User-Agents can cause false associations.<\/p><\/dd>\n Not necessarily. Applicable law depends on the specific purpose, legal basis, jurisdiction, and controller's obligations. IP masking is not guaranteed anonymization. Site administrators remain responsible for transparency, access restrictions, retention, proportionality, and applicable privacy law, including GDPR where relevant. The built-in Help provides additional operational and legal notes; it is not legal advice.<\/p><\/dd>\n\n<\/dl>\n\n\nassets\/monitor.js<\/code>. Its human-readable, non-minified equivalent is included in this same plugin package as assets\/monitor.source.js<\/code>, without requiring a separate repository or download. The readable file contains the complete JavaScript program, including the original identifiers and comments. It is not loaded by WordPress at runtime.<\/p>\n\nassets\/monitor.js<\/code> was deliberately retained byte-for-byte from the submitted release candidate. The readable file was produced through syntax-aware formatting, and its parsed JavaScript abstract syntax tree was checked for equality with the deployed file. No external JavaScript libraries are bundled and no transpilation or module bundling is required to run the plugin.<\/p>\n\nassets\/monitor.js<\/code> using a JavaScript formatter\/minifier without obfuscating identifiers, and test both files for syntax and behavioral equivalence before packaging. This release has no mandatory JavaScript build dependencies. Both source and runtime files are distributed under GPLv2 or later.<\/p>\n\n\n\n
\/wp-content\/plugins\/<\/code>.<\/li>\n\n
Where are search, thresholds, exports and diagnostics?<\/h3><\/dt>\n
Does this plugin store a permanent request log?<\/h3><\/dt>\n
Does the monitor collect passwords or transmit events to other services?<\/h3><\/dt>\n
How do IP visibility and exclusions work?<\/h3><\/dt>\n
Can the plugin tell whether an attack or login succeeded?<\/h3><\/dt>\n
What does GET Fidelity preserve?<\/h3><\/dt>\n
query_fidelity<\/code> supplies counters, truncation flags, and fixed indicator labels for possible XSS, SQLi, traversal, and related patterns. PHP's normalized GET field can still collapse duplicate names. The result is not a byte-for-byte forensic copy.<\/p><\/dd>\nCan the monitor see every request or guarantee complete capture?<\/h3><\/dt>\n
How do Pin, CHAIN, and SCAN CONTEXT differ?<\/h3><\/dt>\n
Does enabling Full IP mode automatically require consent?<\/h3><\/dt>\n
1.0.0<\/h4>\n\n
\n