Coming soon to ToggleWP: Vulnerability Monitor for Every Client Site

ByDave Grey

A plugin gets a security advisory. The next question is always the same: which of my sites run it, and at what version?

Vulnerability Monitor answers that question for you. It’s available soon in ToggleWP as two modules that work together:

  • Vulnerability Monitor runs on each client site.
  • Vulnerability Monitor Hub runs on your agency site.

Because you can’t always trust patch notes

My hosting clients with a managed plan have WP Umbrella + security add-on enabled, letting me hear fairly quickly when a plugin has potential problems. My basic WordPress hosting clients however don’t have additional paid services included as they are on a tight budget.

I don’t want their sites to get hacked as that would cause them more problems than they have the budget for, and they’d turn to me to fix it.

After receiving an alert for a plugin I checked its patch notes and nothing jumped out at me to make it sound urgent. Ordinarily I’d have left it till the next scheduled round of updates, but not this time as I already knew it had issues.

But what to do for my other sites? Adding extra paid services for 10+ sites would eat into my monthly revenue, and they wouldn’t really notice the difference.

I then remembered an idea I had a couple of years ago for my HeadsUpWP plugin, which was to use the WordFence API feed to get free alerts. In the interest of time, that’s now pulling down once a day to my Website Toolkit service, which ToggleWP will talk to when the big v2.0 release comes out in early Oct.

And now back to the main post….

How it works

  1. Each client site reports what it has installed. That means every plugin, every theme (including parent themes) and the WordPress version, with version numbers and whether each one is active.
  2. The report goes to your hub, not to the internet at large. Client sites send it over the same secure pairing that Settings Sync already uses.
  3. The hub checks each site against the Wordfence Intelligence vulnerability feed via the Website Toolkit service. That feed is refreshed in full every day (with webhooks sent for every new change in between), and it covers plugins, themes and WordPress core.
  4. You get one email for your whole portfolio, and only when something new turns up. There’s no separate alert per site and no daily “all clear”.

When sites report

  • Every day, with a full list, so the hub is never more than a day out of date.
  • About a minute after any change, such as installing, updating, activating, deactivating or deleting a plugin, or switching theme.

That second point matters more than it sounds. When you update a vulnerable plugin, the site reports straight away and the warning clears. You can see the fix has landed without waiting until tomorrow.

What your clients see (if you enable it)

On each client site, admins get:

  • A notice on the Dashboard, Plugins, Themes and Updates screens whenever a known vulnerability affects the site (if you enable the option)
  • A dashboard widget listing every open vulnerability, worst first. Each one shows its severity rating, a CVE link and the recommended fix, such as “Update to version 5.3.2, or a newer patched version” (if you enable the option).
  • A “Report Now” button in the module settings for an instant re-check.

Both the notice and the widget can be switched off per site if you’d rather keep this information to your own team.

What you see on the hub

The new Client Vulnerabilities page gives you the portfolio view:

  • Every reporting site with its WordPress version, component count and open vulnerabilities. Click a count to see the details.
  • Installed Across All Sites. This is a single table of every plugin and theme in your portfolio, most widely used first, with every version in use. Click a count to see exactly which sites have it and whether it’s active there.
  • A filter box over that table. Type contact 5.3 and you’ll see every site still running Contact Form 7 5.3.x, in about a second.

That last table is useful well beyond security:

  • Before a major plugin update, check how many sites are affected.
  • Find the one site still running an abandoned page builder.
  • Spot where the same plugin sits at five different versions.

Vulnerabilities also appear in the tools you already use:

  • Sites with a High or Critical vulnerability are flagged in the Settings Sync portfolio, with a badge next to the site name.
  • The monthly portfolio digest gets a new Vulnerabilities column.

Why the hub sits in the middle

I could have had each client site talk to the scanning service directly. I chose not to, for three reasons:

  • Your Website Toolkit API key stays in one place. A key copied onto fifty client sites is a key that can leak from any one of them.
  • Traffic is managed for you. The hub paces submissions to stay inside the service’s rate limits and queues anything over. It also skips re-sending a site whose inventory hasn’t changed.
  • Clean-up is automatic. Delete a client from Manage Sites and its history is removed from the scanning service too.

Getting started

Vulnerability Monitor is available on all premium plans. It’s marked Experimental while I gather feedback.

  1. On your agency site, make sure Content Health Monitor Hub has its Crawler URL and API token set. Vulnerability Monitor Hub uses the same key.
  2. Enable Vulnerability Monitor Hub on your agency site.
  3. In Manage Sites → Feature Sets, tick Vulnerability Monitor under Security for the sets you want covered.
  4. Enable Vulnerability Monitor on your client sites. Sites paired through Settings Sync connect automatically.
  5. In your crawler account, set the API key’s WP vulnerability alert email to wherever you want alerts to land.

Within a minute of enabling the client module, each site sends its first report. Anything already vulnerable shows up on the hub straight away.

This isn’t virtual patching

It is important to note this isn’t virtual patching. It is a way to help alert you to potential issues if you haven’t already heard about them. By highlighting potential issues to your hosting clients they can choose to update their sites more promptly (if they log in), or you can contact them letting them know.

A note on inactive plugins

Vulnerability Monitor checks inactive plugins and themes too. Deactivating a plugin doesn’t remove its files, and some vulnerabilities can be exploited with the plugin switched off. If a report flags something you never use, the right fix is usually to delete it, not just deactivate it.

When is this being made available?

This new feature will be coming in ToggleWP v2.0 which is due early October. If you purchase today you can opt in to the beta programme to try it out and provide your feedback.

Vulnerability data provided by Wordfence Intelligence.

Similar Posts