Vulnerability monitoring · included free of charge
Several times a day we record every WordPress and CMS installation on our servers – with each plugin and theme in its exact version – and check them against several vulnerability databases, including Wordfence Intelligence. If your site is affected, we contact you. For all web hosting and WordPress customers, with no sign-up and no extra charge.
The risk
By far the largest share of WordPress vulnerabilities reported each year is not in the WordPress core but in plugins and themes. Every extension brings its own code – and a typical business website uses many of them. As soon as a vulnerability becomes public, automated scanners search the internet for sites running the affected version, often within a few hours. If you only check at your next maintenance date, you are unprotected in the meantime.
Technology
The monitoring runs on our own servers, with no plugin in your website and no access from outside.
Data protection
We analyse technical metadata only – which software is installed in which version.
Monitor or maintain?
The monitoring tells you that something needs doing and what. You or your agency install the update. If you would rather not do that yourself: in all WordPress editions and with WordPress Sorglos we update core, plugins and themes for you – with a restore point before every update. We usually install security updates within 12 hours.
Examples
Because of a weak security value, visitors who were not logged in could gain administrator rights and create their own administrator accounts. All versions up to 6.3.0.1 were affected; the vulnerability was fixed in version 6.4 on 13 August 2024.
What the monitoring does
Every installation with LiteSpeed Cache up to version 6.3.0.1 is found – even if the plugin is installed but deactivated. You receive an alert pointing to version 6.4.
If the plugin's two-factor login was enabled, attackers could bypass the login and sign in as any user – including an administrator. Versions 9.0.0 to 9.1.1.1 were affected; fixed in version 9.1.2. WordPress.org even pushed the update out as a forced update.
What the monitoring does
A forced update does not reach every site, for example when automatic updates are switched off. We check the version actually installed and keep alerting you as long as it is still vulnerable.
Examples from publicly documented security advisories; details as reported by the vendor and security researchers.
The alert
Short, specific and without attachments. Every alert contains:
Genuine alerts come from hostmaster [at] twosteps.net or support [at] twosteps.net, name your installation specifically, have no attachments and never ask for passwords.
Suitable editions
Best seller
SMEs, law firms, practices, trades
The standard for company websites that carry day-to-day business.
€5.49 / month
incl. 19% VAT · 3-month minimum term · no setup fee
Shops, portals, sites with campaign traffic
More resources and a dedicated PHP pool for shops and sites under noticeable load.
€11.32 / month
incl. 19% VAT · 3-month minimum term · no setup fee
Up to 3 installations
More resources and staging – for sites that carry day-to-day business.
€64.90 / month
incl. 19% VAT · 3-month minimum term · no setup fee
Frequently asked questions
No. It is included in all web hosting and WordPress editions, with no sign-up and no extra charge.
No. The monitoring runs on our servers and records your installations directly in the file system. Nothing changes in your website.
WordPress with all plugins and themes, Joomla, Drupal, Contao and TYPO3, Shopware and Nextcloud – plus other widely used systems installed on our servers. Feel free to ask us if you are unsure whether your system is covered.
The matching runs several times a day. A new advisory from the vulnerability databases is checked against all installed versions in the next run; if your site is affected, you then receive the email.
Not with the free monitoring – we change nothing in your website without your instruction. In the WordPress editions and with WordPress Sorglos we take care of updates; security updates usually within 12 hours.
Our servers also check websites continuously for malicious code. If we find something, we contact you with a clear recommendation. If a compromised installation endangers other customers, we act immediately and inform you straight away. On request we restore an earlier state from our backups.
No. Only technical metadata is evaluated: which software is installed in which version.
It complements them. The monitoring finds known vulnerabilities in installed software; a web application firewall blocks attacks before they reach your application. With us, both are active in every edition.
Start from scratch or simply bring your existing website with you.
Still unsure? Book a consultation ↗
· Arrange a call-back
· Contact form
+49 711 489-657-40
· available Mon–Fri 8 am–6 pm