ldebrouwer

<p>An up-to-date WordPress installation is as safe as it can be, plugins however can often pose a security risk because they’re not maintained by hundreds of contributors. A plugin is as secure as the security knowledge of the developer allows it to be. In some cases this creates loopholes for exploits. WP Plugin Security Check checks plugins for bad practices and possible security holes limiting the risk of a compromised WordPress installation to a ‘hate to say I told you so’.</p>


WP Plugin Security Check

WP Plugin Security Check checks if your WordPress plugins are 'safe'.

Mike Miler

repat

henkwhite

<p>Visual regression testing for WordPress: catch broken layouts after auto-updates, plugin installs, or deploys before your visitors do.</p>
<h3>Find visual bugs before your visitors do</h3>
<p>Every time WordPress core, a plugin, or a theme updates, something on your site can quietly break. By the time a visitor reports it, you have already lost trust and probably sales.</p>
<p>WebChange Detector takes a screenshot of your pages <strong>before</strong> the change, another <strong>after</strong>, and tells you exactly what is different on desktop and mobile. The AI check ignores moving parts like sliders, carousels, and animations, so you only get alerts that actually matter.</p>
<h3>What is visual regression testing?</h3>
<p>Visual regression testing is the practice of taking a screenshot of a web page in a known-good state, then comparing a new screenshot to it after any change like an update, a deploy, a CSS tweak, or a plugin install. Anything that looks different is flagged.</p>
<p>It is the fastest way to catch layout breakage that traditional testing like PHP errors or broken links cannot see, because the page can render “successfully” while still looking wrong to a human visitor. WebChange Detector brings this practice to WordPress with one-click setup, no headless-browser scripting, and no Selenium or BackstopJS know-how required.</p>
<h3>What you can detect</h3>
<ul>
<li>Layout breaks after <strong>WordPress updates</strong> (core, plugins, themes)</li>
<li>Side effects of <strong>installing or activating a new plugin</strong></li>
<li>Visual regressions after <strong>deployments, CSS edits, or pagespeed tweaks</strong></li>
<li>Silent breakage from <strong>third-party scripts, fonts, or external APIs</strong></li>
<li><strong>Hacks, defacement, or injected ads</strong> during continuous monitoring</li>
<li>Theme regressions after switching themes or updating a child theme</li>
<li>Block library or page-builder breakage (Gutenberg, Elementor, Divi, Beaver Builder, Bricks)</li>
<li>Mobile-only layout issues that you would never see on desktop</li>
<li>Scheduled monitoring checks from every 15 minutes up to once per month</li>
<li>Quiet times when monitoring gets skipped to save check credits</li>
</ul>
<h3>Three ways to detect changes</h3>
<p>WebChange Detector gives you three independent check modes. Use one, two, or all three side by side, depending on how you manage your site.</p>
<p><strong>1. Auto Update Checks: automatic safety net for WordPress auto-updates.</strong><br />
This mode hooks directly into the WordPress auto-update system. Right before WordPress installs a core, plugin, or theme update automatically, WebChange Detector takes a “before” screenshot of the pages you selected. Right after the native WordPress auto-update finishes, it takes the “after” screenshot. If anything changed visually you get an email with the affected pages highlighted, plus an AI summary of what looks different. This is the mode that lets you actually leave WordPress auto-updates turned on without losing sleep.</p>
<p><strong>2. On-Demand Checks: visual diffs on your own schedule.</strong><br />
Run a check on demand right before and right after any change you make: a deploy, a plugin install, a CSS tweak, a theme switch, a hosting migration. On-demand checks are perfect for teams that already have an update workflow in tools like <strong>MainWP, ManageWP, WP Umbrella, InfiniteWP, or WP Remote</strong>. Use those tools to push your updates, and use WebChange Detector to verify visually that nothing broke. The plugin captures the pre-state, you push your changes, you trigger the post-state, and you get a side-by-side diff.</p>
