aaronhsieh

<p>Site Add-on Watchdog keeps an eye on your site’s plugins and warns you when:</p>
<ul>
<li>Your installed version is two or more minor releases behind the directory build.</li>
<li>The official changelog mentions security or vulnerability fixes.</li>
<li>(Optional) WPScan lists open CVEs for the plugin when you provide your own API key.</li>
</ul>
<p>The plugin runs on a schedule you control—choose daily, weekly, a twenty-minute testing cadence, or rely on manual scans—and stores results locally. Nothing leaves your site unless you explicitly configure outgoing notifications.</p>
<h3>Privacy first</h3>
<ul>
<li>No plugin inventory or telemetry is ever sent off-site by default.</li>
<li>Optional webhooks are opt-in and only post the detected risks.</li>
<li>WPScan lookups only run when you add your personal API token.</li>
</ul>
<h3>Admin tools</h3>
<ul>
<li>Dashboard page with the current risk list and manual scan button.</li>
<li>Ignore list to suppress noisy plugins.</li>
<li>Notification settings for email, Discord, Slack, Microsoft Teams, or a generic webhook.</li>
</ul>
<h3>Notifications</h3>
<ul>
<li>Email: send to one or more recipients (comma separated).</li>
<li>Discord: post to a channel via webhook.</li>
<li>Slack: connect via an incoming webhook to post alerts into any workspace channel.</li>
<li>Microsoft Teams: send adaptive card style notices through an incoming webhook connector.</li>
<li>Generic webhook: post JSON payload to any endpoint you control, with optional HMAC signatures. Failed deliveries are logged and highlighted on the Watchdog admin screen so you can reconfigure or resend manually.</li>
</ul>
<h3>Troubleshooting</h3>
<h3>Scheduled scans are not running</h3>
<p>Watchdog relies on WP-Cron to trigger scheduled scans and notifications. If you have set <code>DISABLE_WP_CRON</code> to <code>true</code> or your site receives very little traffic (so WP-Cron rarely runs), configure a system cron job to call either <code>wp-cron.php</code> or the plugin’s REST endpoint. The admin <strong>Delivery health</strong> panel lists the REST URL you can target; a typical example looks like this:</p>
<pre><code>curl -X POST https://example.com/wp-json/site-add-on-watchdog/v1/cron
</code></pre>
<p>Testing-mode notifications also rely on this trigger, so be sure your cron job is running when validating delivery.</p>
<h3>CLI Usage</h3>
<p>Watchdog bundles a WP-CLI command so you can run scans outside of the WordPress admin. All examples below assume the command is executed from a shell where <code>wp</code> (WP-CLI) is available.</p>
<pre><code>wp watchdog scan [--notify=<bool>]
</code></pre>
<ul>
<li><code>--notify</code> (optional): Accepts <code>true</code> or <code>false</code> (defaults to <code>true</code>). When set to <code>false</code>, Watchdog will skip any configured email or webhook notifications and only record the scan locally.</li>
</ul>
<p>Examples:</p>
<ul>
<li>Run a scan and send notifications (default): <code>wp watchdog scan</code></li>
<li>Run a scan silently (skip notifications): <code>wp watchdog scan --notify=false</code></li>
</ul>
<p>Recommended workflow: on CI/CD platforms, add a job step that boots your WordPress/WP-CLI container, runs pending database migrations if needed, and then calls <code>wp watchdog scan --notify=false</code> to verify the plugin state without spamming production channels. Promote to production by rerunning the same command with notifications enabled when you are ready to alert your team.</p>
<h3>Development</h3>
<p>The development repository is available on GitHub: https://github.com/happyloa/Site-Add-on-Watchdog. Clone it locally to review the source or run the test suite.</p>


Site Add-on Watchdog

Monitor installed plugins for security notices, outdated releases, and WPScan disclosures without leaking your site's plugin inventory.

Daniel van der Velden

<p>The Viking Abandoned Monitor is a lightweight, admin-only WordPress plugin that helps you identify potentially abandoned or outdated plugins on your site. It scans all installed plugins and classifies them based on their last update date from the WordPress.org plugins API.</p>
<p><strong>Key Features:</strong></p>
<ul>
<li><strong>Automatic Plugin Scanning</strong>: Scans all installed plugins and checks their last update date via WordPress.org API</li>
<li><strong>Status Classification</strong>: Classifies plugins as Safe, Risk, or Abandoned based on configurable thresholds</li>
<li><strong>Dashboard Overview</strong>: Beautiful dashboard with summary cards and filterable plugin table</li>
<li><strong>Weekly Email Reports</strong>: Automatically sends weekly summary emails with top abandoned and risk plugins</li>
<li><strong>Optional Webhook Integration</strong>: Send data to external services like n8n (completely optional, disabled by default)</li>
<li><strong>WordPress.org Compliant</strong>: Fully compliant with WordPress.org guidelines, no deceptive behavior</li>
<li><strong>Lightweight</strong>: No external SDKs or bloat, uses WordPress core functions only</li>
<li><strong>Secure</strong>: Proper nonces, capability checks, and data sanitization</li>
</ul>
<p><strong>How It Works:</strong></p>
<ol>
<li>The plugin scans all installed plugins on your site</li>
<li>For each plugin, it attempts to resolve the WordPress.org slug (from PluginURI, UpdateURI, or folder name)</li>
<li>It fetches plugin information from WordPress.org API (with 48-hour caching to avoid rate limits)</li>
<li>Plugins are classified based on their last update date:
<ul>
<li><strong>Safe</strong>: Updated within the risk threshold (default: 6 months)</li>
<li><strong>Risk</strong>: Updated between risk and abandoned thresholds (default: 6-12 months)</li>
<li><strong>Abandoned</strong>: Not updated within abandoned threshold (default: 12+ months)</li>
<li><strong>Unknown</strong>: Could not be resolved or API error occurred</li>
</ul>
</li>
</ol>
<p><strong>Privacy & Data:</strong></p>
<ul>
<li>All plugin data is fetched from public WordPress.org API</li>
<li>Webhook functionality is completely optional and disabled by default</li>
<li>If webhook is enabled, you can choose to redact plugin details and send only summary counts</li>
<li>No data is sent anywhere unless explicitly configured by the site administrator</li>
</ul>


The Viking Abandoned Monitor

Scans installed plugins and classifies them as Safe / Risk / Abandoned based on last updated date.

Site Add-on Watchdog vs The Viking Abandoned Monitor