System

Compatibility check

Stack Guard looks at what sits around it (a CDN such as Cloudflare, the host, caching, other security plugins, Jetpack, shops, page builders, email and scheduled tasks) and tells you which of its settings would clash, and what to do.

What it does

The Compatibility section at the top of the System tab lists each finding with what was found, what to do, and how it was found, so you can judge it yourself. Conflicts come first.

It checks: whether visitor addresses are read correctly behind a proxy or CDN; security headers the host or CDN already sends; whether the sign-in page is cached; cache plugins and host caches; other security plugins; Jetpack with XML-RPC blocked; shops with country blocking or firewall rules on; page builders with an enforced Content Security Policy; nginx servers; hosts with their own sign-in limits; email delivery; and scheduled tasks.

When there is a conflict, the Dashboard shows how many things need a check, and the setting involved shows a short note beside it.

Why it matters

Most problems after installing a security plugin come from what is around it: a CDN that hides visitor addresses, a cached sign-in page, two plugins locking out the same user, or email that never arrives with an unlock link. Finding these before turning protections on avoids locking out real people.

Use it

Open the System tab. The first time, the test request runs in the background.
Read each Conflict and follow its What to do line.
Click Check again after changing the host, the CDN or a plugin.

Read your Cloudflare settings (Pro)

With Pro, the check can read your Cloudflare zone instead of guessing from headers: the SSL mode, Always Use HTTPS, the minimum TLS version, HSTS, APO, cache rules that may cover the sign-in page, Bot Fight Mode and custom firewall rules. Flexible or off SSL is a conflict, because passwords travel unencrypted between Cloudflare and the server.

In Cloudflare, open My Profile, API Tokens and create a token with Zone Read and Zone Settings Read for this site's zone. Add Zone WAF Read, Bot Management Read and Cache Rules Read to check those too. Account-owned tokens may not be able to read Bot Fight Mode. Paste it in the Cloudflare settings panel under the findings and click Connect.

The token is stored encrypted, never shown again, never exported, and removed when Stack Guard is deleted. Cloudflare is only called when you connect and when the check runs; Stack Guard never changes anything there. Parts the token cannot read are listed as Unknown with the permission to add.

Good to know

It only reads and advises. It never changes another plugin, the host or the CDN.

When something cannot be checked, for example because the site cannot reach itself, it says Unknown instead of guessing.

Stack Guard cannot read other security plugins' settings. It lists what they can also do and which of those features are on in Stack Guard, so you can check the other plugin.

Results are kept for 12 hours and checked again after a plugin or theme change, or after saving a setting they depend on.

Which plan includes it

The compatibility check is in every plan. Reading Cloudflare settings with an API token is part of Pro. The System tab needs full access to Stack Guard, and Check again and the Cloudflare token also need an administrator; the Dashboard count shows for everyone who can see Stack Guard.

How it works, for developers

Built by SMG_Compat. Findings are cached in the smg_compat_results transient and the test request answers in smg_compat_probe, each for 12 hours.
The test request is one GET of the home page and one of the sign-in address, from the site to itself, 10 second timeout. The home page request carries a one-time signed value in X-SMG-Compat so Stack Guard leaves its own headers out and only the host or CDN headers are seen. Only a short list of headers is kept.
Check again uses the smg_compat_check AJAX action: manage_options plus full access, admin nonce, 6 runs per 10 minutes. The signed value works once, the signed request follows no redirects, and its answer is sent with no-store headers and DONOTCACHEPAGE so no cache keeps a copy without Stack Guard's headers.
A failed email is recorded in smg_last_mail_failure (time and error text, addresses removed) and cleared by the next email that goes out.
Cloudflare (Pro, SMG_Compat_Cloudflare, feature compat_cloudflare_api): token in smg_cloudflare_api_token encrypted with the two-factor secret key and moved to the new key when the security keys change (dropped if it cannot be moved), zone in smg_cloudflare_zone_id. Connect lists zones with GET /zones (AJAX smg_compat_cf_connect, 6 per 10 minutes); Check again reads /zones/{id}/settings, /bot_management and the http_request_firewall_custom and http_request_cache_settings entry point rulesets, 6 seconds each. Rule expressions are not stored, only counts and whether a caching rule names the sign-in address.
Tests and site builders can replace what the check reads with the smg_compat_environment and smg_compat_host filters.

Quick answers about compatibility check

What does Compatibility check do in Stack Guard?

The Compatibility section at the top of the System tab lists each finding with what was found, what to do, and how it was found, so you can judge it yourself. Conflicts come first. It checks: whether visitor addresses are read correctly behind a proxy or CDN; security headers the host or CDN already sends; whether the sign-in page is cached; cache plugins and host caches; other security plugins; Jetpack with XML-RPC blocked; shops with country blocking or firewall rules on; page builders with an enforced Content Security Policy; nginx servers; hosts with their own sign-in limits; email delivery; and scheduled tasks. When there is a conflict, the Dashboard shows how many things need a check, and the setting involved shows a short note beside it.

Why use compatibility check on a WordPress site?

How do I set up compatibility check?

1. Open the System tab. The first time, the test request runs in the background. 2. Read each Conflict and follow its What to do line. 3. Click Check again after changing the host, the CDN or a plugin.