=== Notify.domains Domain Monitor ===
Contributors: notifydomains
Tags: domain, dns, ssl, expiry, security
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.11
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Proactive protection for the domain your WordPress site runs on. Expiry, hijacking, and outages, in the dashboard.

== Description ==

Domain Monitor is **proactive protection** for the domain this WordPress site runs on. It watches expiry, hijacking signals, and the outages that follow, from the dashboard you already open. It does not need a Notify.domains account.

If the domain expires, nameservers move, or the certificate lapses, the site is unreachable even when WordPress itself is fine. Registrar reminder mail often goes to a former employee, a privacy proxy, or the agency that built the site and no longer has the contract. The people who log into WordPress are the ones who get blamed.

= What you get as a site owner =

* **Days until expiry** on Dashboard Home, so you do not have to log into the registrar to know if auto-renew is actually doing its job
* **Hijacking signals:** email when nameservers or MX records change
* **Outage warnings:** pending delete, registry hold, expiry inside 7 days, or an expired TLS certificate, as a wp-admin notice editors can see
* **Email to the WordPress admin address** when expiry crosses 30, 14, or 7 days, when the registry puts the name on hold or pending delete, when nameservers or MX change, or when the TLS certificate is about to lapse
* **Registrar name and a typical control-panel link**, so the next click is "fix it"
* **No extra account.** No second inbox to keep in sync. One domain: the one this site runs on.

Once a day it:

* Looks up registry expiry and status over **RDAP** for gTLDs (generic top-level domains such as .com, .net, and .org). For full ccTLD (country-code top-level domain) coverage, [sign up at Notify.domains](https://notify.domains)
* Reads public **DNS** (nameservers, A, AAAA, MX) over HTTPS
* Probes the **TLS certificate** on the site hostname
* Shows the **registrar** name and a link to a typical control panel

A dashboard widget is on by default. Email goes to the WordPress **admin address** (Settings → General).

= What this plugin does not do =

It cannot check the domain while WordPress is down. It is not an HTTP uptime monitor. Quiet sites that never get traffic may skip a day because of wp-cron. A-record changes are not emailed (CDNs rotate those). Cloudflare edge certificates are labeled and not treated as origin expiry.

= Optional: Notify.domains =

If you also want ccTLD coverage, monitoring that keeps running when WordPress cannot, or alerts when this live domain is listed for sale on a marketplace or auction, [sign up at Notify.domains](https://notify.domains). That is optional. The plugin is useful on its own.

== External services ==

This plugin connects to public internet services so it can show registration expiry, DNS, and TLS status for the domain in Settings → General. Checks run from your WordPress host. The plugin does not route traffic through Notify.domains.

No WordPress users, posts, comments, cookies, or the admin email address are sent to these services. The identifiers sent are the site domain and TLS hostname from Settings → General, plus a User-Agent string that includes the plugin name, plugin version, and WordPress version.

= IANA RDAP bootstrap (ICANN Public Technical Identifiers) =

What it is: IANA publishes which RDAP server answers for each TLD. The plugin downloads that public index from `https://data.iana.org/rdap/dns.json`.

What is sent and when: Nothing about your domain. Only a request for the bootstrap file, about once per week (cached). If the bootstrap cannot be fetched, the plugin uses built-in RDAP fallbacks for common TLDs.

IANA is operated by ICANN Public Technical Identifiers (PTI): [privacy policy](https://pti.icann.org/privacy-policy), [ICANN privacy policy](https://www.icann.org/privacy/policy).

= TLD registry RDAP =

What it is: Registration expiry, status, registrar name, and nameservers come from the RDAP server IANA lists for that TLD (or a built-in fallback when the bootstrap is unavailable).

