WordPress monitoring

A WordPress site changes constantly: plugins update, new admins appear, the core needs patching. Most of that happens without anyone telling you. The TLDTrack WordPress plugin connects a site to your account so we can see those changes and alert you when something matters, especially a new administrator account you did not expect.

What it tracks and alerts on

Each time the plugin reports in, TLDTrack stores the current state and compares it with the previous report. Where something meaningful has changed, it raises an alert (which then reaches you through your normal notification channels):

• A new administrator (wp_admin_added). Raised as a warning when the report arrives, and the hourly comparison raises a separate critical user-change alert, because an unexpected admin is a classic compromise signal.
• An administrator removed (wp_admin_removed). Recorded for the audit trail.
• Plugins installed or removed (wp_plugin_installed / wp_plugin_removed). Named in the alert so you know exactly what appeared or disappeared.
• Plugins updated, activated or deactivated (wp_plugin_change). Picked up by an hourly comparison of reports and raised as a warning. A pushed update that fails raises its own warning (wp_update_failed).
• A WordPress core update available (wp_core_update). Raised as a warning, and deliberately only once in a seven-day window per account so you are not nagged about the same pending update every report.

Alongside the alerts, the plugin keeps a running snapshot you can read in the dashboard and the mobile app: the WordPress and PHP versions, the number of plugin and theme updates waiting, the full plugin, theme and user lists, and when the site last reported in.

How a site is paired: the site key

A site is connected with a site key, which is a long secret string beginning tldt_ that you generate in your account. When you create a key you give it:

• A label so you can recognise the site later.
• The site URL, which is required. Reports are rejected if the URL a report comes from does not match the one the key was registered to, so a leaked key cannot be pointed at a different site.
• The platform (WordPress, or "other" for a non-WordPress site reporting through the same endpoint).
• An optional client, if you run an agency and want the site scoped to a particular client.

You paste that key into the plugin's settings on the WordPress site, and from then on the plugin reports in twice a day, and straight after updates, plugin or theme changes, or a press of Refresh Data. A key can be revoked at any time, which immediately stops the site reporting without deleting its history.

Setting it up

1. 1
   In TLDTrack, go to Settings → Integrations and generate a new site key. Give it a label and enter the exact site URL.
2. 2
   Download the TLDTrack WordPress plugin from our WordPress plugin page and install it on the site like any other plugin.
3. 3
   In the plugin's settings, paste the site key and save. The plugin sends its first report, which becomes the baseline.
4. 4
   Check the site now appears under Integrations in your account, showing its WordPress and PHP versions and any waiting updates. From the next report on, changes to admins, plugins and core are detected and alerted.
5. 5
   Make sure your notification contacts are set so the WordPress alerts reach the right people.

What TLDTrack can and cannot do

The relationship is deliberately narrow. The plugin sends a health summary out to TLDTrack; there is no path for TLDTrack to log in, change settings or edit content on your site. The one exception is updates: from plugin version 3.3.0 you can queue a plugin, theme or core update in the dashboard, and the plugin picks it up within about 15 minutes and runs it through WordPress's own updater. On paid team plans you can turn the plugin API off entirely for your organisation. Doing so also revokes every active site key, so you need new keys if you turn it back on.

Where to set this up

Good to know

• The plugin reports out. The only thing that reaches back into your site is an update you queue yourself.
• The site URL is checked on every report, so a key only works for the site it was registered to.
• Theme and plugin update counts are always shown; the change alerts cover admins, plugins added, removed, updated, activated or deactivated, failed pushed updates, and core updates.
• Connect a WordPress site to a domain you already monitor and its health folds into that domain's page, not a separate silo.