Karetaker
| 开发者 | krikir |
|---|---|
| 更新时间 | 2026年9月20日 05:39 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Scripts: new external JavaScript domains after a local baseline (home, and cart/checkout when WooCommerce is active)
- Search engine cloaking: once a day, compares your home page as a visitor and as Googlebot, and flags hidden spam links
- Integrity: core and plugin file changes, checked against published WordPress.org checksums
- Options: changes to the settings that matter, plus curated suspicious option names and unusual new autoload names
- Privileges: role and capability changes, new administrators, user promotions
- Uploads: files appearing in
wp-content/uploadsthat do not belong there - Cron drift: scheduled tasks that vanish, stall, or appear from nowhere
- Plugin risk: closed or abandoned plugins on WordPress.org, and plugins whose listed owner changed
- Optional vulnerability lookup: when you enable it, active plugin versions are checked against public WPVulnerability data (off by default)
- Search engine visibility switched off
- Site email failing to send
- No administrators left on the site
- Invalid or unreachable admin email
- Visibility is pull: the Karetaker admin screen and WP-CLI
- Notification is push: email to the site owner, on ACT-severity events only
- Optional Slack / Telegram / Discord / Microsoft Teams: webhooks or Bot API, off until you turn them on
- Optional weekly summary: one short email on Monday mornings, off until you turn it on
- Pause alerts for an hour while you work on the site; one catch-up email afterwards if something needed you
- Your data, your file: download the activity log as CSV at any time
- Hardening is off until each toggle is switched on
- Site owners who want to know their site is fine without reading a dashboard every morning
- Freelancers and agencies handing a site over to a client, who still need to know if something breaks later
- A WAF or request firewall
- A malware signature scanner
- A login lockout or hide-login product by default
- A writer of
wp-config.php,.htaccess, or server config
KARETAKER_DISABLE as true in wp-config.php, or place an empty file at
wp-content/karetaker-disable. The plugin then boots nothing. Uninstall removes the
plugin's table, options, and scheduled hooks.
Open source
Karetaker is GPL, built by Team Krikir. It does not phone
home, load third-party scripts, or show ads. Issues and pull requests are welcome.
Credits
Karetaker ships no third-party code, fonts or images. It relies on these projects and services,
and thanks them:
- WordPress and the WordPress.org APIs for core and plugin checksums, plugin directory information, and security keys
- WPVulnerability for the optional public vulnerability database (vulnerability details shown in Karetaker come from WPVulnerability and the sources it links to)
- Simple Icons for the destination logos shown in Settings (CC0 1.0)
- Slack incoming webhooks, the Telegram Bot API, Discord webhooks and Microsoft Teams workflows for the optional alert channels
- PHP_CodeSniffer, WordPress Coding Standards and PHPCompatibilityWP, used during development only
安装:
- Upload the
karetakerfolder to/wp-content/plugins/, or install the zip via Plugins → Add New → Upload. - Activate through the Plugins screen.
- Open Karetaker in the admin sidebar. The one-minute setup asks where alerts go and what kind of site this is, runs a first check, and offers three safe protections.
屏幕截图:
常见问题:
Is this a firewall?
No. Karetaker watches and alerts. It does not filter HTTP traffic.
Will it lock me out of wp-login?
Not by default. There is no login lockout or renamed login URL in the default set. Hardening toggles are opt-in and reversible from Karetaker → Protection.
How do I stop it immediately?
Define KARETAKER_DISABLE as true in wp-config.php, or create
wp-content/karetaker-disable. The plugin then boots nothing.
What happened to Advanced mode?
Agency tools (issue tracking with owners, incident cases, client reports, role access and the read-only API) are no longer part of Karetaker. Everything that watches your site, alerts you and protects it stays here and stays free: every check, every alert channel, the weekly summary, all protections and the activity export.
Does uninstall leave data behind?
No. Uninstall drops the events table, plugin options, and cron hooks.
What if I think the site was hacked?
Run wp karetaker incident. That runs a deeper multi-pass scan and shows a checklist
(admins, plugins, uploads PHP, integrity, Guard, passwords). If you think someone else is
logged in, use Karetaker → Protection → "Sign out all administrators". Karetaker does not
clean malware or lock anyone out; it is a guided review, not a clean certificate.
