WP Manifestindependent plugin directory
manifest / analytics / wp-zabbix

WP Metrics for Zabbix

Complete WordPress monitoring solution for Zabbix. Provides system metrics, security alerts, and performance data via secure REST API endpoint.

by Ender Kuș · github.com/enderkus/wp-zabbix · website

★ 5stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/enderkus/wp-zabbix/archive/refs/heads/main.zip
Readme github.com/enderkus/wp-zabbix ↗

Complete WordPress monitoring solution for Zabbix. Monitor your WordPress sites with comprehensive system metrics, security alerts, and performance data through a secure REST API endpoint.

🚀 Features

Core Monitoring

  • ✅ WordPress Core: Version tracking, latest version, update detection, multisite status, locale, debug mode, memory limits (WP & max)
  • ✅ Plugins: Total/active/inactive counts, pending updates with names, current & new versions
  • ✅ Themes: Active theme (name, version, author, template), total themes, available updates with details
  • ✅ PHP: Version, memory limit, max execution time, post max size, upload max filesize, max input vars, display errors, error reporting level, extensions (curl, gd, imagick, mbstring, mysqli, openssl, zip, xml)
  • ✅ Database: MySQL/MariaDB version, database name, size (bytes & MB), table count, charset, collation
  • ✅ Disk Usage: Upload directory size (bytes & MB), disk free space (bytes & GB), disk total space (bytes & GB), disk usage percentage
  • ✅ Site Info: Site name, URL, admin email, language, timezone, date/time format, HTTPS status, permalink structure

Security Monitoring (Tier 1)

  • 🔐 Failed Login Tracking: Built-in system (no external plugins required)
    • Failed login counts: last hour, last 24h, last week
    • Last failed login details: timestamp, username, IP address
    • Unique attacking IPs (24h)
    • Top attacked username with count
    • Logs username, IP address, user agent for each attempt
    • Auto-cleanup (30-day retention)
  • 🔐 Security Checks: XML-RPC enabled status, file edit permissions (disabled/enabled), debug log detection
  • 🔐 Compatibility: Optional integration with Wordfence, iThemes Security, Limit Login Attempts Reloaded (if installed)

Performance Monitoring

  • ⚡ Response Time: API endpoint response time in milliseconds
  • ⚡ Memory Usage:
    • Current memory usage (bytes & MB)
    • Peak memory usage (bytes & MB)
  • ⚡ Load Average: System load average (1 min, 5 min, 15 min) - Linux only
  • ⚡ Server Uptime: System uptime in seconds (Linux only)

Advanced Monitoring

  • ⏰ Cron Jobs:
    • Total jobs count
    • Next run time & countdown (seconds)
    • Stuck jobs detection (overdue jobs)
    • Cron disabled status
    • Top 10 upcoming jobs with hook names, schedule, next run time, overdue status
  • 🐛 Error Tracking:
    • Debug log existence & size (bytes & MB)
    • Debug log line count
    • Fatal errors count
    • Warning errors count
    • Recent errors list (last 10)
    • PHP error log existence check
  • 🔒 SSL Certificate:
    • SSL enabled status
    • Certificate issuer
    • Valid from date
    • Valid to (expiry) date
    • Days until expiration
    • Certificate verification status

Security & Architecture

  • 🔑 API Key Authentication: Secure 64-character hex key
  • 📖 REST API: WordPress native REST API integration
  • 🔧 Read-Only: Complete safety - no data modification possible
  • 🌐 Multisite Compatible: Works with WordPress Multisite networks
  • 🔄 Auto-Repair: Database table auto-creates if missing

📦 Installation

Method 1: Manual Installation

  1. Download or clone this repository:

    cd /path/to/wordpress/wp-content/plugins/
git clone https://github.com/yourusername/wp-zabbix.git

  2. Activate the plugin:

    • Go to WordPress Admin → Plugins → Installed Plugins
    • Find "WP Metrics for Zabbix"
    • Click Activate

  3. Get your API key:

    • Go to Settings → Zabbix Monitoring
    • Copy your API key

Method 2: Upload via WordPress Dashboard

  1. Download the plugin as ZIP
  2. Go to Plugins → Add New → Upload Plugin
  3. Upload the ZIP file
  4. Click Install Now and then Activate

🔧 Configuration

WordPress Setup

  1. Navigate to Settings → Zabbix Monitoring
  2. Copy your API Key (auto-generated on activation)
  3. Copy your Endpoint URL: https://yoursite.com/wp-json/wp-zabbix/v1/metrics
  4. Test the endpoint using the built-in test button

