What each warning level means
Our warnings tell you when to act, not how scary it sounds.
Watchfox is almost ready. Nothing is for sale yet, and the plugin isn’t out. This page explains how it will work.
Updated
Attackers are using it right now.
Something on your site has a security hole, and attackers are already getting into sites through it. Fix it today.
- The proof
- Your site has the affected version, and two trusted sources say it’s being used in attacks, or CISA (the US cyber safety agency) lists it.
- Can I mute it?
- No. It’s too important. We stop once it’s fixed.
A real problem. No attacks yet.
A trusted security source has confirmed a problem in something your site uses. Nobody’s attacking it yet, but they could start. Fix it this week.
- The proof
- One trusted source confirmed it, and your site has, or may have, the affected version.
- Can I mute it?
- Yes. If it later becomes “Today”, we’ll tell you anyway.
Early talk. Not confirmed.
People are talking about a possible problem in something your site uses, but no trusted source has confirmed it yet. There may be no fix so far.
- The proof
- At least two separate sources. One post on its own is never enough.
- Can I mute it?
- Yes. These are off unless you turn them on.
Nothing needs you.
Most weeks look like this. If you like, we’ll say so in a short Sunday email.
You fixed it.
Your site checked itself again and the problem is gone. One short email to say so, and that’s it.
On the Free plan
Free sites get one safety-check email a month, listing anything that needs doing. The first “Today” warning each month comes straight away, in full. The others need Pro or Agency. You can always see every warning inside WordPress, on any plan.
Can a warning change?
- It can go up when new proof arrives. For example, “This week” becomes “Today” when attacks start. We email you once when that happens.
- It can be called off. If a trusted source says a report was wrong, we tell you the good news and close it.
- Not sure it’s your plugin? If a plugin only shares a name with one on WordPress.org, we say “may affect you”. That can never be “Today”.
Which sources count as trusted? See how we check.
Find out when your site needs fixing.
Leave your email and we’ll write once, on launch day.
Get early access