Is it hacked?
Malware, hidden code, infections that come back after you delete them, spam shown only to Google, and blocklisting.
Sentinel: WordPress security monitoring
Are any of your WordPress sites hacked? Get a straight answer.
Sentinel is the WordPress security monitoring built into WPCentrify. For every site you manage, it answers five plain-English questions, gives one verdict and a score out of 100, and tells you exactly what to do. It is built to stay quiet when nothing is wrong.
Checks every site from inside and outside. Free during early access.
Updated
What is WordPress security monitoring?
WordPress security monitoring is the ongoing check that tells you when a WordPress site has been hacked, has a security hole or is exposed to attack, so you can act before visitors, Google or the people who rely on the site notice.
A security plugin on one site shows warnings for that one site. When you look after five, twenty or two hundred sites, you need something different: one place that checks every site every day, explains what it found in words a client understands, and says nothing when there is nothing to do. That is what Sentinel is for.
Why most WordPress security tools let you down
- Someone asks "is the website hacked?" and the tool cannot give a straight answer
- Long lists of warnings, file paths and red badges that nobody understands
- False alarms that teach your team to stop opening the security page
- A plugin the same attacker can switch off. Sentinel also checks every site from outside.
The core idea
Five questions everyone actually asks about a website
Sentinel turns hundreds of technical checks into five questions anyone can understand. Each one is answered Fine, Something to look at, or Problem.
Are plugins and themes safe?
Known security holes in plugins, themes and WordPress itself, tampered files, plugins pulled from WordPress.org and software nobody updates any more.
Is signing in safe?
Password guessing, sign-ins from a new country, new or hidden administrators, stolen sessions and new app passwords.
Is anything private open to the public?
Backup files, database dumps, config and log files, and open folders that anyone on the internet could download.
Do visitors and Google trust it?
A secure connection, certificate expiry, browser protections, Google blocklist status and pages that show Google something different.
One verdict for the whole website
Every site gets one of four verdicts: Safe, Needs attention, At risk or Hacked. Next to it sits a security score out of 100 that never reads better than the sentence beside it.
It is the answer a site owner wants when they ring, and the answer your newest team member can act on without asking anyone. Status is always written in words, never shown by color alone.
The difference
A security page your team will actually open
Most security tools cry wolf. Sentinel was built the other way round: it is designed to recognize what normal, legitimate software does and leave it alone, so whatever it does raise is worth your time.
Your host's own tools are recognized
Host malware scanners, firewalls and caching plugins show up as protection, not as threats.
Your team's work is never an alarm
Sign-ins and accounts created through WPCentrify's one-click login are never flagged.
"Hacked" is said only on proof
One odd signal is never enough. Sentinel needs real evidence before it uses that word.
Routine changes are notes, not alarms
A plugin updating its own files, or a cache file changing, goes into a quiet list of normal changes.
Dismiss once, and it stays dismissed
If something you cleared gets worse, Sentinel asks again. Otherwise it stays out of your way.
What it checks
What Sentinel checks on every WordPress site
Grouped the way you think about them, and explained in plain English whenever something turns up.
Inside the site, and from outside it
Some problems can only be seen from inside a website, and some can only be seen from outside. Sentinel covers both. The WPCentrify plugin reports what is installed and who is signing in, and separate checks look at each site the way anyone on the internet can.
That matters on the day it counts: a hacked site can hide things from a plugin, but it cannot hide what it shows the world. Ranking known holes across your whole portfolio is covered in vulnerability monitoring.
To check one site by hand first, our guide to scanning a WordPress site for malware step by step shows what each kind of scan can and cannot see.
Vulnerabilities and software
- Daily vulnerability alerts. Every plugin, theme and WordPress version is checked against a vulnerability database every day, with the version that fixes each hole.
- Tampered plugins and core. Plugin and WordPress core files that have been changed are flagged.
- Premium plugins too. Paid plugins are checked for tampering as well, without your files ever being copied off the site.
- Abandoned software. Plugins removed from WordPress.org, and software past its end of life.
WordPress malware detection
- Malware hidden below WordPress. The most dangerous infections hide where ordinary security plugins do not look. Sentinel looks there.
- Malware that comes back. Infections that rebuild themselves after you delete files, with a clean-up order that works.
- Hidden code in the database. Malicious code stored in WordPress settings.
- Known malware files. Recognized wherever they turn up.
- Uploads and injected scripts. PHP files in the media library, hidden JavaScript in posts and widgets, and scheduled tasks that keep malware alive.