API Key Management

  • Current Key: Displayed in the admin panel
  • Regenerate: Click "Generate New Key" (invalidates the old key)
  • Security: Keep your API key secure - never commit to public repositories

📊 API Usage

Endpoint

GET /wp-json/wp-zabbix/v1/metrics

Authentication

Two methods available:

1. Header Authentication (Recommended)

curl -H "X-API-Key: YOUR_API_KEY_HERE" \
     https://yoursite.com/wp-json/wp-zabbix/v1/metrics

2. Query Parameter

curl "https://yoursite.com/wp-json/wp-zabbix/v1/metrics?api_key=YOUR_API_KEY_HERE"

Response Example

{
  "timestamp": 1760390232,
  "date": "2025-10-19 11:44:17",
  "status": "ok",
  "wordpress": {
    "version": "6.8.3",
    "latest_version": "6.8.3",
    "has_update": false,
    "is_multisite": false,
    "locale": "en_US",
    "debug_mode": false,
    "memory_limit": "40M",
    "max_memory_limit": "2048M"
  },
  "plugins": {
    "total": 25,
    "active": 18,
    "inactive": 7,
    "updates_available": 3,
    "plugins_need_update": [
      {
        "name": "Elementor",
        "current_version": "3.31.0",
        "new_version": "3.32.0"
      }
    ]
  },
  "themes": {
    "active_theme": {
      "name": "Twenty Twenty-Five",
      "version": "1.3",
      "author": "the WordPress team",
      "template": "twentytwentyfive"
    },
    "total_themes": 3,
    "updates_available": 0
  },
  "php": {
    "version": "8.1.33",
    "memory_limit": "2048M",
    "max_execution_time": "300",
    "post_max_size": "512M",
    "upload_max_filesize": "64M",
    "max_input_vars": "50000",
    "extensions": {
      "curl": true,
      "gd": true,
      "mysqli": true,
      "openssl": true,
      "zip": true
    }
  },
  "database": {
    "version": "10.3.39-MariaDB",
    "database_name": "wp_database",
    "database_size_bytes": 1111393,
    "database_size_mb": 1.06,
    "table_count": 16,
    "charset": "utf8mb4",
    "collate": "utf8mb4_unicode_520_ci"
  },
  "disk": {
    "upload_dir_size_mb": 250.5,
    "disk_free_space_gb": 105.13,
    "disk_total_space_gb": 500.0,
    "disk_usage_percent": 78.97
  },
  "performance": {
    "uptime_seconds": 2592000,
    "memory_usage_bytes": 6291456,
    "memory_usage_mb": 6.0,
    "memory_peak_bytes": 8388608,
    "memory_peak_mb": 8.0,
    "load_average": {
      "1min": 0.52,
      "5min": 0.48,
      "15min": 0.45
    }
  },
  "site": {
    "name": "My WordPress Site",
    "url": "https://example.com",
    "admin_email": "admin@example.com",
    "language": "en-US",
    "timezone": "America/New_York",
    "https_enabled": true,
    "permalink_structure": "/%postname%/"
  },
  "updates": {
    "total_updates_available": 3,
    "wordpress_update": false,
    "plugin_updates": 3,
    "theme_updates": 0
  },
  "security": {
    "failed_logins_last_hour": 3,
    "failed_logins_last_24h": 15,
    "failed_logins_last_week": 42,
    "last_failed_login": "2025-10-19 11:30:22",
    "last_failed_username": "admin",
    "last_failed_ip": "192.168.1.100",
    "unique_ips_last_24h": 5,
    "top_attacked_username": "admin",
    "top_attacked_count": 12,
    "xml_rpc_enabled": true,
    "file_edit_disabled": false,
    "debug_log_exists": false
  },
  "cron": {
    "total_jobs": 12,
    "next_run": "2025-10-19 12:00:00",
    "next_run_in_seconds": 938,
    "stuck_jobs": 0,
    "cron_disabled": false,
    "upcoming_jobs": [
      {
        "hook": "wp_update_plugins",
        "next_run": "2025-10-19 12:00:00",
        "schedule": "twicedaily",
        "is_overdue": false
      }
    ]
  },
  "errors": {
    "debug_log_exists": false,
    "debug_log_size_mb": 0,
    "fatal_errors_count": 0,
    "warning_errors_count": 0,
    "recent_errors": []
  },
  "ssl": {
    "ssl_enabled": true,
    "certificate_issuer": "Let's Encrypt",
    "certificate_valid_from": "2024-09-15",
    "certificate_valid_to": "2025-12-14",
    "certificate_days_until_expiry": 56,
    "certificate_expired": false
  },
  "response_time": 123.45
}

