WordPress and WooCommerce Monitoring — What Exactly We Check

WordPress is detected automatically — there is no plugin to install and no login details to hand over. Alongside availability monitoring, MonitorWWW.com checks what most often leads to a WordPress breach: an outdated core, known vulnerabilities and files that should not be public.

Version and known vulnerabilities

• Core version — compared with the latest WordPress release.
• Vulnerabilities (CVE) — the installed version is checked against a database of known security flaws; a new flaw triggers an alert. You can also browse it publicly in our WordPress vulnerability database.
• Version exposure — the generator tag, readme.html and license.txt.

Installation security

• xmlrpc.php — whether it is reachable from outside.
• wp-config.php and its copies — .bak, .old and ~ files.
• User list — login enumeration through author URLs and the REST API.
• Debug mode — error messages on the page and a public wp-content/debug.log.
• wp-cron.php — whether it can be triggered from outside.
• Maintenance mode — a leftover .maintenance file after a failed update.

Environment and WooCommerce

• Theme, page builder and detected plugins — read from the page source.
• WooCommerce — store detection and a comparison of its version with the latest release.
• Cookies — Secure, HttpOnly and SameSite flags.

How often

We check availability every few minutes and run security probes several times a day, with random pauses between requests. The vulnerability database refreshes independently, so an alert about a new flaw arrives even when nothing on the site has changed.

Alerts

Email, SMS or Telegram: outages, an expiring certificate or domain, detected malware and a new known vulnerability in the installed WordPress version. Other findings are in the dashboard together with a fix for Apache and Nginx.

What we check on every site, regardless of platform

• Uptime and response time — HTTP status, load time, redirects, maintenance mode.
• SSL certificate and domain — certificate validity and domain expiry date, with an alert ahead of time.
• DNS — SPF, DMARC, MX and CAA records.
• Security headers — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cookie flags.
• Files that should not be visible — .env, .git, phpMyAdmin, backups, directory listing.
• Malware and PHP errors — suspicious code and error messages in the page content.
• Blacklists — whether the domain has been flagged as unsafe.
• Content changes — an optional keyword that must be present on the page.