What is sent and when: The monitored domain name is included in the RDAP request URL, about once per day (or when you click Check now). Which operator receives the query depends on the TLD. Built-in fallbacks in the plugin include:

* Verisign (`.com`, `.net`, `.cc`, `.tv`, `.name`): [RDAP policy](https://www.verisign.com/en_US/legal-notices/domain-name-registration-data-access-protocol/index.xhtml), [privacy policy](https://www.verisign.com/en_US/legal-notices/privacy-policy/index.xhtml), [terms of service](https://www.verisign.com/en_US/legal-notices/terms-service/index.xhtml)
* Public Interest Registry (`.org`): [privacy notice](https://pir.org/privacy-notice)
* Identity Digital (`.info`, `.me`, `.biz`, `.io`, `.co`, `.shop`, and other Identity Digital TLDs): [privacy policy](https://identity.digital/policies/privacy-policy/), [terms of use](https://identity.digital/policies/terms-of-use/)
* Google Registry (`.app`, `.dev`, `.page`): [privacy policy](https://www.registry.google/policies/privacy/), [RDAP terms](https://www.registry.google/policies/rdap-terms/)
* CentralNic (`.xyz`, `.online`, `.site`): [privacy policy](https://www.centralnic.com/privacy-policy/), [terms and conditions](https://www.centralnic.com/terms-and-conditions/)
* DENIC (`.de`): [data privacy statement](https://www.denic.de/en/data-privacy-statement/)
* SIDN (`.nl`): [privacy statement](https://www.sidn.nl/en/about-sidn/privacy)
* Nominet (`.uk`, `.co.uk`): [privacy notice](https://www.nominet.uk/who-we-are/policies/privacy-notice/)
* CIRA (`.ca`): [privacy policy](https://www.cira.ca/en/privacy-policy/)
* auDA (`.au`, `.com.au`): [privacy policy](https://www.auda.org.au/policies/privacy-policy/), [terms and conditions](https://www.auda.org.au/policies/terms-and-conditions-dns/)
* NIC.AI (`.ai`): [privacy policy](https://www.nic.ai/privacy-policy/)

For other TLDs, IANA's bootstrap points to the authoritative registry operator; that operator's RDAP service receives the domain name in the request. Consult that operator's website for its terms and privacy policy.

= Public DNS over HTTPS =

What it is: Nameserver, A, AAAA, and MX records are read from public DNS resolvers over HTTPS.

What is sent and when: The domain name as a DNS query, about once per day (or when you click Check now). The plugin tries Cloudflare DNS-over-HTTPS (`https://cloudflare-dns.com/dns-query`) first, then Google Public DNS (`https://dns.google/resolve`) if Cloudflare does not answer.

Cloudflare: [1.1.1.1 resolver privacy](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/), [website terms](https://www.cloudflare.com/website-terms/), [privacy policy](https://www.cloudflare.com/privacypolicy/)

Google Public DNS: [terms of service](https://policies.google.com/terms), [privacy policy](https://policies.google.com/privacy)

= TLS certificate on this site =

What it is: The plugin opens a TLS connection to this site's own hostname on port 443 and reads the certificate expiry. That is not a third-party monitoring service; it is the same public hostname visitors already reach.

What is sent and when: The site's TLS hostname from Settings → General, only to that hostname on your server (or CDN edge), about once per day (or when you click Check now). No data is sent to a separate TLS monitoring vendor.

= Notify.domains (optional, user-clicked only) =

What it is: Optional links to Notify.domains (trial signup, contact, ccTLD coverage) in the settings screen footer and upgrade card.

What is sent and when: Nothing is sent in the background. Links open only if someone clicks them. The trial link may include the monitored domain as a URL parameter.

Notify.domains: [terms of service](https://notify.domains/terms/), [privacy policy](https://notify.domains/privacy/)

== Privacy ==

Results are stored in this WordPress database (`nddm_snapshot` and related options). Email alerts are sent with `wp_mail` to the WordPress admin address. Uninstalling the plugin deletes that stored data. WordPress.org user: [notifydomains](https://profiles.wordpress.org/notifydomains/).

== Installation ==

1. Zip the `notify-domains-domain-monitor` folder and upload it at Plugins → Add Plugin → Upload Plugin. Or copy that folder to `/wp-content/plugins/notify-domains-domain-monitor/`.
2. Activate **Notify.domains Domain Monitor**.
3. Open the Dashboard. The Domain Monitor widget is on.
4. Optional: Settings → Domain Monitor to confirm the domain and that mail goes to the admin address.