<p><strong>3. Monitoring: continuous visual surveillance with alerts.</strong><br />
Schedule recurring checks at fixed intervals. The plugin captures and compares your selected pages on schedule, and emails you the moment a difference appears. Monitoring catches changes that nobody on your team pushed: hacks, defacement, expired SSL, third-party-script breakage, broken CDN assets, accidental edits, server-side issues, theme regressions, vendor outages. It is your “site is silently broken” alarm.</p>
<p>You can mix all three. A typical agency setup: auto-update checks on every client site so nothing breaks silently during automated WordPress updates, monitoring at 24h intervals on the same selection, and on-demand checks fired from the agency’s MainWP or ManageWP dashboard before scheduled maintenance windows.</p>
<h3>Features</h3>
<ul>
<li>Automatic cookie banner opt-in to load all content which is blocked initially.</li>
<li>Hiding ads that might cause changes on every check.</li>
<li>AI classification of whether a change is an actual change or just a moving element.</li>
<li>Train the AI to recognize intentional changes like A/B tests so specific patterns get ignored.</li>
<li>Smart shift detection: if your hero section gets taller, we don’t flag the entire page below it as ‘changed’.</li>
<li>Check desktop and mobile screen sizes.</li>
<li>Pausing dynamic content like sliders, carousels, GIFs, videos, etc. before taking screenshots.</li>
<li>Trigger lazy load elements before starting the visual regression testing.</li>
<li>Check browser console logs for new errors to detect errors like a broken contact form.</li>
<li>WPML and Polylang support.</li>
<li>WP Multisite support.</li>
<li>Publicly accessible link to a change detection to share with your agency or developer.</li>
<li>Basic Auth support to check websites behind a password.</li>
<li>Static IP proxy to whitelist the IP in a firewall which blocks other users.</li>
</ul>
<h3>Why site owners and agencies pick WebChange Detector</h3>
<ul>
<li><strong>Works on staging, password-protected, and firewalled sites.</strong> Basic-auth credentials and an optional static IP for firewall whitelisting come built in. Most visual-regression plugins refuse to run on anything that is not public.</li>
<li><strong>Free plan with 10 monthly checks.</strong> On-demand checks, auto-update checks, and the API are all included; no paywall on the core workflow.</li>
<li><strong>AI-powered noise filtering.</strong> Sliders, counters and other randomized content are filtered out automatically so you stop drowning in false positives.</li>
<li><strong>Built for multisite.</strong> Network-activated or per-site, with sub-site allowances so agencies can hand each client a controlled slice of features.</li>
<li><strong>WPML and Polylang ready.</strong> Each language version is synced and checked separately.</li>
<li><strong>Share results without giving WP access.</strong> Every comparison has a public link you can paste into Slack or send to a designer.</li>
<li><strong>Desktop and/or mobile in every check.</strong> Choose which screen size(s) you want to check per site.</li>
</ul>
<h3>How it works</h3>
<ol>
<li>Install the plugin and create a free account from inside WordPress.</li>
<li>Pick the pages you want watched (posts, pages, custom post types, taxonomies, custom URLs).</li>
<li>Pick your check mode: auto-update checks, on-demand checks, monitoring, or any combination.</li>
<li>Get an email alert with the changed pages highlighted. Open the slider view to compare before/after, mark the result Ok / To Fix / False Positive, and share the link with your team.</li>
</ol>
<h3>Manual QA vs. automated visual regression testing</h3>
<p>Most WordPress site owners check their site after an update by clicking through a few pages and trusting their memory. That works until it does not.</p>
<p>A manual click-through covers only the pages you happen to remember, takes 10 to 60 minutes per round, almost never includes the mobile viewport, and depends on your eyes catching pixel shifts that the human visual system is genuinely bad at. The output, when something does break, is usually a panicked Slack message after a customer noticed first.</p>
