Security status across sites
recipe__security_statusSecurity posture for every connected site running GuardPress, Wordfence or Kadence Security (formerly Solid Security) (when a site has more than one, GuardPress is read, unless GuardPress has never scanned the site and another plugin is protecting it: Wordfence once it has scanned the site, else Kadence Security), from Royally's hourly security sweep: which plugin each site uses (provider), when it last scanned, how many components have known vulnerabilities (null, with vulnerability_checking off, when the site's plugin is not checking: GuardPress without its vulnerability feed, Wordfence before its first scan, and always for Kadence Security, which does not scan for vulnerabilities; not checked, never zero; stale when the feed or last Wordfence scan is over a week old, so new vulnerabilities may be missing; unknown when the site has not said), serious configuration or file findings, updates waiting (updates_waiting counts those without a published vulnerability, null for Kadence Security, which does not report updates; pending_updates lists every core, plugin and theme update the plugin reported, one per component, with current_version, latest_version, fixes_vulnerability, actively_exploited and ignored (set when the agency chose to ignore that update: scope site or every_site, version, reason; ignored updates are left out of the updates alert, but one that fixes a vulnerability is still alerted), or null until the sweep has read the list), and the open security alerts with their advisory ids (use fleet__get_advisory for details), plus muted_alerts that a person dismissed or accepted as a risk. A site whose only problems are muted has status muted, not ok. A site where Royal MCP Pro is not licensed is listed with status unlicensed and no alerts, because Royally cannot check it. A site where Royal MCP reads none of these plugins is checked through EMCP Tools' security scan when that server is connected to it and its scan tool is on (provider emcp: malware, changed WordPress files, critical settings and waiting updates; vulnerability_checking always off, so vulnerable_components is null). Wordfence and Kadence Security sites also get alerts when the firewall or login protection is off. hardening lists which protective settings the site's plugin has on (null until read): provider, items of {key: firewall, login_lockouts, two_factor, strong_passwords, malware_scans, file_monitoring, login_captcha, xml_rpc_off, security_headers, comment_spam or hidden_login; state on, off, learning (Wordfence's firewall not blocking yet) or no_licence (a GuardPress feature that needs its license)}, only the items that plugin reports (a missing item is not reported, not off), GuardPress's own score and grade, and for GuardPress how many users have two-step sign-in set up. Sites Royally does not monitor for security are listed under not_monitored with the reason. Account alerts (a new administrator, which stays open after the account's first 7 days until a person acknowledges, resolves or dismisses it or the account is removed or is no longer an administrator, and capabilities given outside a user's role, which close once they are gone) are raised hourly on every connected site with Royal MCP, with or without a security plugin: they are among these open alerts on the sites listed here, and on other sites they come from Royally's account check (source royally_account_check; use fleet__list_advisories). Use recipe__run_security_sweep to refresh first if the last check is old.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| site_ids | No | Only these sites. Omit for every monitored site. |