BOROS Vigilon Client

BOROS Vigilon Client turns a WordPress installation into a monitored endpoint. It adds two
authenticated REST routes that return a structured JSON report about the server, the
WordPress installation and its current health. A monitoring server polls those routes; the
plugin itself never initiates outbound connections to a third party.

The plugin is passive by design. It stores no data of its own beyond its settings and a
cached Site Health report, and it answers only requests that carry a valid signature.

Reported data

• Server information: PHP version, web server, operating system, disk and memory usage, load average and uptime.
• WordPress information: core version and update status, installed plugins with version, slug and update status, active theme.
• Site Health: the results of the WordPress Site Health tests, collected by a twice-daily cron job and served from cache.
• Database: total size, per-table data, index and reclaimable bytes, row counts, plus cleanup candidates such as expired transients, autoloaded options, post revisions, trashed posts and spam comments.
• Error log: the ten most recent PHP error entries from debug.log, when the file is readable.
• Log files: the size and age of the log files the installation writes, in wp-content, in the plugin log directories below uploads, and at the configured WP_DEBUG_LOG and PHP error_log paths. Metadata only, no log content.
• Composer: whether the installation is Composer-managed, and the installed package versions.
• Realtime resource usage: a lightweight CPU, memory and load snapshot on a separate route.

Authentication

Requests are authenticated with an HMAC-SHA256 signature over timestamp:nonce:route,
sent in the X-Boros-Vigilon-Timestamp, X-Boros-Vigilon-Nonce and X-Boros-Vigilon-Signature
headers, or as Authorization: Bearer. A nonce may only be used once inside the signature
validity window, so captured requests cannot be replayed. A 64-character secret is
generated on activation.

Access can additionally be limited to a list of IP addresses, and the status route is rate
limited per endpoint and remote IP.

Privacy

The plugin transmits no data on its own. It answers requests from whoever holds the shared
secret, and the response may contain PHP error messages from debug.log, file paths and
server details. Review what your debug.log contains, restrict Allowed IPs to your
monitoring server, and treat the secret like a password.