Siteward

Siteward is a lean, self-hosted dashboard to manage multiple WordPress sites from one place, a no-bloat way to monitor uptime, run fleet-wide core, plugin and theme updates, watch UpdraftPlus backups and WP-Cron health, and catch critical errors across every site you maintain. It’s a free, unlimited-site alternative to hosted maintenance services, with no per-site fees and no third-party cloud: you own the control panel.

Install it on one central WordPress site, add the free Siteward Child plugin to each site you manage, and connect them with a one-time secure handshake. Then manage everything from your dashboard:

• Vulnerability monitoring: every installed plugin, theme and core version is checked against a live feed of known vulnerabilities, with severity, CVE and the version that fixes it. Free, no API key, no account.

• Uptime monitoring: each site is checked on a schedule; retry-then-alert avoids false alarms, you get an email the moment a site goes down or recovers, and every site shows its uptime over the last 24 hours, 7 days and 30 days.

• Fleet-wide updates: see every pending core, plugin and theme update in one place and apply them one-click or in bulk, with a live progress view.

• Critical-error detection: catches HTTP 5xx errors and the WordPress “critical error” white screen.

• Backup monitoring: see each site’s latest UpdraftPlus backup and get alerted when backups are missing, stale, or failing.

• WP-Cron & health flags: surfaces overdue cron events, recovery mode, plugins/themes auto-paused after a fatal error, and Site Health critical issues.

• Site notes: keep client contacts, hosting details or anything else on each site’s page, searchable from the Sites list.

• Secure & self-hosted: the dashboard initiates all traffic; every request is signed with an OpenSSL keypair and protected against replay. Your data never routes through a third-party cloud.

Every feature above is fully functional and free. Unlimited managed sites. No per-site fees.

com

Siteward Pro (optional, sold separately): an add-on that adds fleet plugin management (bulk activate, deactivate, install and uninstall plugins across sites), SSL certificate & domain-expiry monitoring, a Dynamic Notification Engine that groups a whole server’s outage into a single alert, and Zapier webhook notifications.

External services

This plugin downloads a vulnerability data feed so it can tell you which of your managed sites are running software with a known vulnerability.

com/wp-json/omnis-updates/v1/vulnerabilities (and a small /vulnerabilities/meta document used to check whether the feed has changed since the last download). It is requested twice a day, and when you press “Refresh & rescan” on the Vulnerabilities screen.

These are plain downloads. No data about your managed sites or the software installed on them is sent: the matching between the feed and your sites happens entirely on your own server. com can see the dashboard’s IP address and its web address, which WordPress includes in its standard User-Agent header.

Server logs holding these are kept for 7 days.

, and redistributed under its terms. com/terms/

Vulnerability records that originate with MITRE carry MITRE’s copyright notice, and records from Defiant carry Defiant’s; both are displayed on the Vulnerabilities screen, as their licences require.

php (or return false from the siteward_vuln_feed_enabled filter). Vulnerability detection then stays off. No other feature of the plugin contacts an external service: uptime checks, syncs and updates only talk to the sites you connect.