aaronhsieh

<p>Site Add-on Watchdog keeps an eye on your site’s plugins and warns you when:</p>
<ul>
<li>Your installed version is two or more minor releases behind the directory build.</li>
<li>The official changelog mentions security or vulnerability fixes.</li>
<li>(Optional) WPScan lists open CVEs for the plugin when you provide your own API key.</li>
</ul>
<p>The plugin runs on a schedule you control—choose daily, weekly, a twenty-minute testing cadence, or rely on manual scans—and stores results locally. Nothing leaves your site unless you explicitly configure outgoing notifications.</p>
<h3>Privacy first</h3>
<ul>
<li>No plugin inventory or telemetry is ever sent off-site by default.</li>
<li>Optional webhooks are opt-in and only post the detected risks.</li>
<li>WPScan lookups only run when you add your personal API token.</li>
</ul>
<h3>Admin tools</h3>
<ul>
<li>Dashboard page with the current risk list and manual scan button.</li>
<li>Ignore list to suppress noisy plugins.</li>
<li>Notification settings for email, Discord, Slack, Microsoft Teams, or a generic webhook.</li>
</ul>
<h3>Notifications</h3>
<ul>
<li>Email: send to one or more recipients (comma separated).</li>
<li>Discord: post to a channel via webhook.</li>
<li>Slack: connect via an incoming webhook to post alerts into any workspace channel.</li>
<li>Microsoft Teams: send adaptive card style notices through an incoming webhook connector.</li>
<li>Generic webhook: post JSON payload to any endpoint you control, with optional HMAC signatures. Failed deliveries are logged and highlighted on the Watchdog admin screen so you can reconfigure or resend manually.</li>
</ul>
<h3>Troubleshooting</h3>
<h3>Scheduled scans are not running</h3>
<p>Watchdog relies on WP-Cron to trigger scheduled scans and notifications. If you have set <code>DISABLE_WP_CRON</code> to <code>true</code> or your site receives very little traffic (so WP-Cron rarely runs), configure a system cron job to call either <code>wp-cron.php</code> or the plugin’s REST endpoint. The admin <strong>Delivery health</strong> panel lists the REST URL you can target; a typical example looks like this:</p>
<pre><code>curl -X POST https://example.com/wp-json/site-add-on-watchdog/v1/cron
</code></pre>
<p>Testing-mode notifications also rely on this trigger, so be sure your cron job is running when validating delivery.</p>
<h3>CLI Usage</h3>
<p>Watchdog bundles a WP-CLI command so you can run scans outside of the WordPress admin. All examples below assume the command is executed from a shell where <code>wp</code> (WP-CLI) is available.</p>
<pre><code>wp watchdog scan [--notify=<bool>]
</code></pre>
<ul>
<li><code>--notify</code> (optional): Accepts <code>true</code> or <code>false</code> (defaults to <code>true</code>). When set to <code>false</code>, Watchdog will skip any configured email or webhook notifications and only record the scan locally.</li>
</ul>
<p>Examples:</p>
<ul>
<li>Run a scan and send notifications (default): <code>wp watchdog scan</code></li>
<li>Run a scan silently (skip notifications): <code>wp watchdog scan --notify=false</code></li>
</ul>
<p>Recommended workflow: on CI/CD platforms, add a job step that boots your WordPress/WP-CLI container, runs pending database migrations if needed, and then calls <code>wp watchdog scan --notify=false</code> to verify the plugin state without spamming production channels. Promote to production by rerunning the same command with notifications enabled when you are ready to alert your team.</p>
<h3>Development</h3>
<p>The development repository is available on GitHub: https://github.com/happyloa/Site-Add-on-Watchdog. Clone it locally to review the source or run the test suite.</p>


Site Add-on Watchdog

Monitor installed plugins for security notices, outdated releases, and WPScan disclosures without leaking your site's plugin inventory.

Peter Booker

<p>PromPress tracks various website and WordPress related metrics for collection by <a href="https://prometheus.io/" rel="nofollow ugc">Prometheus</a>, which allows you to monitor your site’s performance and health. You can even setup dashboards with <a href="https://grafana.com/" rel="nofollow ugc">Grafana</a> and/or setup alerting via <a href="https://prometheus.io/docs/alerting/latest/alertmanager/" rel="nofollow ugc">Prometheus Alertmanager</a>.</p>
<p>(Note: Requires Object Caching via Redis to be active, so that the plugin can store metrics.)</p>
<p>We track a range of Website and WordPress specific metrics:</p>
<ul>
<li>Request Count</li>
<li>Request Duration</li>
<li>Request Peak Memory Usage</li>
<li>External Request Duration</li>
<li>Query Count</li>
<li>Query Duration</li>
<li>Plugin Updates</li>
<li>Theme Updates</li>
<li>Emails Sent</li>
<li>User Count</li>
<li>Post Count</li>
<li>Option Count</li>
</ul>
<p>This gives you the ability to monitor the performance of your website over time and get an early warning of potential problems, like your site sending a lot of emails or the post count increasing a lot.</p>
<p>We purposefully avoid general software and/or server level metrics which are better handled outside of the website, like detailed database metrics which is better handled via the <a href="https://github.com/prometheus/mysqld_exporter" rel="nofollow ugc">mysqld exporter</a>.</p>


PromPress

Monitor the performance and health of your site with Prometheus.

Site Add-on Watchdog vs PromPress