WordPress security monitoring

Two lanes: the checks that run against every website you manage without anybody asking, and the deeper scan you run when you want it. This page is both lists, what a finding carries when one is raised, and — because it matters more than the rest — what this product deliberately will not do.

Start your 14-day trial What it will not do

Core integrity checked nightly Advisories matched hourly Findings that survive a fix and a relapse

Two lanes, and the difference is not decoration

Anything that runs against sixty customer websites on a timer has to be cheap enough to be polite. Anything expensive has to be something a person chose to spend.

Lane one

Runs on its own, on every connected website

Core file integrity, nightly. WordPress core compared against what that release should contain.
File integrity, indicators and correlation, nightly. The heaviest pass, run when the website's visitors are fewest.
Published advisories, hourly. Refreshed and matched against the versions actually installed, not against plugin names.
Cloaking, weekly. Whether the website shows a search engine something different from a visitor.
Certificates and mail records, daily. Plus indexability, so a noindex left after a rebuild is caught the next morning.
A database write probe, daily. Because a quota lock that removes INSERT breaks logins and orders while every read-only check reports the site fine.

Lane two

Runs when you ask, one website or the whole estate

The full security scan. The connected plugin examines the installation and answers; the public surface is read from outside at the same time.
Both halves, always. The outside-in observation runs even when the plugin does not answer — a website whose Agent has gone quiet is exactly one worth looking at from outside.
Estate-wide from one press. One website at a time, resumable, with the remaining work recorded as a row rather than held in a process.
Not on a timer, and this page will not pretend otherwise. Nothing schedules it. You run it, or it does not run.

What a finding carries

A finding is not an alert with a scary title. It names a rule from a closed vocabulary, carries its own severity and a separate confidence, and quotes a bounded, sanitised fragment of the evidence — written by a website that may be compromised, so it is treated as hostile input on the way in.

Severity and confidence are two axes and are never collapsed into one number. “Almost certainly nothing, but it would be serious” and “definitely there, and it is minor” are different situations, and an agency triaging sixty websites needs to tell them apart before breakfast.

Each one also says what to do: which page, which location, and what would establish whether an installed plugin accounts for it.

On every finding

Rule: closed vocabulary
Severity: critical · high · warning
Confidence: high · medium · low
Evidence: sanitised, bounded
Where: surface and location
Next step: in plain language

Three rules, in the product's own words

Executable JavaScript primitive in the page. The page runs a JavaScript construct commonly used to execute code that is not visible in the source. Legitimate scripts occasionally use these, so this is evidence to review rather than proof of a break-in.

Obfuscated script content in the page. An inline script carries a long encoded or escaped block rather than readable code. Hiding what a script does is unusual for legitimate website code.

Raw PHP visible in the public page. The public page contains PHP source the server did not execute — either a broken configuration or code placed somewhere PHP is never run, and both expose logic visitors should never see.

A finding has a life, and nothing is deleted

“Was this fixed, and did it come back?” is the question that separates a security tool from a list of warnings. It can only be answered by a record that outlives the problem.

State one

Open

Raised, with its rule, severity, confidence and evidence. It stays on the website's record and in the client report's unresolved section until something changes.

State two

Resolved

It stopped being reported by an observation that was complete. A page that could not be fully read proves nothing about what is absent from it, so a partial reading never closes anything.

State three

Recurred

It came back, and the count went up. The same finding returning three times is a different story from three separate findings, and the record tells them apart.

A finding's identity is built from the website, the surface, the rule and a normalised object key — and never from text the remote website supplied.

That is a deliberate defence rather than a tidy implementation detail. An attacker who rewrites the payload around the same construct produces the same identity and increments a recurrence, instead of quietly opening a fresh finding that looks like a first sighting. And because an incomplete observation cannot resolve anything, making a page unreadable is not a way to clear the ledger.

The record has to survive the thing it describes, or it is just a notification.

What this is not

Four sentences that most products in this category leave you to discover after you have bought. Read them before the trial rather than after.

It does not remove anything

SiteVigilante will show you what it would propose and record that you approved it. It has no route that carries the action out — not on that screen and not anywhere else, and a test in this repository fails the build if one is ever added. This is a product that finds and explains; the fixing is yours.

It does not scan continuously

The checks in lane one run on the cadences named above — nightly, hourly, daily, weekly. The full scan in lane two runs when you press it. Nothing here watches a website second by second, and no page of this website will tell you it does.

It is not a firewall, and it blocks nothing

Every check reads. Nothing sits in front of a website, inspects traffic or refuses a request. If you need something in the request path, you need a different category of product, and this one is happy to sit beside it.

It does not guarantee anything

No security product can promise a website will not be compromised, and one that does is telling you something about its marketing rather than its engineering. What this offers is that the checks it says it runs are the checks it runs, at the cadence it states, and that an answer it could not establish is reported as unknown rather than as clean.

Scan a website you already look after

14 days, no card required. Connect one website, run the scan, and read what it found and what it says to do about it.

Start your 14-day trial The full timetable

€1.49 per website per month, excluding VAT Included, not a security tier