How vulnerability findings reach site-level protection

Patchstack compares the WordPress core, add-ons, and themes installed on a site with its vulnerability database. This matching identifies known issues; it does not perform external checks. The Patchstack App offers a central view of connected sites and their security status.

The Personal (Free) plan includes vulnerability detection, email alerts, remote update management, snapshot reports, and an overview for up to three websites. It can provide up to 48-hour early warning about new vulnerabilities found by the security research community. Automatic updates for vulnerable plugins are optional.

Patchstack Developer is a paid plan. Detection, logs and analytics, snapshot PDF reports, and email alerts are also included in the Personal plan. Developer adds automatic vulnerability protection and preventive security controls.

Per-site vPatches for known flaws

When Patchstack detects a specific vulnerability on a site, it deploys a targeted virtual patch, or vPatch, for the affected extension or theme. Each vPatch is a firewall rule designed to block exploit attempts while the vulnerable component is being addressed. It does not modify the site’s code. The paid version includes access to more than 12,000 individual protection rules.

Hardening and custom rules

Developer includes an advanced hardening module with WordPress-specific rules and remote options for .htaccess, login protection, and reCAPTCHA. Other listed controls include two-factor authentication, CAPTCHA, a Community IP Blocklist of known attacker IP addresses, and advanced security settings.

• Unlimited custom firewall rules and custom alert triggers
• Weekly or monthly PDF security reports and report scheduling
• Slack alerts and unlimited Patchstack App API usage

The Patchstack App brings connected sites, findings, logs, analytics, and reports into one dashboard. Teams can review alerts and security activity there, with Slack alerts available for another notification process.

Connect a site and review its security status

Install the Patchstack plugin, register in the Patchstack App, add the site, and paste its API key into the plugin. Then review the security overview and configure alerts, reports, hardening settings, and custom rules for the site.

Agencies can monitor customer sites covered by WordPress care plans, while hosting companies can apply targeted vulnerability protection across sites. WooCommerce operators and individual site owners can use the findings, alerts, and reports to manage WordPress security issues.