Get a plain email when a plugin, theme or WordPress on your site has a known security problem, with what to do and by when. No jargon, and no email when all is quiet.

Watchfox AI keeps an eye on the plugins, themes, WordPress and PHP version on your site. When one of them has a known security hole, it tells you how serious it is and what to do: today, this week, or when you can.

Who it’s for

Site owners who are not developers and want to know, in words they understand, when something needs updating.
Small businesses and shops that rely on a WordPress site but have nobody watching it.
Freelancers and agencies who look after client sites and want security alerts by email in one place (Agency plan).

How it works

Install and activate, then enter your email and choose English or Spanish.
Every hour your site compares its versions with a public, signed list of known problems. It never changes anything without your OK.
When something needs you, you get an email with what to do and the proof behind it. You can also see it any time in WordPress.

Free and paid

Every finding shows in WordPress on every plan, free included. The plan changes which emails you get, and whether our service runs Auto-fix for you.

Free: 1 site for each email address, one safety-check email a month, and the first “Today” warning each month in full by email.
Paid (Pro, or Agency for up to 10 sites): checked all day, every day, every warning by email in full with its proof, “This week” and “When you can” warnings, optional early warnings from the news, “Sorted” emails when you fix things, and an optional weekly summary.
Auto-fix, run by our service, is part of the trial and the paid plans. Fix it now is free on every plan.

Why it is different

Plain words. Each warning says who is at risk, what to do and by when, so you can act or forward it to whoever looks after your site.
Proof, not scare. Every warning shows where it comes from, such as a trusted security source and an official ID, so you can check it.
Early warnings. The AI runs on our service to read public security news, so new problems can be added to the list early; the plugin itself only compares versions and runs no AI.
Quiet by design. You only hear from us when something needs doing.

What you get:

A plain page in your WordPress admin that lists what needs doing, with the proof behind each warning.
An email when something needs you, so you do not have to remember to look.
Warning emails in English or Spanish, your choice.
A “Fix it now” button that updates a risky plugin or theme in one click, after you confirm. It saves a copy first and puts it back if your site breaks.
Auto-fix is part of the trial and the paid plans, and is run by our service. It is off until you turn it on, then updates plugins and themes with a known security problem, with a backup and an automatic undo. The Fix it now button stays free on every plan.
After an update, it checks that your home page, login, cart and checkout still work.
“Is this update safe?”: how the same update went on other sites, before you press the button.
It never changes anything without your OK.

How it works in detail: Watchfox AI downloads a public, signed list of known problems and compares it with the versions on your site. If you sign up for emails, your site sends back only the problems it found, so we can write to you.

External services

Watchfox AI uses four outside services. Nothing is sent to any service until you finish setup.

