What is vulnerability monitoring in WordPress?

Vulnerability monitoring checks the plugins, themes and WordPress version on your site against a database of known security flaws. When one of them has a weak spot, you get an alert that names it and says how serious it is. You can then update it before someone uses the flaw to get into your site.

What is a WordPress vulnerability?

A vulnerability is a flaw in the code of WordPress itself, a theme or a plugin that an attacker could use. It isn't a hack yet: that only happens with an exploit, when someone actually takes advantage of the flaw. In the worst case, an attacker could use it to upload malware to your site or get into it. A vulnerability is usually fixed with an update from the developer.

WordPress is one of the most popular tools for building websites. Much of what a WordPress website can do comes from the thousands of themes and plugins available for it. That popularity is also a security risk, because it makes WordPress a tempting target for attackers.

Attacks target your software, not you

When a new WordPress version fixes a flaw, the information needed to exploit that flaw is almost always public too. That makes older versions easier to attack, whoever runs the site. In Patchstack's research on WordPress security, the vulnerabilities attackers go after most are typically exploited within hours. So the size of your business doesn't protect you, and what counts is the version your site runs. Keep it up to date, so your site doesn't keep running a version with a flaw that an update has already fixed.

How vulnerability monitoring works

The monitoring looks up the version your site runs of WordPress, and of every installed theme and plugin, in a database of known vulnerabilities. When it finds a match, it sends you a report. Our Vulnerability Monitor, for example, emails you the issues it found with their risk level and the version that fixes each one.

The severity of a flaw can be given as a CVSS score, short for Common Vulnerability Scoring System. Scores run from 0.0 to 10.0, and the higher the score, the more severe the flaw. The scale sorts the scores into five ratings, and our advice on how quickly to act depends on the rating:

• None (0.0): nothing for you to do.
• Low (0.1 to 3.9): fix it with your next round of updates.
• Medium (4.0 to 6.9): don't leave it for long, and plan the update this week.
• High (7.0 to 8.9): update as soon as you can, ideally the same day.
• Critical (9.0 to 10.0): act straight away, even if that means switching the plugin off until a fix is out.

Why WordPress sites need vulnerability monitoring

The theme and plugins on your site, from a contact form to an online shop, are code written by developers. They are updated to add features and keep them secure, but new flaws can appear in any of them.

It's hard to judge the security of every developer's code yourself, and you don't need to. The monitoring keeps watch for you and tells you when something needs fixing.

How to fix WordPress vulnerabilities

When an alert names a plugin, deal with it in this order:

1. Make sure you have a current website backup, so you can go back if an update causes problems.
2. Open Plugins in your WordPress dashboard and look for the plugin the alert names. The plugin's entry in the list then includes a line reading “There is a new version” when an update is out.
3. If a new version is available, click update now to update the plugin.
4. If no new version fixes the flaw yet, click Deactivate to switch the plugin off.
5. If no new version fixes the flaw yet, click Delete to remove the deactivated plugin, and replace it with a maintained plugin that does the same job if you still need one.

A theme alert follows the same order, on the Themes screen in your dashboard, where Update now installs the new version. If no fix is out yet, click Activate on another theme to make it your current theme, then delete the affected one.

If the alert names your WordPress version, back up your site first, as in step 1. Then update WordPress itself from the link in the new version banner or from the Updates screen under Dashboard, and click Update Now on the Update WordPress page.

With Managed Hosting for WordPress, we update WordPress, your themes and plugins, and fix detected vulnerabilities for you with an update, where one exists, once you switch automatic fixes on.

How to lower the risk of vulnerabilities

Monitoring on its own only tells you about a flaw. An update usually closes it, and a backup gets your site back if something goes wrong. These habits keep the number of weak spots on your site down:

• Delete the themes and plugins you no longer need, rather than only switching them off. Every one you remove is one less that can have a flaw.
• Choose plugins and themes that are still maintained. Look for ones that receive regular updates, so a fix arrives when a flaw is found.
• Get them from trusted sources only. Stick to the WordPress.org directory or well-known developers, and stay away from "nulled" copies of paid themes or plugins that other sites offer for free.
• Keep a recent website backup, so you can go back if an update breaks something.
• Keep everything up to date, and update WordPress, your themes and your plugins as new versions come out, not only when an alert arrives.

Strong passwords, two-factor authentication and user roles matter too. Our WordPress security guide lists more measures you can take.

What if your WordPress site has already been hacked?

If someone has already used a flaw to get in, clean your site and close the gap before anything else, because monitoring can't undo a break-in. The WordPress.org guide for hacked sites shows you how to fix a hacked WordPress site. It takes you from noting what you see and changing your passwords to restoring a backup. Once your site is clean, it has you update WordPress.

Should you monitor your site yourself or use Managed Hosting for WordPress?

Monitor your site yourself if you're happy to run the updates when an alert arrives. Choose Managed Hosting for WordPress if you'd rather we ran them for you. The Lite version of our Vulnerability Monitor is part of our plugin. When you set up WordPress with our 1-click installer, the plugin is installed automatically, and if you installed WordPress another way, you can install it yourself. You'll find the monitor's settings in WP Admin, in the Health Monitor section of our plugin. With Lite, you get the alerts by email and the updates are then up to you.

With Managed Hosting for WordPress, the Pro version fixes detected vulnerabilities with updates for you, where an update exists, and you get an email about the results. Its monitoring is powered by Patchstack. You switch the automatic fixes on in the plugin's settings. For a plugin with no fix yet, steps 4 and 5 above still apply.

Hosting for WordPress and Managed Hosting for WordPress compared

If you check your email regularly and you're happy to run the updates yourself, Hosting for WordPress and the alerts are enough. If you'd rather not keep an eye on alerts and updates, Managed Hosting for WordPress is the better fit. With it, we run those updates for you, check your site visually after each one and roll it back if something looks wrong.

If you'd rather hand over the updates and fixes, see what's included with Managed Hosting for WordPress.