Tracking — Digital Exposure Audit #

Purpose #

Demonstrates to visitors how much of their identity is exposed to any website they visit. Designed as a sales/awareness tool for cybersecurity consultations.

No data is stored. No cookies are set by this plugin. Everything is computed live and discarded.

How it works #

The plugin collects information from two sources:

Server-side (PHP): IP address (with proxy/VPN detection via ipCheck()), User-Agent, accepted languages, referrer, source port, forwarding headers (X-Forwarded-For, Cloudflare).

Client-side (JavaScript): Screen resolution, colour depth, CPU cores, device memory, connection type, battery status, timezone, platform, canvas fingerprint, WebGL renderer/vendor, audio fingerprint, Do Not Track, cookies, localStorage, browser plugins, touchscreen capability, WebRTC IP leak.

A final score (0–100) is computed based on how many vectors returned usable data. The score represents exposure percentage, not a security rating.

Threat levels #

Each data card is visually tagged by exposure severity:

• Low (green border): minimal identifying power on its own
• Medium (yellow border): contributes to fingerprint entropy
• High (red border): strongly identifying
• Critical (pulsing red border): near-unique identifier

Security #

• Access restricted to TRACKING_LEVEL_HIGHUSER by default
• Not public ($is_public = 0)
• All server-side values sanitized via Parser
• No database required
• No data persistence

Structure #

/plugins/tracking/
├── tracking.php
├── /conf/
│   └── tracking.conf.inc.php
├── /doc/
│   └── tracking.md
├── /locale/
│   ├── tracking.en.inc.php
│   ├── tracking.fr.inc.php
│   └── tracking.de.inc.php
├── /css/
│   └── tracking.css
└── /js/
	└── tracking.js

Configuration #

In conf/tracking.conf.inc.php:

• $ftype = 2 — classified as stats/crawler tool
• $is_public = 0 — not available to unauthenticated visitors
• TRACKING_LEVEL_HIGHUSER — minimum access level

To restrict to admins only:

defined('TRACKING_LEVEL_HIGHUSER') or define('TRACKING_LEVEL_HIGHUSER', BASE_LEVEL_ADMIN);

Translations #

47 translation keys in $dialtracking[]. Available in EN, FR, DE.

JavaScript API #

The plugin exposes three global functions (prefixed to avoid collision):

• tracking_init() — entry point, called via $footdata
• tracking_checkWebRTC(translations, callback) — async WebRTC leak test
• tracking_updateVerdict(score, maxScore, translations) — recomputes and displays the verdict

All translations are passed via setJavascriptLocale() through the PLUGIN_TRANSLATION.tracking namespace.

Changelog #

• 2.0.0 (2026.02.07): Complete rewrite. Added canvas/WebGL/audio fingerprinting, WebRTC leak detection, battery API, scoring system. Full i18n. BeamReactor plugin conventions.
• 1.0.0 (2003): Original version. Basic server info + inline JavaScript.