# Your WordPress sites and your repositories, in the same dashboard.

Source: https://libwatch.com/en/ecosystems/wordpress

Ecosystem · WordPress

LibWatch inventories the core, plugins, themes and PHP version of each site, and alerts you when a vulnerability affects them. No plugin to install.

[Monitor a site](https://app.libwatch.com/users/sign_up?source=eco_wordpress)

[How to connect](#connexion)

Connection

## A site connected in two minutes

WordPress already supports it: no plugin, no file to upload to the server.

### Create a dedicated user

Administrator role: it's the only one that can list plugins through the REST API. A separate account can be revoked without affecting the others.

### Generate an application password

Profile › Application Passwords, name it “LibWatch”. WordPress shows it only once.

### Paste the site URL and the password into LibWatch

The first analysis starts right away. To cut off access, revoke the password in the profile.

What LibWatch checks

## Everything running on the site

Core

### WordPress version

Compared with published vulnerabilities and the latest release.

Plugins

### Every plugin, active or not

A deactivated plugin is still an exploitable file on the server.

Themes

### Active theme and installed themes

Child themes and forgotten themes included.

PHP

### The site's PHP version

When the site shows it: end of life and engine vulnerabilities, like PHP2Shell.

Health

### Abandoned plugins

Removed from the official directory or not updated in years.

Every night

### Nightly watch

PHP version rechecked every night; plugins and themes at each analysis, which can be scheduled.

Sources

## Where the vulnerabilities come from

LibWatch doesn't make up its own alerts: it cross-checks recognized public databases.

CVE Program

### Vulnerabilities published with a CVE ID

The global reference database, for core, plugins and themes.

Wordfence Intelligence

### The WordPress-specific feed

Added on top, when enabled, to cover plugins faster.

CERT-FR

### French government alerts on PHP

For vulnerabilities in the PHP engine that runs your sites.

LibWatch and your security plugin

## The two work together

A security plugin protects a site from the inside. LibWatch monitors all your sites from the outside.

On each site
### Security plugin

- — Web application firewall and attack blocking.
- — Scan of the site's files.
- — Installed and updated site by site.

Across all your sites
### LibWatch

- — Inventory and vulnerabilities of all your sites in one place.
- — Your Git repositories in the same plan.
- — Nothing to install on the sites.

Frequently asked questions

## LibWatch and WordPress

### Why an administrator account?

The WordPress REST API only lists plugins to users who can manage them. Use a dedicated account, which you can revoke at any time.

### Is multisite supported?

Each site is added by its URL, with its own application password. In a multisite network, add the sites you want to track one by one: each counts as one project.

### What if the site hides its PHP version?

The rest of the analysis is unchanged: core, plugins and themes are checked. PHP end of life and engine vulnerabilities are only reported if the site reveals its version.

### Does a site count as a project?

Yes. A WordPress site counts as one project in your plan, like a Git repository.

## Your WordPress sites, checked from the first analysis.

A site counts as one project, like a Git repository.

[Monitor a site](https://app.libwatch.com/users/sign_up?source=eco_wordpress)

Hosted in France by OVHcloud