Everything the plugin keeps in the database and the scheduler, and what removing it takes away.
Options
| Option | Autoloaded | Holds |
|---|---|---|
consepo_csp_scanner_settings | Yes | The settings |
consepo_csp_scanner_policy | Yes | The last policy a Consepo scan completed with |
consepo_csp_scanner_integrity | Yes | Up to 300 assets with their hashes, statuses and when they were last seen |
consepo_csp_scanner_site | No | The site's scan: slug, status, summary, warnings and timestamps |
consepo_csp_scanner_credentials | No | The API token, or OAuth tokens, sealed with a key derived from wp_salt( 'secure_auth' ) |
consepo_csp_scanner_oauth_client | No | The OAuth client id this site registered, its redirect URI and the issuer |
The three autoloaded options are the ones public pages read on every request. On a public page the integrity option is written at most once, at shutdown, and only when an asset is new, its file changed, or it was last seen more than a day ago.
Transients
| Transient | Lifetime | Holds |
|---|---|---|
consepo_csp_scanner_oauth_metadata | 12 hours, or 1 hour when Consepo published none | Consepo's OAuth authorization server metadata |
consepo_csp_scanner_discover | 1 minute | The one-time token for Check home page |
consepo_csp_scanner_oauth_{user id} | 10 minutes | An administrator's sign-in attempt: its state, PKCE verifier and redirect URI |
Scheduled events
| Hook | Schedule | Does |
|---|---|---|
consepo_csp_scanner_refresh_scan | Twice daily | Refreshes the scan, so a re-run started in the Consepo dashboard reaches the site |
consepo_csp_scanner_poll_scan | Every five minutes after a scan starts, up to 36 times | Follows a running scan until it finishes |
consepo_csp_scanner_hash_remote | 30 seconds after a remote file is queued | Fetches and hashes up to ten queued remote files |
The refresh is scheduled on activation and re-checked on every admin page load, so a copy that was symlinked in rather than activated still gets it.
Deactivating and deleting
Deactivating unschedules all three events and keeps the data. Deleting the plugin runs uninstall.php, which deletes the six options and the first two transients and unschedules the three events. A sign-in attempt transient is left to expire within ten minutes.