🔍 Zabbix Configuration

Quick Start - Using the Ready-Made Template

📦 Template Included! A complete Zabbix template is provided: zabbix_wordpress_http_template.yaml

Step 1: Import Template

Zabbix Web Interface:
Configuration → Templates → Import

Select file: zabbix_wordpress_http_template.yaml
Import

Step 2: Create Host and Assign Template

Configuration → Hosts → Create host

Host name: WordPress-YourSite
Groups: WordPress Servers
Templates: Select "Template WordPress Monitoring"

Step 3: Configure Macros

Host → Macros → Inherited and host macros

{$WP.API.KEY} → Your API key from WordPress
{$WP.URL} → https://yoursite.com (no trailing slash!)

Done! Your WordPress site is now monitored.

What's Included in Template

  • ✅ Master HTTP Item - Fetches all metrics in one call
  • ✅ 16 Dependent Items - Core metrics (updates, security, performance)
  • ✅ 11 Triggers - Critical alerts (disk, security, errors, SSL)
  • ✅ 2 Macros - Easy configuration per host

Template Items

Category Items Description
Core WordPress Version, Update Available Version tracking & update detection
Updates Total Updates, Plugin Updates, Theme Updates Complete update overview
System PHP Version, Database Size, Disk Usage % Core system metrics
Security Failed Logins (1h, 24h, week), Unique IPs, Top Attacked Username Comprehensive security monitoring
Performance API Response Time, Memory Usage (current & peak in MB), Load Average Performance & resource tracking
Maintenance Cron Jobs (Total, Stuck), Next Run Countdown Cron health monitoring
Errors Fatal Error Count, Warning Count, Debug Log Size Error detection & tracking
SSL Days Until Expiry, Certificate Status SSL certificate monitoring
Site Site Name, URL, HTTPS Status Site information

Template Triggers

Priority Trigger Threshold
🔴 HIGH Critical Disk Usage >95%
🔴 HIGH WordPress Update Available Core update pending
🔴 HIGH Too Many Plugin Updates >5 plugins
🔴 HIGH Multiple IPs Attacking >5 unique IPs
🔴 HIGH Fatal Errors Detected >0 errors
🔴 HIGH SSL Expires Soon <7 days
🟡 WARNING High Disk Usage >85%
🟡 WARNING Brute Force Attack >10 attempts/hour
🟡 WARNING SSL Certificate Warning <30 days
🟡 WARNING Slow API Response >1000ms
🟡 AVERAGE Cron Jobs Stuck >0 stuck jobs

Alternative: Manual Setup (Without Template)

If you prefer manual configuration, follow these basic steps:

Manual Setup:

  1. In Zabbix, go to Configuration → Hosts
  2. Select your WordPress host → Items → Create item
  3. Configure:
    Name: Get WordPress Metrics
Type: HTTP agent
Key: wordpress.get.metrics
URL: https://yoursite.com/wp-json/wp-zabbix/v1/metrics
Request type: GET
Request headers: X-API-Key: YOUR_API_KEY
Update interval: 5m

Multi-Site Deployment

Use the template for monitoring multiple WordPress sites:

For each site:

  1. Create new host
  2. Assign same template
  3. Override macros with site-specific values

Example:

Host 1: wordpress-site1.com
  {$WP.URL} = https://site1.com
  {$WP.API.KEY} = key_for_site1

Host 2: wordpress-site2.com
  {$WP.URL} = https://site2.com
  {$WP.API.KEY} = key_for_site2

Updating the Template

When plugin updates with new metrics:

  1. Update template items in Zabbix
  2. Or re-import updated template (overwrite existing)
  3. All hosts using template get updates automatically!