api.watchfox.site (run by the Watchfox AI team, https://watchfox.site). This is the service behind the plugin. Terms: https://watchfox.site/terms. Privacy policy: https://watchfox.site/privacy.
- Threat list download: your site fetches the public list (an index and small files). Only the files that match what is installed are fetched. The request carries no account or site details, but each file name is a short hash prefix of an installed item, and your server address is visible like in any web request.
- Site registration: when you finish setup, your site sends the email address and language you chose, your site address and wp-admin address, and the Watchfox AI, WordPress and PHP versions, so we can email you.
- Reports: after each check your site sends your site address, a running number for each report (so an old report cannot be sent again), only the problems it found (an ID, the item folder name, its version, a status, how serious it is, what kind of item it is and its display name), the IDs of warnings a trusted source has withdrawn, your email and warning settings (including which warnings you muted), your wp-admin address (so the “Fix it now” button in an email opens the right page), whether Auto-fix is on or off and which warning levels it covers (so a warning email can mention it when it is off; never which items you excluded), and, for each problem, the version WordPress offers as the fix, if there is one (so our service can decide what Auto-fix covers), whether the Sunday summary may include one line asking for a review on WordPress.org (only yes or no; whether you click it is never sent), and the Watchfox AI, WordPress and PHP versions. It never sends your full list of plugins and themes. Reports are signed with a secret that belongs to your site.
- Orders: when Auto-fix is ticked, your site asks the service about once an hour whether to fix something, and once more right after a fix, sending your site address, signed like a report. It also tells the service which orders it did not carry out and a short reason code (for example that the item is on your skip list); it never sends the skip list itself. It acts only on an order signed for your site, and never on anything else the service might say.
- Outside look: before and after any fix, on every plan, your site asks the service to look at its home page and up to two more public pages. The service loads them only for sites on a trial or paid plan, to see whether they still work. These requests identify themselves as WatchfoxAI/1.0 (+https://watchfox.site). Your site tells the service whether it is the look before or after a fix, which pages to look at (up to three) and the id of the order it belongs to; the service reads only their public address and answer. Some time after a fix is kept, the service also looks at your home page once more by itself, with no request from your site.
- What Watchfox changed: if you use “Fix it now” or Auto-fix, the next report also says what was done: how many fixes and put-backs there were, and for each one the warning ID, the item folder name and display name, the version before and after, how serious the warning was, whether it worked, could not be checked or was put back (and why), whether Watchfox had to switch the plugin off after a put-back failed, and whether you or Auto-fix did it. On paid plans we use this to email you “Fixed for you” or “We put it back”. No file contents and no backup data are ever sent.
- Safety ratings: when an update is ready, your site downloads a small public file to see how that update went on other sites. The request carries no account or site details, but the file name is a short hash prefix of the item, like the threat list files. When you use “Fix it now” or Auto-fix, whether the update was kept or put back is pooled anonymously with the same result from other sites. Only rounded totals (such as “100+ sites”) are published, and only once at least 10 different site owners reported the same update.
- Removal: when you delete the plugin, your site tells the service to stop watching it.
- Uninstall reason (only if you choose to send it): when you deactivate Watchfox AI on the Plugins screen, a small optional question appears. If you press “Send and deactivate”, your site sends one of five reasons you picked and the short note you typed (at most 200 characters, if any), with your site address, signed like a report. Press “Skip and deactivate” and nothing is sent. We keep the answers for 400 days.
- Emails and payments: when you press “Send it again” or “Send me a sample warning”, or choose a paid plan, your site asks the service to send that email or to prepare a payment link (with the plan you picked and your site ID).
Brevo (https://www.brevo.com), through api.watchfox.site. Brevo delivers our emails (the confirmation, warnings, a sample warning, a weekly all-quiet note, and on paid plans “Fixed for you” or “We put it back” after a fix) from [email protected]. Your email address and the name and address of your site are passed to Brevo only to deliver those emails. Terms: https://www.brevo.com/legal/termsofuse/. Privacy policy: https://www.brevo.com/legal/privacypolicy/.
Dodo Payments (https://dodopayments.com), only if you choose a paid plan. Your browser opens a Dodo Payments page, the merchant of record, which collects the payment and handles taxes. Card details go only to Dodo Payments, never through your site or Watchfox AI. Cancelling also happens on a Dodo Payments page that the plugin links to. Buyer terms: https://dodopayments.com/legal/buyer-terms. Privacy policy: https://dodopayments.com/legal/privacy-policy.
api.wordpress.org (https://wordpress.org). Once a day, for a few plugins that WordPress.org used to list but no longer does, your site asks the WordPress.org plugin information API whether the plugin was closed. Once a week, for each plugin from WordPress.org, it asks when the plugin was last updated, so a plugin nobody has updated for two years can be pointed out. Each request sends the plugin folder name and your server address. When you press “Fix it now” (or Auto-fix runs), WordPress itself downloads the update from its normal update source, exactly as the Update button on the Plugins screen does; Watchfox AI never downloads or runs code from our service. Terms and privacy: https://wordpress.org/about/privacy/.

After an update made with “Fix it now” or Auto-fix, your site also loads a few of its own pages (home, login, and the WooCommerce cart, checkout and a product page if you use WooCommerce) to check that they still work. These requests go only to your own site.

The plugin contains no tracking, ads or hidden links.