Know when a plugin on your site gets a known vulnerability.

Yes, and it needs no account. A site watched by the plugin doesn't use any UpHeron plan's monitors, also once you add it to an account.

To check that it's up, and once while registering, to read a one-time code from the plugin's verify route. That proves the request came from your site. Sites on your computer, behind a login wall or behind a firewall that blocks unknown visitors can't be verified; Settings → UpHeron says what went wrong and tries again every day.

Yes, if you add the [upheron_status] shortcode to a page: it shows the site's state, its uptime and a bar per day. Nothing is shown to visitors unless you add it. It links to the site's public status page on upheron.com unless you turn "Show link to status page on upheron.com" off on the Uptime tab.

Every five minutes, from the internet, by UpHeron's servers. The Uptime tab shows the results; the uptime history goes back 90 days.

In wp-admin, users who can manage the site's options (administrators). Each of them can hide alerts for themselves, and choose in Settings → UpHeron where the alert bar appears and the lowest severity it shows. By email, the address you set in Settings → UpHeron, once it's confirmed.

Settings → UpHeron lists the hidden alerts under the open ones, with "Show in alerts" for each and "Show all in alerts again". A hidden alert also comes back by itself if it gets worse.

The alert disappears from the bar as soon as the fixed version is installed. The plugin then reports the update to UpHeron about a minute later, and UpHeron confirms the fix within seconds.

No, so deactivating plugins to find a problem doesn't lose the site's history. Press Stop monitoring in Settings → UpHeron, or delete the plugin. A site that sends no report for 30 days is removed by UpHeron, after an email a week before.

The plugin only starts by itself on production sites, so a staging copy doesn't get a monitor of its own unless you press Start monitoring. A copy at another address never uses the original site's access token.

Yes. The main site starts by itself; each other site that should be watched starts on its own, with its own monitor.

This plugin is the WordPress side of UpHeron (https://upheron.com), a monitoring service operated by Symelo LTD. When the plugin is activated on a production site, it starts using UpHeron by itself: activating the plugin is how you agree to it. On staging, development and local sites (wp_get_environment_type()), on network sites other than the main one, and when UPHERON_AUTO_REGISTER is false, nothing is sent until an administrator presses "Start monitoring" in Settings → UpHeron. All requests go from your server to upheron.com/api/v1/wordpress over HTTPS and identify themselves with an UpHeron-WordPress/<version> user agent that includes your site's address.

• Registering. A few seconds after activation (or after "Start monitoring"), the plugin sends your site's address and name, the site's admin email address (for the alerts), the address of the plugin's verify route, and the versions of WordPress, PHP and the plugin. UpHeron then reads a one-time code from /wp-json/upheron/v1/verify on your site, which proves the request came from your site, and the plugin collects the site's access token. If the site moves to another address, the plugin registers the new one.
• Reports. Right after registering, a minute after plugins, themes or WordPress are installed, updated, activated, deactivated or deleted, and once a day, the plugin sends: your site's address and name, the plugin's version, the versions of WordPress, PHP, the database server and the web server, and the folder name, file name, name, version and active state of every installed plugin and theme.
• Findings. The plugin reads the site's open findings and status from UpHeron when its settings screen opens, a few times after a report while UpHeron checks it, and once a day. Only the site's access token is sent.
• Uptime. The plugin reads the site's uptime from UpHeron (its state, response times, uptime history, outages and certificate and domain expiry) when the Uptime tab opens, at most every five minutes in the background while the status shortcode or the Dashboard box is shown, and once a day. Only the site's access token is sent. The shortcode shows visitors this stored copy; their browsers never contact UpHeron.
• Email alerts. UpHeron emails the alert address once it is confirmed. Changing the address or the alert settings in Settings → UpHeron sends them to UpHeron. "Manage in the UpHeron dashboard" opens upheron.com, where you can add the site to an account.
• Stopping. Pressing Stop monitoring, or deleting the plugin, tells UpHeron to stop accepting the token. A site without an UpHeron account is then deleted at UpHeron with its history; a site in an account keeps its monitor there. Deactivating the plugin sends nothing.
• Status page. Right after registering (and once a day until it exists), the plugin asks UpHeron to publish the site's status page on upheron.com, which shows the site's name, whether it's online and its uptime; the status widget links to it. Turn off "Show link to status page on upheron.com" on the Uptime tab before it's published to keep it unpublished, or press "Remove" next to it on the Settings tab to delete it.
• Uptime checks. While UpHeron watches the site, its own servers request your site's address every five minutes to check that it is up and how fast it answers. This doesn't involve the plugin.

The plugin never sends your content, users, customers, orders, settings or passwords. The vulnerability databases are queried by UpHeron, never by your site.

UpHeron Terms of Service, Privacy Policy.

• define( 'UPHERON_AUTO_REGISTER', false ); or the upheron_auto_register filter: don't start monitoring by itself (default: production sites, main site of a network).
• upheron_capability (filter): capability needed to start and stop monitoring, change alerts and see findings (default manage_options).
• upheron_http_timeout (filter): timeout of requests to UpHeron in seconds (default 15).
• upheron_registering (action): the plugin asked UpHeron to watch the site.
• upheron_reported (action): after UpHeron accepted a report.
• upheron_connection_lost (action, $message, $in_account): UpHeron stopped accepting the site's token (removed from its account, or by UpHeron after a month without reports).
• upheron_more_from_symelo (filter): products listed under "More from Symelo LTD" on the Support tab.
• define( 'UPHERON_API', 'http://localhost:3000/api/v1/wordpress' ); points the plugin at a development copy of UpHeron.

Shortcode: [upheron_status], as set on the Uptime tab. Attributes override that on one page: days (7 to 90), show (any of status,uptime,bars,response,incidents), title, style (card or badge) and branding (yes or no, the UpHeron logo with a link to the site's status page).

REST API for administrators under /wp-json/upheron/v1/: status, findings, refresh, uptime (?refresh=1), report, inventory, alerts, settings, email-alerts, email-alerts/resend, start, start/collect, stop, claim. verify is public: UpHeron reads the one-time code from it while the site registers.

WP-CLI: wp upheron status, wp upheron uptime [--refresh], wp upheron start, wp upheron stop, wp upheron report, wp upheron findings [--refresh].