Many WordPress sites, one place

The Overview shows what needs attention on each website and how urgent it is. An outage, a known vulnerability, or a security finding comes before an ordinary pending update. You don’t have to open every admin panel to find out where things are on fire.

The Plugins page shows which plugin runs on which websites, in which version, whether it’s active, which version WordPress offers, and how many known vulnerabilities it has. digiWatcher checks vulnerabilities against the public wpvulnerability.net database.

What the agent reports from inside

Every hour the digiWatcher Agent plugin sends data you can’t get from outside the site:

• pending updates for core, plugins, and themes,
• the PHP version, with a warning once it no longer gets security fixes,
• WordPress scheduled tasks that have been stuck for more than an hour,
• a site that shows debug errors to visitors, and the number of fatal PHP errors in the last day (never their text),
• low free disk space and an unreachable database.

Once a day the agent compares core files and wordpress.org plugin files with the official checksums and looks for PHP where it doesn’t belong. The security log records new administrators and changes to the administrator email and the site address. Alerts go out only when something changes, not every hour about the same plugin.

For each website digiWatcher shows whether it can be updated, and if not, why. Typically the agent is missing or out of date, updates aren’t enabled in digiWatcher or in WordPress, the site runs as a multisite network, the hosting can’t write files directly, or a previous update is waiting for your review. It also flags websites where the safety brake is missing.

Write access stays off until the site’s administrator turns it on. Before every update digiWatcher checks the site from outside: uptime, the home page content, and the agent’s response. It won’t update a broken site. After the update it checks again, and if the site got worse, it restores the original plugin or theme files. A version that has failed once stays flagged in the list for 60 days.

How updates move from site to site and when a batch stops is explained on the bulk WordPress updates page. The steps in the app are in the Updates and care manual chapter.

A confirmed outage opens an incident. In the Agency queue you set its priority, assignee, and work status, log time, and link it to a change on the same website, such as the plugin update after which the site went down. Operators work on and acknowledge incidents; only the Owner can delete websites and change settings.

The care history of each website brings together version changes digiWatcher detected, updates carried out through digiWatcher, and your own manual records. Whatever you mark as shared, the client sees in the client portal. Internal notes stay with your team.

• It never installs new plugins or themes.
• It never uploads a ZIP file and has no file editor.
• An update instruction doesn’t carry a package URL. The agent only updates to the version WordPress’s own update source offers.
• It writes nothing without the site administrator’s permission; by default it only reads.
• It doesn’t accept an unsigned instruction. Each one is signed with a key only digiWatcher and that website know, and it can’t be sent twice.
• It doesn’t send server disk paths or file contents.

Even if someone stole the write key, it would let them do no more than WordPress would do on its own during an automatic update. The safe WordPress agent page covers the agent’s limits in more detail.

Agencies that look after dozens of client websites, freelancers with their own portfolio, and in-house managers of company websites. The Agency plan covers 100 websites; fully used, one website works out at €0.66 a month.

If you’re looking for someone to take care of your one website, digiWatcher won’t do that for you. It’s a tool for site managers, not a maintenance service. It doesn’t update or fix a site by itself: an update is always started by a person, or by an automatic update rule someone deliberately turned on. Websites that don’t run WordPress are tracked from outside only: uptime, response time, the SSL certificate, and domain expiry.

How a whole team works with digiWatcher and what the client sees is summed up on the digiWatcher for agencies page.