aaronhsieh

<p>Site Add-on Watchdog keeps an eye on your site’s plugins and warns you when:</p>
<ul>
<li>Your installed version is two or more minor releases behind the directory build.</li>
<li>The official changelog mentions security or vulnerability fixes.</li>
<li>(Optional) WPScan lists open CVEs for the plugin when you provide your own API key.</li>
</ul>
<p>The plugin runs on a schedule you control—choose daily, weekly, a twenty-minute testing cadence, or rely on manual scans—and stores results locally. Nothing leaves your site unless you explicitly configure outgoing notifications.</p>
<h3>Privacy first</h3>
<ul>
<li>No plugin inventory or telemetry is ever sent off-site by default.</li>
<li>Optional webhooks are opt-in and only post the detected risks.</li>
<li>WPScan lookups only run when you add your personal API token.</li>
</ul>
<h3>Admin tools</h3>
<ul>
<li>Dashboard page with the current risk list and manual scan button.</li>
<li>Ignore list to suppress noisy plugins.</li>
<li>Notification settings for email, Discord, Slack, Microsoft Teams, or a generic webhook.</li>
</ul>
<h3>Notifications</h3>
<ul>
<li>Email: send to one or more recipients (comma separated).</li>
<li>Discord: post to a channel via webhook.</li>
<li>Slack: connect via an incoming webhook to post alerts into any workspace channel.</li>
<li>Microsoft Teams: send adaptive card style notices through an incoming webhook connector.</li>
<li>Generic webhook: post JSON payload to any endpoint you control, with optional HMAC signatures. Failed deliveries are logged and highlighted on the Watchdog admin screen so you can reconfigure or resend manually.</li>
</ul>
<h3>Troubleshooting</h3>
<h3>Scheduled scans are not running</h3>
<p>Watchdog relies on WP-Cron to trigger scheduled scans and notifications. If you have set <code>DISABLE_WP_CRON</code> to <code>true</code> or your site receives very little traffic (so WP-Cron rarely runs), configure a system cron job to call either <code>wp-cron.php</code> or the plugin’s REST endpoint. The admin <strong>Delivery health</strong> panel lists the REST URL you can target; a typical example looks like this:</p>
<pre><code>curl -X POST https://example.com/wp-json/site-add-on-watchdog/v1/cron
</code></pre>
<p>Testing-mode notifications also rely on this trigger, so be sure your cron job is running when validating delivery.</p>
<h3>CLI Usage</h3>
<p>Watchdog bundles a WP-CLI command so you can run scans outside of the WordPress admin. All examples below assume the command is executed from a shell where <code>wp</code> (WP-CLI) is available.</p>
<pre><code>wp watchdog scan [--notify=<bool>]
</code></pre>
<ul>
<li><code>--notify</code> (optional): Accepts <code>true</code> or <code>false</code> (defaults to <code>true</code>). When set to <code>false</code>, Watchdog will skip any configured email or webhook notifications and only record the scan locally.</li>
</ul>
<p>Examples:</p>
<ul>
<li>Run a scan and send notifications (default): <code>wp watchdog scan</code></li>
<li>Run a scan silently (skip notifications): <code>wp watchdog scan --notify=false</code></li>
</ul>
<p>Recommended workflow: on CI/CD platforms, add a job step that boots your WordPress/WP-CLI container, runs pending database migrations if needed, and then calls <code>wp watchdog scan --notify=false</code> to verify the plugin state without spamming production channels. Promote to production by rerunning the same command with notifications enabled when you are ready to alert your team.</p>
<h3>Development</h3>
<p>The development repository is available on GitHub: https://github.com/happyloa/Site-Add-on-Watchdog. Clone it locally to review the source or run the test suite.</p>


Site Add-on Watchdog

Monitor installed plugins for security notices, outdated releases, and WPScan disclosures without leaking your site's plugin inventory.

