Michael Dahlke

<p>You (the project manager or WP admin) are constantly needing to tell your developer that you added/updated/removed a plugin<br />
on the live site so he can keep his dev environment semi-synced. This eliminates that need, by just shooting them an email<br />
with the plugin information and what happened.</p>


Plugin Notifier

Automatically alert your developer when you install/update/remove a plugin.

aaronhsieh

<p>Site Add-on Watchdog keeps an eye on your site’s plugins and warns you when:</p>
<ul>
<li>Your installed version is two or more minor releases behind the directory build.</li>
<li>The official changelog mentions security or vulnerability fixes.</li>
<li>(Optional) WPScan lists open CVEs for the plugin when you provide your own API key.</li>
</ul>
<p>The plugin runs on a schedule you control—choose daily, weekly, a twenty-minute testing cadence, or rely on manual scans—and stores results locally. Nothing leaves your site unless you explicitly configure outgoing notifications.</p>
<h3>Privacy first</h3>
<ul>
<li>No plugin inventory or telemetry is ever sent off-site by default.</li>
<li>Optional webhooks are opt-in and only post the detected risks.</li>
<li>WPScan lookups only run when you add your personal API token.</li>
</ul>
<h3>Admin tools</h3>
<ul>
<li>Dashboard page with the current risk list and manual scan button.</li>
<li>Ignore list to suppress noisy plugins.</li>
<li>Notification settings for email, Discord, Slack, Microsoft Teams, or a generic webhook.</li>
</ul>
<h3>Notifications</h3>
<ul>
<li>Email: send to one or more recipients (comma separated).</li>
<li>Discord: post to a channel via webhook.</li>
<li>Slack: connect via an incoming webhook to post alerts into any workspace channel.</li>
<li>Microsoft Teams: send adaptive card style notices through an incoming webhook connector.</li>
<li>Generic webhook: post JSON payload to any endpoint you control, with optional HMAC signatures. Failed deliveries are logged and highlighted on the Watchdog admin screen so you can reconfigure or resend manually.</li>
</ul>
<h3>Troubleshooting</h3>
<h3>Scheduled scans are not running</h3>
<p>Watchdog relies on WP-Cron to trigger scheduled scans and notifications. If you have set <code>DISABLE_WP_CRON</code> to <code>true</code> or your site receives very little traffic (so WP-Cron rarely runs), configure a system cron job to call either <code>wp-cron.php</code> or the plugin’s REST endpoint. The admin <strong>Delivery health</strong> panel lists the REST URL you can target; a typical example looks like this:</p>
<pre><code>curl -X POST https://example.com/wp-json/site-add-on-watchdog/v1/cron
</code></pre>
<p>Testing-mode notifications also rely on this trigger, so be sure your cron job is running when validating delivery.</p>
<h3>CLI Usage</h3>
<p>Watchdog bundles a WP-CLI command so you can run scans outside of the WordPress admin. All examples below assume the command is executed from a shell where <code>wp</code> (WP-CLI) is available.</p>
<pre><code>wp watchdog scan [--notify=<bool>]
</code></pre>
<ul>
<li><code>--notify</code> (optional): Accepts <code>true</code> or <code>false</code> (defaults to <code>true</code>). When set to <code>false</code>, Watchdog will skip any configured email or webhook notifications and only record the scan locally.</li>
</ul>
<p>Examples:</p>
<ul>
<li>Run a scan and send notifications (default): <code>wp watchdog scan</code></li>
<li>Run a scan silently (skip notifications): <code>wp watchdog scan --notify=false</code></li>
</ul>
<p>Recommended workflow: on CI/CD platforms, add a job step that boots your WordPress/WP-CLI container, runs pending database migrations if needed, and then calls <code>wp watchdog scan --notify=false</code> to verify the plugin state without spamming production channels. Promote to production by rerunning the same command with notifications enabled when you are ready to alert your team.</p>
<h3>Development</h3>
<p>The development repository is available on GitHub: https://github.com/happyloa/Site-Add-on-Watchdog. Clone it locally to review the source or run the test suite.</p>


Site Add-on Watchdog

Monitor installed plugins for security notices, outdated releases, and WPScan disclosures without leaking your site's plugin inventory.

Plugin Notifier vs Site Add-on Watchdog