IRONCREED Request Log offers two opt-in, clearly separated sources.<\/p>\n\n
This is intentionally a visibility-boundary diagnostic rather than a generic arbitrary-file log viewer. It keeps application-observed WordPress requests separate from provider-supplied nginx records, so operators can see what each layer can and cannot observe without a local-file reader, telemetry, or a general analytics stack.<\/p>\n\n
Both sources start disabled. Records use bounded retention and count limits. Sensitive query values are redacted. Runtime records omit IP addresses, User-Agent, Referer, bodies, cookies, and authorization data. Hosting Ukraine records may include IP addresses, URI identifiers, User-Agent, and Referer and must be covered by the site's privacy notice and lawful basis.<\/p>\n\n
The plugin has no telemetry, advertising, export, live tail, public endpoint, alternate updater, or local-file reader. It never sends fetched logs to IRONCREED or another service.<\/p>\n\n
Development source, tests, build tooling, and release documentation are maintained at IRONCREED\/SECURITY<\/a>.<\/p>\n\n The optional Hosting Ukraine integration calls Review the API method<\/a>, general API guide<\/a>, access-log documentation<\/a>, Terms of Service<\/a>, public offer<\/a>, and Privacy Policy<\/a> before connecting.<\/p>\n\n Administrators control enablement, access, retention, clearing, disconnect, and uninstall. Default retention is 24 hours with a 10,000-record cap; retention ranges from one hour to 30 days and the cap from 100 to 100,000. The plugin supplies suggested Privacy Policy Guide text. Site owners determine their lawful basis and privacy notice; the plugin does not promise legal compliance.<\/p>\n\n\n On Multisite, each site stores and displays its own records. Uninstall removes records, settings, credentials, all scheduled jobs, and capabilities from every site. Deactivation preserves data and credentials but cancels scheduled jobs until reactivation.<\/p>\n\n\n No. It records requests only after WordPress loads.<\/p><\/dd>\n It does not open arbitrary server files or present one source as complete. It records only requests WordPress actually sees and can optionally retrieve the hosting provider's current-day nginx archive through a read-only API. The two sources remain separate, with explicit visibility and privacy boundaries.<\/p><\/dd>\n No. The provider adapter downloads the current day's nginx log and remains read-only with respect to hosting configuration.<\/p><\/dd>\n On an explicit domain lookup, connection test or log fetch, and periodically after separate opt-in. Installing, activating, opening a screen or saving a manual connection does not contact the provider. A token entered for a test is used but not saved.<\/p><\/dd>\n WP-Cron needs site traffic or an operator-configured system scheduler. Low traffic, disabled cron or failed loopbacks can delay execution. The UI shows the last and next attempt. Errors back off; Retry-After is honored for rate-limited imports. Each download covers today's archive only.<\/p><\/dd>\n For a shared hosting virtual host, start with the main network site domain. Separately hosted mapped domains may need different IDs. IDs from the user header, hosting account or WordPress blog are different objects. Connections remain local to the configured site.<\/p><\/dd>\n The plugin does not register an exporter or eraser because records have no reliable WordPress-user identity and an email-keyed lookup cannot correctly identify all related URI, IP, User-Agent, or Referer values. Administrators can filter and clear records by source, and uninstall removes all plugin data.<\/p><\/dd>\n\n<\/dl>\n\n\nExternal services<\/h3>\n\n
https:\/\/adm.tools\/action\/hosting\/log\/web\/nginx\/<\/code> when an authorized administrator explicitly tests\/fetches or separately enables scheduled imports. The read-only site lookup calls https:\/\/adm.tools\/action\/get_services\/<\/code> with type=host<\/code> and the Bearer token. It receives the host services available to that token, matches the entered domain locally, and uses the matching service id<\/code> as host_id<\/code>; account_id<\/code> and virtual_domain_id<\/code> are not used as substitutes. The discovery list is not stored. Test\/import requests send the saved Bearer token in the Authorization header and the matched Hosting Ukraine host ID in the request body. The log response is a gzip nginx access-log archive that may contain timestamps, IP addresses, methods, URIs, statuses, response sizes, User-Agent values, and Referer values. Imported records are retained in the local WordPress database. Disconnect deletes credentials, cancels future scheduled imports, and leaves imported records until retention expiry or manual clearing.<\/p>\n\nPrivacy<\/h3>\n\n
\n
\n
Is WordPress Runtime a complete server access log?<\/h3><\/dt>\n
How is this different from a generic log viewer?<\/h3><\/dt>\n
Does Hosting Ukraine change my server?<\/h3><\/dt>\n
When does the plugin make network requests?<\/h3><\/dt>\n
Why is automatic import late?<\/h3><\/dt>\n
Which ID should Multisite use?<\/h3><\/dt>\n
Does the WordPress personal-data exporter identify records by email?<\/h3><\/dt>\n
1.0.0<\/h4>\n\n
\n