Skip to content
PluginCanary

The connector plugin

Connect a site in two minutes

PluginCanary Connector is a small WordPress plugin that tells us which plugins a site runs, so we can alert you when one of them turns risky. Prefer not to install anything? Paste a plugin list or upload a CSV instead.

Get a site key, freeComing soon to wordpress.org

Install

  1. Create a free account

    Sign up and add a site. We show you a site key once. Copy it.

  2. Install the connector

    Install PluginCanary Connector on the site, then activate it. It is coming soon to wordpress.org, where you will be able to install it from Plugins, Add New.

  3. Paste the site key

    Open the PluginCanary settings page in wp-admin, paste the key and save. The first sync runs right away.

  4. Done

    The site appears in your dashboard within a minute. Alerts start for every plugin it runs.

What it sends, and what it never sends

What it sends

  • Site URL, WordPress version and PHP version
  • Whether the site is a multisite
  • Plugin slugs and versions, with active and auto-update status
  • Whether a plugin update is available

What it never sends

  • Posts, pages or any other content
  • Users, customers or orders
  • Files, database contents or credentials

It reports when activated, whenever a plugin is installed, updated, activated, deactivated or deleted, and once a day. Data goes over HTTPS to plugincanary.com only. The site key is stored hashed on our side, and you can rotate it in the app at any time.

In wp-admin

One settings page: paste the site key, see the last sync status, press Sync now, and open the site in PluginCanary. Nothing else. No banners, no upsells, no front-end code.

Uninstall

  • Deactivating the connector stops all syncing. Nothing is sent after that.
  • Deleting the connector removes its stored site key and settings from the WordPress database.
  • In PluginCanary the site is marked stale after 72 hours without a sync. Remove it from the app to delete its plugin list from our side.