WordPress plugin vulnerability alerts for the site your designer built
Run the free website scan to see what your site runs and what is out of date. Vulnerability Watch then alerts you when a plugin, theme or PHP version has a known vulnerability or reaches end of life.
Free plan, with add-ons from a few dollars a month.
Nobody has touched the website since launch. That is the gap.
Your designer built the site, handed over the logins and moved on. The plugins and theme kept getting fixes. Your site kept running the old versions.
Every WordPress site is made of parts written by different people: the WordPress core, a theme, and a handful of plugins for forms, bookings or a shop. When a flaw is found in one of those parts, the author publishes a fix and the flaw is listed publicly.
Once a flaw is public, people go looking for sites still running the affected version. A small business site is not targeted because it is important. It is found because it is out of date.
When it goes wrong, it usually looks ordinary: spam pages appearing under your domain, a contact form that sends junk, a browser warning in front of your home page, or a weekend spent with your host restoring a backup.
The fix is rarely hard. The hard part is knowing it is needed. That is what the free website scan and Vulnerability Watch are for.
Photo by Unknown authorUnknown author on Wikimedia Commons (Public domain)
What can go wrong at each layer, and what to ask
Your website is a stack of software. Each layer below says what can go wrong there and the questions that get a straight answer from whoever looks after the site.
Plugins
Plugins add your contact form, bookings and shop. Each is someone else's code, and abandoned plugins never get a fix. Ask your developer: which plugins do we actually use, is each still updated, and can we remove the rest?
Themes
A premium or custom theme bought years ago may not update on its own, so fixes never arrive. Ask your developer: is our theme still supported, is it a child theme, and who holds the licence that delivers updates?
PHP
PHP is the language WordPress runs on. After end of life a version gets no more security fixes, though the site still loads. Ask: which version are we on, when does support end, and can we test a newer one on a copy first?
Server software
Under PHP sit the web server, database and hosting control panel. On shared hosting they are your host's job. On a server your designer set up, they may be nobody's. Ask: who updates the server, and is anything past end of life?
What a Vulnerability Watch alert says
What happened: a plugin on your site has a publicly listed vulnerability for the version you run. Why it matters: the flaw is public, so sites on that version get looked for. What to do next: update the plugin or forward this to your developer.
How WordPress plugin vulnerability alerts reach you, in four steps
Run the free website scan
Enter your website address. The scan shows what your site runs, including WordPress, the theme, plugins and PHP, what is out of date, and which alerts are worth turning on.
Start a free account
The free plan watches one website with uptime checks every 5 minutes, SSL and domain expiry, and one full scan. You also get a weekly digest and a monthly health report.
Turn on Vulnerability Watch
Add Vulnerability Watch to hear when a plugin, theme, PHP version or other software on your site has a known vulnerability or reaches end of life. Add-ons start from a few dollars a month.
Act on the alert, then move on
Update it yourself or forward the alert to your developer. Your alerts stay in your history for 90 days, so you can check what was flagged and when.
Every alert says what happened, why it matters and what to do next.
Questions owners ask about WordPress vulnerability alerts
Frequently Asked Questions
- Do I need to know which plugins my site uses?
- No. The free website scan works out what your site runs, including WordPress, the theme, plugins and PHP version. You do not need logins or a list from your developer to see the result.
- Will Vulnerability Watch fix the problem for me?
- No. It tells you what happened, why it matters and what to do next. Most fixes are an update from the WordPress dashboard. If someone else looks after your site, forward the alert to them as it is.
- What is the difference between out of date and vulnerable?
- Out of date means a newer version exists. Vulnerable means a flaw has been publicly listed for the version you run, often with a CVE number. Our glossary entry on CVE explains how those listings work.
- What does end of life mean for PHP?
- When a PHP version reaches end of life, it stops getting security fixes. Your site keeps loading, so nothing looks wrong, but new flaws in that version will never be patched. Our PHP end-of-life guide explains how to plan the move.
- My site is not built on WordPress. Is this still useful?
- Yes. Vulnerability Watch covers PHP versions and other website software you run, not only WordPress plugins and themes. Run the free website scan first to see what it finds on your site.
- My developer says the site is fine. Why check?
- They may be right today. New flaws are published all the time, and an alert means you hear about the next one without having to ask. It also gives you specific questions to put to them.
Know what your website runs before the next flaw is published.
Run the scan, open a free account, and add Vulnerability Watch when you want an alert the day a plugin, theme or PHP version on your site needs attention.