Accounts and sign-ins
- New administrators. An alert the moment an admin account appears, with the details that tell you whether to worry.
- Hidden administrators. Admin accounts that hide themselves from the WordPress users screen.
- Password guessing. Brute-force attacks counted, and stopped when login lockouts are on.
- Guessed passwords. An urgent email when a password guessing attack succeeds.
- New places and stolen sessions. Sign-ins from a new country or network, and admin sessions with no sign-in behind them.
- Old admins and app passwords. Admins who have not signed in for a long time, and new application passwords.
Checked from outside the website
- Exposed files. Backups, database dumps, .env files, logs and Git folders anyone could download.
- Open folders and source code. Folder listings and PHP source code showing in the browser.
- Username listing. Whether anyone can list your admin usernames.
- Spam shown only to Google. Pages that show Google different content from what visitors see.
- Google blocklist check. Whether Google is warning people away from the site.
- Certificates and browser protections. Expiry dates and missing security headers.
If the plugin itself is attacked
- Damaged plugin. If the WPCentrify plugin is emptied or broken, you are told.
- Silenced plugin. If someone stops the plugin from reporting, Sentinel raises it instead of showing a clean result.
Neighboring sites
- Hacked neighbor. If a hacked site in your account shares a server with another of your sites, you are told, because shared servers spread infections.
Hacked site recovery
When a site is hacked, Sentinel shows the way back
When the verdict is Hacked, that website's security page turns into a recovery plan, so you are not left with a list of findings and a sinking feeling.
Sign everybody out
One button signs every user out and removes app passwords. Passwords stay the same, so the owner and your one-click login keep working. Only the workspace owner can press it, with a typed confirmation.
Clean it, or put back a copy from before
Sentinel finds when the hack first showed real proof and offers the last backup taken before that moment. If that backup holds only the database or only core files, it says so plainly.
Close the door
Change administrator passwords, update every plugin and reinstall anything that did not come from its maker. Sentinel keeps checking and tells you when the site is clean.
What happened, in order
A timeline of what Sentinel saw around the first sign: findings, sign-ins, new admins and new plugins. Facts, not guesses, and every action lands in the activity log.
Clean-up in the right order
For malware that rebuilds itself, the order matters. Deleting the visible files first is how most clean-ups fail.
Fix security holes automatically
One switch creates an automation rule that applies the updates which close a known security hole, and only those.
For the full response, including who to tell and what to say, read what to do when a WordPress site is hacked.
Hardening
Harden every WordPress site from one screen
Turn protections on for one website or all of them. Each website reports back what is actually in effect, not just what was asked for.
| Protection | What it does |
|---|---|
| Login lockouts | Stops an address after a few wrong passwords. The simplest WordPress brute force protection there is. |
| Hide login errors | Does not tell attackers whether it was the username or the password that was wrong. |
| Strong passwords | Requires strong passwords for anyone who can publish. |
| Block admin-style usernames | Refuses new accounts called admin, root or the site's own name. |
| Block PHP in uploads | Stops code running from the media folder, and checks that the server really honors it. |
| Turn off XML-RPC | Closes an old door attackers use for password guessing. |
| Stop username listing | Stops anyone listing your usernames. |
| Remove file editors | Removes the code editors from wp-admin, so a stolen admin password cannot be used to run code. |
Off until you switch them on
Sentinel never changes a website without being asked. Protections stay off until you turn them on, for one site or the whole portfolio.
WordPress login security beyond the login form
Your team signs in to every site with one-click login, so nobody shares passwords. Lockdown can then refuse normal password sign-ins for administrators altogether, which leaves password guessers with nothing to guess.
Built for portfolios
Security for multiple WordPress sites, in one view
Sentinel was built for anyone who runs more than one WordPress site, whether the sites are your own, your company's or your clients'. Every site's security sits in one place, worst first, alongside security risk ranked across your portfolio.
- Fleet overview. Every site's verdict and score on one screen, worst first, next to the rest of your fleet dashboard.
- One to-do list. The same issue on eleven websites is one job, not eleven.
- 90-day history. A daily record of each site's security, shown as a simple strip.
- Security reports anyone can read. The monthly report has a plain-English security section that counts only real issues, never dismissed false alarms.
- Email alerts that matter. Urgent emails only for things that need someone today, such as a guessed password. Alert profiles decide who gets which.
- Team permissions. Choose who can view security and who can act on it, with team and client access.
- Clear and accept. Clear findings in bulk, or accept one with a note for the record.
