Everything you need to keep WordPress sites secure and online

Every minute we check whether your sites are reachable. If a site goes down, an incident is opened in the log immediately, with start time, duration and error type. So you know before your client calls.

Once a day we read the installed plugins and themes with their versions, plus the WordPress core version and the server status (Site Health). Every version is checked against the Wordfence Intelligence vulnerability database, with WPScan as a fallback.

Only versions that actually fall within a vulnerable range are flagged, so you don't get false alarms.

• SSL certificate: warning 30 days and urgent 14 days before expiry
• Security headers: HSTS, X-Frame-Options, X-Content-Type-Options and Content-Security-Policy
• Publicly reachable xmlrpc.php
• Exposed files such as .git/HEAD, debug.log, readme.html and wp-config backups
• Username "admin", disabled indexing, publicly visible users and inactive plugins or themes
• PHP version: warning when it no longer receives security updates

Green, orange or red per site. Outdated plugins are shown with the latest available version, so you know exactly what needs updating.

A 30-day uptime bar, an incident log and a timeline of all scans with found and fixed vulnerabilities. Monthly reports per site with uptime percentage, security score and updated plugins, ready to print or share as PDF.

Each site uses a WordPress Application Password. It is stored encrypted and only used on our server — it never reaches the browser.