aaronhsieh

<p>Site Add-on Watchdog keeps an eye on your site’s plugins and warns you when:</p>
<ul>
<li>Your installed version is two or more minor releases behind the directory build.</li>
<li>The official changelog mentions security or vulnerability fixes.</li>
<li>(Optional) WPScan lists open CVEs for the plugin when you provide your own API key.</li>
</ul>
<p>The plugin runs on a schedule you control—choose daily, weekly, a twenty-minute testing cadence, or rely on manual scans—and stores results locally. Nothing leaves your site unless you explicitly configure outgoing notifications.</p>
<h3>Privacy first</h3>
<ul>
<li>No plugin inventory or telemetry is ever sent off-site by default.</li>
<li>Optional webhooks are opt-in and only post the detected risks.</li>
<li>WPScan lookups only run when you add your personal API token.</li>
</ul>
<h3>Admin tools</h3>
<ul>
<li>Dashboard page with the current risk list and manual scan button.</li>
<li>Ignore list to suppress noisy plugins.</li>
<li>Notification settings for email, Discord, Slack, Microsoft Teams, or a generic webhook.</li>
</ul>
<h3>Notifications</h3>
<ul>
<li>Email: send to one or more recipients (comma separated).</li>
<li>Discord: post to a channel via webhook.</li>
<li>Slack: connect via an incoming webhook to post alerts into any workspace channel.</li>
<li>Microsoft Teams: send adaptive card style notices through an incoming webhook connector.</li>
<li>Generic webhook: post JSON payload to any endpoint you control, with optional HMAC signatures. Failed deliveries are logged and highlighted on the Watchdog admin screen so you can reconfigure or resend manually.</li>
</ul>
<h3>Troubleshooting</h3>
<h3>Scheduled scans are not running</h3>
<p>Watchdog relies on WP-Cron to trigger scheduled scans and notifications. If you have set <code>DISABLE_WP_CRON</code> to <code>true</code> or your site receives very little traffic (so WP-Cron rarely runs), configure a system cron job to call either <code>wp-cron.php</code> or the plugin’s REST endpoint. The admin <strong>Delivery health</strong> panel lists the REST URL you can target; a typical example looks like this:</p>
<pre><code>curl -X POST https://example.com/wp-json/site-add-on-watchdog/v1/cron
</code></pre>
<p>Testing-mode notifications also rely on this trigger, so be sure your cron job is running when validating delivery.</p>
<h3>CLI Usage</h3>
<p>Watchdog bundles a WP-CLI command so you can run scans outside of the WordPress admin. All examples below assume the command is executed from a shell where <code>wp</code> (WP-CLI) is available.</p>
<pre><code>wp watchdog scan [--notify=<bool>]
</code></pre>
<ul>
<li><code>--notify</code> (optional): Accepts <code>true</code> or <code>false</code> (defaults to <code>true</code>). When set to <code>false</code>, Watchdog will skip any configured email or webhook notifications and only record the scan locally.</li>
</ul>
<p>Examples:</p>
<ul>
<li>Run a scan and send notifications (default): <code>wp watchdog scan</code></li>
<li>Run a scan silently (skip notifications): <code>wp watchdog scan --notify=false</code></li>
</ul>
<p>Recommended workflow: on CI/CD platforms, add a job step that boots your WordPress/WP-CLI container, runs pending database migrations if needed, and then calls <code>wp watchdog scan --notify=false</code> to verify the plugin state without spamming production channels. Promote to production by rerunning the same command with notifications enabled when you are ready to alert your team.</p>
<h3>Development</h3>
<p>The development repository is available on GitHub: https://github.com/happyloa/Site-Add-on-Watchdog. Clone it locally to review the source or run the test suite.</p>


Site Add-on Watchdog

Monitor installed plugins for security notices, outdated releases, and WPScan disclosures without leaking your site's plugin inventory.

Pierre Lannoy

Hosterra

<p><strong>Capture and log events, metrics and traces on your site. Make WordPress observable – finally!</strong></p>
<p>De-facto standard stack for WordPress observability, <strong>DecaLog</strong> provides reliable and powerful logging, monitoring and tracing features for WordPress core, PHP, database, plugins and themes.</p>
<p><strong>DecaLog</strong> captures events generated by WordPress core, PHP, database, plugins and themes, collates metrics and KPIs and follows traces of the full WordPress execution. It has the ability to enrich these events, metrics and traces with many details regarding their triggering, before storing them in WordPress database or passing them to external services.</p>
<p>If you don’t want to use external services, <strong>DecaLog</strong> provides the tools to leverage all the benefits of observability right in the WordPress admin dashboard. It supports multisite logs delegation and contains many features to help to protect personal information (user pseudonymization, IP obfuscation, etc.).</p>
<p>For a full list of supported – internal or third-party – services please, jump to the official <a href="https://perfops.one/decalog#services" rel="nofollow ugc">supported services list</a>.</p>
<p><strong>DecaLog</strong> can be used in dev/debug phases or on production sites: it has nearly no resource impact on the server. It provides an extensive set of WP-CLI commands to help operations too.</p>
<blockquote>
<p><strong>DecaLog</strong> is part of <a href="https://perfops.one/" rel="nofollow ugc">PerfOps One</a>, a suite of free and open source WordPress plugins dedicated to observability and operations performance.</p>
</blockquote>
<h4>Developers</h4>
<p>If you’re a plugins / themes developer and want to take advantage of the logging features of DecaLog, there’s a <a href="https://decalog.io/" rel="nofollow ugc">DecaLog SDK</a> for you.</p>
<h4>Support</h4>
<p>This plugin is free and provided without warranty of any kind. Use it at your own risk, I’m not responsible for any improper use of this plugin, nor for any damage it might cause to your site. Always backup all your data before installing a new plugin.</p>
<p>Anyway, I’ll be glad to help you if you encounter issues when using this plugin. Please read carefully the FAQ at the bottom of this page before requesting support.</p>
<h4>Privacy</h4>
<p>This plugin, as any piece of software, is neither compliant nor non-compliant with privacy laws and regulations. It is your responsibility to use it – by activating the corresponding options or services – with respect for the personal data of your users and applicable laws.</p>
<p>This plugin doesn’t set any cookie in the user’s browser.</p>
<p>This plugin may handle personally identifiable information (PII). If the GDPR or CCPA or similar regulation applies to your case, you must use the anonymization options embedded in the plugin and/or adapt your processes (consent management, security measure, treatment register, etc.).</p>
<h4>Donation</h4>
<p>If you like this plugin or find it useful and want to thank me for the work done, please consider making a donation to <a href="https://www.laquadrature.net/en" rel="nofollow ugc">La Quadrature Du Net</a> or the <a href="https://www.eff.org/" rel="nofollow ugc">Electronic Frontier Foundation</a> which are advocacy groups defending the rights and freedoms of citizens on the Internet. By supporting them, you help the daily actions they perform to defend our fundamental freedoms!</p>


DecaLog

Very nice to be able to push certain events to New Relic logs. I can even see Wordfence alerts and user logins coming in which is awesome! 

Great plugin!

Capture and log events, metrics and traces on your site. Make WordPress observable - finally!

Site Add-on Watchdog vs DecaLog