🔒 Security Best Practices

  1. Use HTTPS: Always use SSL/TLS for API communication
  2. Firewall Rules: Restrict endpoint access to Zabbix server IP only
  3. API Key Rotation: Regularly regenerate your API key
  4. Monitor Access: Review your web server logs for suspicious activity
  5. Keep Updated: Always use the latest version of the plugin

Example Firewall Rules

Apache (.htaccess):

<Files "wp-json">
    <RequireAll>
        Require ip ZABBIX_SERVER_IP
    </RequireAll>
</Files>

Nginx:

location ~ ^/wp-json/wp-zabbix/ {
    allow ZABBIX_SERVER_IP;
    deny all;
}

📋 System Requirements

WordPress Site

  • WordPress: 5.0 or higher
  • PHP: 7.4 or higher (8.0+ recommended)
  • MySQL/MariaDB: 5.6+ / 10.0+
  • WordPress REST API: Must be enabled (enabled by default)
  • PHP Extensions: mysqli, json, openssl (standard in most installations)

Zabbix Server

  • Zabbix: 5.0 or higher (6.0+ recommended for YAML import)
  • HTTP Agent: Support required (available in 4.4+)
  • JSONPath: Processing support
  • Network: HTTPS access to WordPress site

🛠️ Development

File Structure

wp-zabbix/
├── wp-zabbix.php                              # Main plugin file
├── includes/
│   ├── class-metrics-collector.php            # Metrics collection engine
│   └── admin-settings.php                     # Admin panel template
├── assets/
│   └── admin.css                              # Admin panel styles
├── uninstall.php                              # Clean uninstall handler
├── zabbix_wordpress_http_template.yaml        # ⭐ Zabbix template (ready to import)
├── README.md                                  # Complete documentation
├── LICENSE                                    # GPL v2 license
└── .gitignore                                 # Git ignore rules

Adding Custom Metrics

Edit includes/class-metrics-collector.php:

private function get_custom_metrics() {
    return array(
        'custom_value' => your_custom_function(),
    );
}

Then add to collect_all_metrics():

$metrics['custom'] = $this->get_custom_metrics();

🐛 Troubleshooting

WordPress Plugin Issues

API Key Not Working

  1. Verify the API key in WordPress admin
  2. Check REST API is accessible: https://yoursite.com/wp-json/
  3. Ensure no security plugin is blocking REST API
  4. Check .htaccess file for REST API blocks

Failed Login Tracking Not Working

  1. Deactivate and reactivate the plugin (this creates database table)
  2. Verify table exists in database: wp_zabbix_failed_logins
  3. Check WordPress login hooks are functioning
  4. Try manual table creation if needed (check plugin activation logs)

Zabbix Issues

Template Import Failed

  • Zabbix 6.0+: Use zabbix_wordpress_http_template.yaml
  • Zabbix 5.x: Use zabbix-template.xml
  • Check Zabbix version compatibility

Master Item "Not Supported"

  1. Check URL is correct in macro {$WP.URL}
  2. Verify API key in macro {$WP.API.KEY}
  3. Test manually: curl -H "X-API-Key: KEY" https://yoursite.com/wp-json/wp-zabbix/v1/metrics
  4. Check Zabbix server can reach WordPress (firewall, DNS)

Dependent Items Show "Not Supported"

  1. Verify master item has data
  2. Check JSONPath syntax: $.wordpress.version
  3. Ensure preprocessing steps are correct

Triggers Not Firing

  1. Check item has recent data
  2. Verify trigger expression syntax
  3. Ensure trigger is enabled
  4. Check trigger conditions are met

📝 Changelog

1.0.0 (2025-10-19)

  • 🎉 Initial release
  • ✅ Core WordPress, plugin, and theme monitoring
  • ✅ PHP and database metrics
  • ✅ Built-in failed login tracking (no external dependencies)
  • ✅ Cron job monitoring with stuck job detection
  • ✅ Error tracking from debug.log
  • ✅ SSL certificate monitoring
  • ✅ Disk usage and performance metrics
  • ✅ Secure API key authentication
  • ✅ Auto-repair database table mechanism
  • ✅ Zabbix template included

🤝 Contributing

Contributions are welcome! Please:

  1. Fork the repository
  2. Create a feature branch (git checkout -b feature/amazing-feature)
  3. Commit your changes (git commit -m 'Add amazing feature')
  4. Push to the branch (git push origin feature/amazing-feature)
  5. Open a Pull Request

📄 License

This project is licensed under the GPL v2 or later. See the LICENSE file for details.

📚 Documentation

  • 📖 README.md - Complete documentation (installation, usage, configuration)
  • 📊 zabbix_wordpress_http_template.yaml - Ready-to-import Zabbix template

💬 Support

🙏 Acknowledgments

  • WordPress Community
  • Zabbix Community
  • All contributors and users

Made with ❤️ for WordPress & Zabbix monitoring

⭐ If this plugin helps you, please consider giving it a star on GitHub!