Can hosting providers use this?
Yes. Karetaker does not ship a WAF, does not lock logins by default, and does not write
server config. wp karetaker status prints the host safety profile as JSON, and Site
Health reports scan freshness, Guard flags, and the same profile. Kill switch: KARETAKER_DISABLE or wp-content/karetaker-disable.
What data leaves the site?
By default, only integrity checks contact WordPress.org to fetch published core/plugin checksums (same family of APIs WordPress itself uses). Optional features you turn on yourself may also leave the site: ACT alert emails (to the address you choose), an ACT webhook POST (to the URL you set), Slack Incoming Webhooks, Telegram Bot API, Discord and Microsoft Teams webhook messages (when enabled), the weekly summary and end-of-pause emails (when enabled), and vulnerability lookup requests to wpvulnerability.net (plugin slug only, when enabled under Settings). The daily "What Google sees" check requests your own home page twice (once with a Googlebot user agent); it does not contact Google. Karetaker does not phone home to Team Krikir and does not load third-party scripts or ads. When you enable those optional services, you also accept their terms:
- Slack: https://slack.com/terms-of-service and https://slack.com/privacy-policy
- Telegram: https://telegram.org/tos/bot-developers and https://telegram.org/privacy
- Discord: https://discord.com/terms and https://discord.com/privacy
- Microsoft Teams: https://www.microsoft.com/servicesagreement and https://privacy.microsoft.com/privacystatement
- WPVulnerability: https://www.wpvulnerability.com/ (public vulnerability database API)
更新日志:
- An .htaccess or .user.ini under uploads whose rules only restrict, like the one plugins write to protect their own upload folders, is no longer reported as a problem.
- Fixed a repeating alert: marking a changed uploads config as expected did not update the baseline, so the same file was reported again on the next scan.
- A scan that ran out of time no longer replaces the baseline with the part of the folder it reached, which made untouched files look new.
- A file rewritten with the same contents is no longer treated as a change.
- Config files under uploads are no longer reported a second time as executable code.
- The setup screen now sits in the middle of the page.
- Developer: filters for the navigation label and the footer version text, so add-ons can name their screens.
- Advanced mode is gone. Agency tools (issue tracking with owners, detailed monitoring, incident cases, client reports, role access and the read-only API) are no longer part of Karetaker.
- Settings now holds the vulnerability lookup switch, how many events to keep, trusted proxies, a test alert button and email previews.
- Protection has "Sign out all administrators" for when you think someone else is logged in.
- Activity has a Download CSV button.
- Developer: new filters karetaker_settings_defaults and karetaker_admin_setting.
- Developer: an extension API (actions, filters and a JavaScript bridge) so add-ons can extend Karetaker without editing it.
- Tidier stylesheet comments.
- New email design for alerts, the weekly summary, the pause summary and test emails, matching the admin screens.
- Clearer subjects that lead with the status and name the site, for example "Act now: A must-use plugin file changed · example.com".
- Every email now has a readable plain-text version and a readable technical details table instead of raw data.
- The logo no longer breaks in email clients or when SMTP plugins are active.
- Summaries group repeated events into one line with a count.
- Preview any email from Advanced mode → Incidents → Alert routing.
- Sixty-second setup: where to send alerts, what kind of site this is, a first check, and three safe protections.
- Home: plain-language status, a to-do card for anything that needs you, and the twelve checks Karetaker runs.
- Watches: critical files, WordPress core and plugin files against official checksums, administrators (including accounts hidden from the Users screen), plugin risk signals from WordPress.org, must-use plugins, the uploads folder, scheduled tasks, option names, external script domains, what search engines see, failed logins, search visibility and email delivery.
- Activity: everything Karetaker recorded, kept in your own database.
- Protection: seven optional protections that cannot lock you out. Karetaker never edits wp-config.php or .htaccess.
- Alerts by email, and optionally Telegram, Slack, Discord, Microsoft Teams or your own webhook, with a weekly summary and a one-hour pause while you work.
- Advanced mode for agencies and developers: issue tracking with owners, detailed monitoring, incident cases with a response checklist, client reports, CSV/JSON/ZIP exports, role permissions and read-only API tokens.
- WP-CLI commands and an emergency off switch.