How it works
How Sentinel works, in three steps
Nothing to configure before it is useful. Connect a site and Sentinel starts checking straight away.
Install the WPCentrify plugin
One lightweight plugin on each website. It runs in the background and does not slow the site down.
Sentinel checks inside and outside
Each site is checked from the inside and from the outside every day, against a vulnerability database that is updated daily.
You get answers
One verdict, five answers and plain next steps for every site. Anything urgent arrives by email.
Sentinel's checks keep improving on our side, so every connected site gets better protection without anyone updating a plugin.
Honest limits
What Sentinel is, and what it is not
Security is the one place an over-promise costs trust. Here is exactly where Sentinel stops.
Detection, not a firewall
Sentinel finds problems and helps you fix them. It is not a web application firewall, and it works well alongside one, such as Wordfence, Cloudflare or your host's firewall.
Not a malware removal service
It shows exactly what to remove and in what order, and finds a clean backup. The cleaning is done by you, your host, or WPCentrify on request.
Outside checks see what the public sees
Some things can only be seen from inside a website, which is why the plugin and the outside checks work together.
Sign-in protection is lockouts and access control
It comes from login lockouts, strong passwords, one-click login and lockdown.
More on ranking security risk across a portfolio, and what to do if a WordPress site has been hacked.
Answers
Questions about Sentinel and WordPress security monitoring
What people ask before they connect their sites.
WordPress security monitoring is the ongoing check that tells you when a WordPress site has been hacked, has a security hole or is exposed to attack. Sentinel does it for every site you manage, gives each one a verdict and a score, and explains what to do in plain English.
Common signs are redirects to spam sites, administrator accounts you did not create, files that changed without an update, PHP files in the uploads folder, spam pages in Google results and a browser or Google warning. Sentinel checks every site you manage for signs like these and answers the question directly: is it hacked, yes or no.
It looks for proof, such as malware that rebuilds itself, a confirmed malware file, hidden spam shown to Google or a Google blocklisting. A single odd signal is never enough to call a site hacked.
Sentinel works alongside the security plugin you already use. It recognizes Wordfence, NinjaFirewall, MalCare, All-In-One Security and host scanners such as Monarx and Imunify as protection, and does not raise their files as threats.
No. The plugin reports in the background, and the heavy checks run on our servers rather than on your website.
No. Sentinel is built to stay quiet when nothing is wrong. Most findings are shown on screen, and only urgent problems, such as a guessed password, are emailed.
From a vulnerability database that is checked every day. For each plugin, theme or WordPress version with a known security hole, you see the hole and the version that fixes it.
Yes. Paid plugins are checked for tampering too, even though there is no public copy of them on WordPress.org. Your files and data are never copied off the site to do it.
Yes. Every finding is written in plain English, and the monthly report includes a security section that counts only real issues, never dismissed false alarms.
The security page becomes a recovery plan: sign everybody out, clean the site or restore the last backup from before the hack, then close the door. Sentinel keeps checking and tells you when the site is clean.
Sentinel is included on WPCentrify's team plans rather than sold as a separate product. Plans and prices are announced at launch, and early access is free while we build.
Look for one that checks every site every day, explains what it finds in plain words and stays quiet when there is nothing to do. Sentinel, WPCentrify's security monitoring, gives every site one verdict and a score out of 100, checks for vulnerable plugins, signs of a hack and risky sign-ins, and shows the way back if a site is hacked.
Yes. From a hacked site's recovery page, the workspace owner can sign everybody out of the site in one step: every session ends and every application password is removed. Passwords stay as they are, so the owner can sign straight back in.
Choose a protection level once for your workspace. In WPCentrify, Basic turns on sign-in lockouts, hides which part of a login was wrong, refuses obvious usernames such as admin and removes the file editors. Harden adds the rest, such as blocking XML-RPC and user enumeration, while keeping XML-RPC on where a plugin such as Jetpack needs it.
Works with the rest of WPCentrify
Vulnerability monitoring
Known holes matched across your whole portfolio and ranked by how many sites they expose
Read moreOne-click login
Sign in to any of your sites without sharing passwords, then lock the login page down
Read moreBackups and restore
The clean copy from before the hack, ready when Sentinel says you need it
Read moreMore on this topic: Security and vulnerability scanning
Early access
Know which of your sites need you today
Connect your first website in minutes. Sentinel starts checking straight away, and every site's verdict, score and next steps appear in one place.
Free during early access. No credit card required.