WordPress plugin
The UpHeron Vulnerability Monitoring plugin watches a WordPress site from the inside. It reports exactly what the site runs, so UpHeron can alert the day a vulnerability is published for any of it. Download it from the plugin's page.
It is free and needs no account. A site watched by the plugin never uses one of a plan's monitors, also after it joins an account.
What it watches
- Vulnerabilities. WordPress core, every installed plugin and theme (active or not, premium ones included), PHP, MySQL or MariaDB, and the web server. The plugin reports them right after it starts, a minute after anything is installed, updated or removed, and once a day. UpHeron checks them daily against WPVulnerability, WordPress's own security advisories, the CVE Program, NVD, OSV, CISA's list of exploited vulnerabilities and endoflife.date.
- Uptime. UpHeron checks every five minutes that the site is up and how fast it answers, and keeps 90 days of history, outages, and certificate and domain expiry.
- Alerts. A bar at the top of wp-admin lists open issues, most urgent first, with the version that fixes each. Emails go to the site's admin address once it is confirmed. New sites alert on high and critical vulnerabilities; exploited ones and releases that lose support always alert.
Install it
- Download the zip from the plugin's page.
- In wp-admin, open Plugins → Add New Plugin → Upload Plugin, choose the zip, press Install Now, then Activate.
- Confirm the email UpHeron sends to the site's admin address.
On a production site UpHeron starts watching within seconds of activation. Staging, development and local copies start only when an administrator presses Start monitoring in Settings → UpHeron. UpHeron reads a one-time code from the site's /wp-json/upheron/v1/verify route while it registers, which proves the request came from the site.
The plugin and the website scan
A website monitor in the dashboard can also alert on vulnerabilities in the site's software (software lists). From the outside, a scan sees only what the site shows publicly: often WordPress and some plugins, without their versions. The plugin reports every plugin and theme with its exact version, so the alerts are exact. The dashboard suggests the plugin on monitors of WordPress sites.
With an UpHeron account
Settings → UpHeron → "Manage in the UpHeron dashboard" adds the site to an account, with its history: its alerts then follow the workspace's contacts (Slack, Teams, webhooks and more), and the site can appear on status pages next to your other monitors. This is optional; the plugin keeps working without an account.
Visitors and the status page
The [upheron_status] shortcode shows visitors whether the site is online, its uptime and a bar per day. The plugin also publishes the site's status page on upheron.com, which the widget links to; both can be turned off on the plugin's Uptime tab.