hosting

GET `/v1/sites/{siteId}/plugin-guard`

What the plugin guard found on, or refused for, one site.

Authentication

Send an API key as a bearer token. The key must carry the sites.view permission; a key without it is refused with 403, not 404.

This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X GET https://api.zinndigital.com/v1/sites/{siteId}/plugin-guard \
  -H "Authorization: Bearer zdk_live_…"

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

L06 s1014 (docs/1027). The plugin guard refuses a blocked plugin or a phishing kit at every install and upload door, and a fleet scan finds what arrived another way (wp-admin, SFTP, a restore). Lists every open finding and everything resolved in the last 90 days, newest first: state is reported (found, left in place), quarantined (moved to the account's protected quarantine folder, nothing deleted), refused (stopped at a door), restored, or gone. Requires sites.view; 404 for a site that is not yours.

Parameters

Name	Type	Required	What it is
`siteId (path)`	`string`	Yes	—

Response

Name	Type	Required	What it is
`hits`	`PluginGuardHit[]`	Yes	—
`holds`	`SitePluginUpdateHold[]`	Yes	Plugin updates on hold for this site (its own and every site's), holding or released in the last 30 days.
`updates`	`PluginUpdateAttempt[]`	Yes	Plugin updates the platform applied or refused on this site in the last 90 days, newest first.
`integrity`	`SiteIntegrityFinding[]`	Yes	Site integrity findings (WordPress core files that are not WordPress's own, or a wrong site address), open or seen in the last 90 days.

Errors this endpoint can return

401 · 403 · 404

GET /v1/sites/{siteId}/plugin-guard