The first check runs as soon as you open Domain Monitor after activation. Use **Check now** any time after that.

== Screenshots ==

1. Dashboard widget on Dashboard → Home. Days until expiry, registrar, nameservers, and TLS.
2. Settings → Domain Monitor after the first lookup, including sample alert emails.
3. wp-admin notice when expiry (or another critical issue) needs attention.
4. Alert email sent to the WordPress admin address.

== Frequently Asked Questions ==

= What does this protect against? =

Expiry (registration running out), hijacking (nameserver or MX changes you did not expect), and the outages that follow (pending delete, hold, or a lapsed TLS certificate). Checks run from this WordPress site, and the status lives on the dashboard.

= Why not just rely on the registrar email? =

That mail often goes to whoever registered the name: a former employee, a privacy proxy, or the agency that built the site and no longer has the contract. Domain Monitor puts expiry, DNS, and TLS in wp-admin, and emails the WordPress admin address the site team already uses.

= Does this require a Notify.domains account? =

No. Registry, DNS, and TLS checks for gTLDs run from your WordPress host. Notify.domains is optional, and is how you get full ccTLD coverage, off-site monitoring, and marketplace listings.

= Where do emails go? =

The WordPress admin email under Settings → General. Change it there. Domain Monitor does not keep a separate address so the two cannot drift apart.

= Why is expiry wrong or missing? =

Some registries do not publish an expiration date in RDAP. Some hosts block outbound HTTPS to the registry. The plugin will say it could not reach the registry instead of showing a fake all-clear.

= Why does TLS say Cloudflare? =

If the site is proxied, the certificate WordPress can see is Cloudflare's edge cert, which auto-renews. That is not the origin certificate on your host.

= Does this support country-code domains (.uk, .de, .au)? =

This plugin covers gTLDs (generic top-level domains such as .com, .net, and .org). Country-code TLDs (ccTLDs) are not fully covered here. [Sign up at Notify.domains](https://notify.domains) for ccTLD monitoring.

== Changelog ==

= 1.0.11 =
* External services section documents every third-party lookup (IANA bootstrap, registry RDAP operators, DNS resolvers, optional Notify.domains links) with working terms and privacy policy URLs.
* Tested up to WordPress 7.1.

= 1.0.10 =
* Sample emails include registry hold and mail routing, ordered expiry, hold, nameservers, mail routing, certificate.

= 1.0.9 =
* Sample email intro copy uses the full width of the settings card.

= 1.0.8 =
* Settings screen shows labeled sample emails (nameservers, expiry, certificate) so you can see what an alert looks like before one is sent.

= 1.0.7 =
* How Domain Monitor works can be collapsed and expanded. It is no longer dismissed permanently.

= 1.0.6 =
* Clearer Domain Monitor emails: specific subjects, HTML plus plain text, linked Open Domain Monitor button.

= 1.0.5 =
* Settings help text for Domain and TLS hostname stays in the value column.

= 1.0.4 =
* Settings screen no longer fatals if plugin files are out of sync. Domain and TLS hostname are read from Settings → General. Widget status icon matches the two-line header.

= 1.0.3 =
* Clearer empty states and lookup errors. Widget icon sized to the two-line header. Issue lines align with the heading. Check now shows a spinner until the page reloads. Dashboard widget visibility is Screen Options only.

= 1.0.2 =
* Settings footer shows the plugin version and a Contact us link. Next-check times stay on one line.

= 1.0.1 =
* First check runs as soon as you open Domain Monitor after activate, with a visible progress state.

= 1.0.0 =
* First version. Dashboard widget, Settings screen, daily RDAP / DNS / TLS checks, email to the admin address.

== Upgrade Notice ==

= 1.0.11 =
Readme update: external services documentation for WordPress.org review.

= 1.0.0 =
Initial release.
