Request a demo

Spot the silent breach in WordPress

A hacker who breaks into WordPress often leaves a way back in: a plugin that hides from your plugin list, or a script among your uploads. Alertica checks your files every day and tells you the day something appears. There's no plugin to install, and there's a free plan that never expires.

Request a demo See what it watches
  • Ready-made checks for WordPress
  • Free plan that never expires

Protect a WordPress site in three steps

  1. Connect your site

    Add the site with the SFTP, FTPS or FTP login from your host. A read-only login is enough, and Alertica finds WordPress by itself, even when the blog sits in a subfolder.

  2. Turn on WordPress Protection

    Pick WordPress as the platform. The checks for core, plugins, themes and uploads are ready-made, so there's nothing to configure.

  3. Choose who hears about it

    Pick who gets alerts, by email or SMS, with Slack coming soon. The first scan reports anything suspicious that's already on the site, so you start from a known state.

What WordPress Protection watches

The checks know where WordPress keeps its code and where it keeps your uploads. Each alert says what was found and what to do about it.

  • Plugins you never installed

    Some malware installs itself as a hidden plugin that runs on every page and doesn't show in your normal plugin list. Alertica alerts you the day one appears.

  • Your site's master key

    wp-config.php holds your database password. Alertica alerts you when it changes, and when a copy of it turns up where anyone could download it.

  • Scripts hidden among your images

    Your uploads folder should only hold images and documents. A script there is a red flag, and so is a fake login page planted to steal passwords.

  • WordPress, your plugins and your theme

    Any file added or changed in WordPress itself, your plugins or your theme. Your own updates show up too, so you can tell your changes from someone else's.

  • Files that shouldn't be there

    Known hacking tools, scripts disguised as images like photo.php.jpg, and backups of your database left where anyone could download them.

  • Signs of a mass attack

    More than 200 files changed or 100 deleted in one scan, and the files ransomware leaves behind.

Why site owners and agencies pick Alertica

  • Nothing to switch off

    A security plugin runs inside WordPress, so an attacker who can change your files can turn it off. Alertica runs on our servers and only logs in to read.

  • Nothing on your pages

    No plugin means nothing extra loading for your visitors and nothing new to keep updated. The site runs exactly as it does today.

  • Secure by design

    Alertica reads file names, sizes and timestamps, never what's inside. Your login is encrypted with AES-256, and every account uses two-step sign-in.

  • Set up with you

    Setup and onboarding come with Pro and Enterprise. We connect the site with you, turn on WordPress Protection and read the first scan together.

Questions WordPress owners ask

What WordPress Protection covers, how it fits next to a security plugin, and what it costs.

Running a multisite or something unusual? Ask us about your setup
  • Do I still need a WordPress security plugin?

    Alertica watches your files from outside WordPress and alerts you when they change or when a file appears that shouldn't be there. It doesn't block attacks or read the database, where some malware hides in settings and widgets, so a firewall or a scanner that reads the database is still worth running alongside it.

  • Will every plugin update set off an alert?

    An update changes plugin files, so yes, and the alert tells you the change was yours. The cache and upgrade folders, and the backup folders of UpdraftPlus and All-in-One WP Migration, are skipped, so they don't add noise.

  • Is it safe to give Alertica access to my site?

    Yes. Alertica is agentless and read-only: it lists your files and never opens, changes or deletes them, so a read-only login is all it needs. The login is encrypted with AES-256, and every Alertica account uses two-step sign-in.

  • Can I watch all my clients' sites?

    Yes. Each site is added on its own, with its own people to alert, and Pro is $20 per site per month. If you look after sites for clients, the partner programme adds wholesale pricing and a portal to manage them. See the partner programme

  • What does it cost?

    Free covers one site with a weekly scan and the site-wide security check. Pro is $20 per site per month and runs every check daily, with SMS alerts and setup and onboarding with our team. Compare plans

  • Does it work with my host?

    If your host lets you connect over SFTP, FTPS or FTP, yes. That's the login you'd use to upload files by hand, usually found in your hosting control panel. Nothing gets installed on the server.

Ready-made checks for other platforms

Find out what's on your site today

Tell us about your site. We'll turn on WordPress Protection with you and go through the first scan together.

Request a demo