<p>WebChange Detector checks every URL you selected, every single time, on desktop <em>and</em> mobile, in seconds. It runs unattended while you sleep (in monitoring and auto-update modes), and produces a public side-by-side comparison link you can paste straight to a designer or developer.</p>
<p>Manual QA is fine for one-off changes. WebChange Detector pays for itself the first time an auto-update silently breaks a checkout button at 3 a.m.</p>
<h3>Who is WebChange Detector for?</h3>
<p><strong>Site owners and freelancers</strong> who do not want to spend half a Sunday afternoon clicking through 30 pages after the WordPress auto-update ran.</p>
<p><strong>Agencies and maintenance providers</strong> running MainWP, ManageWP, WP Umbrella, InfiniteWP, or WP Remote across dozens or hundreds of client sites. WebChange Detector slots into your existing update workflow as the visual-verification layer those tools do not provide on their own.</p>
<p><strong>WooCommerce and shop owners</strong> who cannot afford a broken checkout, cart, or product page after a WooCommerce or payment-gateway update.</p>
<p><strong>Publishers and news sites</strong> that release content many times a day on top of fragile templates and ad scripts.</p>
<p><strong>SaaS and lead-gen teams</strong> running landing-page experiments where every CRO test carries layout risk.</p>
<p><strong>Multilingual sites</strong> running WPML or Polylang where breakage often hides in non-English language versions.</p>
<p><strong>Multisite networks</strong> where one update can ripple across dozens of sub-sites and a single dashboard view is the only way to stay sane.</p>
<h3>Compatibility</h3>
<p>WebChange Detector renders the front-end of your site through a real browser, so anything that renders for a human visitor renders for our screenshot engine. We are tested with:</p>
<ul>
<li><strong>Page builders</strong>: Gutenberg, Elementor, Divi, Beaver Builder, Oxygen, Bricks, GenerateBlocks, Cwicly, Spectra, Stackable.</li>
<li><strong>Themes</strong>: Astra, GeneratePress, Kadence, Blocksy, Hello, Divi, Avada, Storefront, and any well-coded theme.</li>
<li><strong>WooCommerce</strong>, EDD, MemberPress, LearnDash, BuddyBoss, bbPress, and most WordPress ecosystems.</li>
<li><strong>Caching plugins</strong>: WP Rocket, W3 Total Cache, LiteSpeed Cache, WP Super Cache, FlyingPress.</li>
<li><strong>Multilingual</strong>: WPML, Polylang.</li>
<li><strong>Hosts</strong>: works on shared hosting, VPS, managed (Kinsta, WP Engine, SiteGround, Pressable, Cloudways), and on-premise.</li>
</ul>
<h3>Trial plan</h3>
<ul>
<li><strong>1,000 checks during your 14-day trial</strong></li>
<li>Use and test all features mentioned above</li>
</ul>
<h3>Free plan</h3>
<p>After the trial, you are automatically switched to our free plan with some restrictions:<br />
* 10 checks per month<br />
* No browser console log errors</p>
<h3>Premium plans</h3>
<p>Need more checks and all features unlocked? See the pricing page at <a href="https://www.webchangedetector.com/pricing/" rel="nofollow ugc">webchangedetector.com/pricing</a>.</p>
<h3>Privacy and data</h3>
<p>Screenshots are taken from our servers only for publicly available sites or sites you give access to via our proxy or basic auth. We never inject anything into your site or load any styles or scripts on the public site. We operate under GDPR.</p>
<h3>About WebChange Detector</h3>
<p>WebChange Detector started because we kept finding client sites broken after updates. We first built it for our own web agency. Now we help other agencies catch problems before their clients do.</p>


WebChange Detector: Visual Regression Testing & Visual Checks After Updates


I'm tracking a bunch of website changes with this tool. It's affordable and saves me time by automatically checking if stuff broke after updates, especially plugins.


Super Useful

Visual regression testing for WordPress: catch broken layouts after auto-updates, plugin installs, or deploys before your visitors do.

WP Plugin Security Check vs WebChange Detector: Visual Regression Testing & Visual Checks After Updates