pluginventoryteam

<p>Pluginventory is the lightweight connector plugin that links your WordPress site to your Pluginventory account. Once installed and paired, it sends a daily signed report so you can see every plugin across every site you manage — all in one place. Rest easy: it can’t change or update your plugins but is only used for reporting.</p>
<p><strong>Perfect for agencies and freelancers managing multiple WordPress sites.</strong></p>
<p>If you manage more than a few WordPress sites, it’s easy to forget which plugins are running where — especially when clients can install anything themselves. And when a site goes down, plugins are almost always the reason: Patchstack’s 2026 security report found that 91% of new WordPress vulnerabilities came from plugins, not themes.</p>
<p>Managing plugins across multiple sites on different servers makes this even harder. Without the right tool, you’re either logging into each one, or finding out something’s wrong when a client calls.</p>
<p>Pluginventory gives you a single dashboard to see every plugin across every WordPress site you manage. Search any plugin instantly. Spot what’s outdated, inactive, or recently added. Know exactly where to act — without logging into a single site or compromising your security.</p>
<p><a href="https://app.pluginventory.com/demo" rel="nofollow ugc">See a live demo</a></p>
<h4>What it does</h4>
<ul>
<li>Sends a daily HMAC-signed report of your installed plugins, their versions, active/inactive status, and available updates — transmitted over HTTPS</li>
<li>Lets you trigger an on-demand report at any time from the Pluginventory dashboard or directly from your WordPress admin</li>
<li>Works on single-site and multisite (subdomain and subdirectory) WordPress installs</li>
<li>Fully supports network-wide activation with a dedicated Network Admin settings screen for bulk pairing and reporting</li>
</ul>
<h4>What it does NOT do</h4>
<ul>
<li>It cannot install, update, activate, deactivate, or delete any plugins on your site</li>
<li>It does not collect or transmit any personally identifiable information</li>
<li>It does not run any code on your site’s front end</li>
</ul>
<h4>How it works</h4>
<ol>
<li>Install and activate this plugin on your WordPress site</li>
<li>Log in to your Pluginventory account at app.pluginventory.com</li>
<li>Generate an Install Token from your account page</li>
<li>Paste the token into the Pluginventory settings screen and click Pair Site</li>
<li>Your site is now connected — reports will be sent automatically every day</li>
</ol>
<h4>Security</h4>
<p>All reports are authenticated with an HMAC-SHA256 signature using a secret that is unique to your site and generated at pairing time. Your Pluginventory account verifies this signature before accepting any report. Tokens are stored as WordPress options and are never exposed in your site’s HTML or source. All communication requires HTTPS — non-HTTPS App URLs are blocked.</p>
<h4>Multisite support</h4>
<p>When network-activated, Pluginventory adds a Network Admin > Settings > Pluginventory screen where you can:</p>
<ul>
<li>Set shared App URL and Install Token defaults for all subsites</li>
<li>Bulk pair all subsites with one click</li>
<li>Bulk send reports for all subsites</li>
<li>Pair or trigger individual subsites from the same screen</li>
</ul>
<h3>Privacy Policy / External Service Disclosure</h3>
<p>This plugin transmits data to an external service (Pluginventory) in order to function. This section discloses what data is sent, when, where, and why — as required by WordPress.org plugin guidelines.</p>
<h4>What data is sent</h4>
<p>When a report is triggered (automatically or manually), the following data is transmitted:</p>
<p>Site-level data:</p>
<ul>
<li>Your site’s URL (home URL) and site name</li>
<li>A stable per-install UUID (generated locally, used to identify your WordPress installation)</li>
<li>A timestamp of when the report was generated</li>
<li>PHP version running on your server</li>
<li>WordPress version, and whether a core update is available (including the available version number)</li>
<li>Database server version</li>
<li>WordPress memory limit setting</li>
<li>Environment type (production, staging, development, or local)</li>
<li>Active theme name, version, slug, and whether it is a child theme (including parent theme name if applicable)</li>
<li>On multisite installs: network ID and blog ID</li>
</ul>
<p>Per-plugin data (for each installed plugin):</p>
<ul>
<li>Plugin name, slug, file path, and version</li>
<li>Active or inactive status</li>
<li>Whether an update is available, and the latest available version if applicable</li>
<li>Plugin author name</li>
<li>Minimum PHP and WordPress version requirements declared by the plugin</li>
<li>Plugin URI (homepage URL declared by the plugin)</li>
<li>Approximate install or last-update date (based on file modification time)</li>
</ul>
<p>No usernames, email addresses, passwords, post content, or any personally identifiable information is ever included in reports.</p>
<h4>When data is sent</h4>
<p>Data is only sent after you have completed the pairing process by entering a valid Install Token and clicking Pair Site. Before pairing, no data leaves your site. After pairing, data is sent:</p>
<ul>
<li>Once per day via a scheduled WordPress cron event</li>
<li>Immediately when you click Send Test Report in the settings screen</li>
<li>When triggered remotely from your Pluginventory dashboard using the Remote Trigger Token</li>
</ul>
<h4>Where data is sent</h4>
<p>Data is sent to the Pluginventory service at the App URL you configure during pairing (default: https://app.pluginventory.com). Reports are POSTed to {App URL}/webhook/report and pairing requests are sent to {App URL}/webhook/pair. All requests require HTTPS.</p>
<h4>Third-party service information</h4>
<ul>
<li>Service: Pluginventory</li>
<li>Website: https://pluginventory.com</li>
<li>Privacy Policy: https://pluginventory.com/privacy</li>
<li>Terms of Service: https://pluginventory.com/terms</li>
</ul>


Pluginventory

Know exactly which plugins run across your WordPress portfolio — search any plugin instantly and catch problems before a site breaks.

Site Add-on Watchdog vs Pluginventory