Title: SLB-Impact Sentinel – Addon Monitor & Risk Scanner Author: spartanlogicbuilders Published: August 15, 2026 Last modified: August 15, 2026 --- Search plugins ![](https://ps.w.org/slb-impact-sentinel/assets/banner-772x250.png?rev=3648633) ![](https://ps.w.org/slb-impact-sentinel/assets/icon-256x256.png?rev=3648633) # SLB-Impact Sentinel – Addon Monitor & Risk Scanner By [spartanlogicbuilders](https://profiles.wordpress.org/spartanlogicbuilders/) [Download](https://downloads.wordpress.org/plugin/slb-impact-sentinel.2.2.5.zip) * [Details](https://wordpress.org/plugins/slb-impact-sentinel/#description) * [Reviews](https://wordpress.org/plugins/slb-impact-sentinel/#reviews) * [Installation](https://wordpress.org/plugins/slb-impact-sentinel/#installation) * [Development](https://wordpress.org/plugins/slb-impact-sentinel/#developers) [Support](https://wordpress.org/support/plugin/slb-impact-sentinel/) ## Description Impact Sentinel keeps watch over your WordPress plugins so you do not have to. When a plugin updates, it fetches the changelog, scores it against a risk keyword list, and sends you an email alert — before you decide whether to apply or roll back the update. **Know what changed before it breaks anything.** Most WordPress sites apply plugin updates without reading what changed. Impact Sentinel reads the changelog for you, flags risky updates (breaking changes, deprecated APIs, security patches), and gives you the information to make an informed decision — not just a blind click on “Update All.” **How it works** 1. Impact Sentinel runs a scan on your installed plugins — either triggered manually from the dashboard or automatically on a schedule (Pro). 2. When a version change is detected, it fetches the changelog from the plugin’s readme, the WP.org API, or a configured URL. 3. The changelog is scored against a tiered risk keyword list — security terms, breaking change indicators, deprecations, and more. 4. If the risk score meets your configured threshold, an email alert is sent to your team. No AI required. No external account required. Changelog scanning and email alerts work out of the box. #### Plugin Discovery & Inventory On first run, Impact Sentinel scans all installed plugins and builds a persistent inventory. Classify each plugin by tier — Self-Managed (your code), WP.org (community), or Premium (paid third-party) — and mark which ones you own or actively maintain. Classification context appears on every alert so your team knows what they are looking at. Plugins can declare their dependencies using the standard WordPress Requires Plugins header. Impact Sentinel reads these declarations automatically and seeds the dependency map without any manual input. #### Changelog Scanning Impact Sentinel resolves changelogs through six sources in priority order: * Manual paste — for plugins behind member portals or login walls, paste the changelog text directly into the alert card * Local readme.txt or CHANGELOG.md — reads the file on disk before making any network request * WP.org API — the structured changelog endpoint, not a scrape * Saved URL — a specific changelog URL you have configured for that plugin * URL probe — automatic HEAD requests to common changelog paths (/changelog/, / release-notes/) * Fallback label — when no text is available, the alert is created with a note to check manually #### Risk Keyword Scoring Changelogs are scored against a tiered keyword list. The high tier includes security- focused terms: CVE, XSS, SQL injection, RCE, authentication bypass, privilege escalation, unauthenticated, vulnerability, and more. Medium and low tiers cover breaking changes, deprecations, and general notices. The keyword list is fully customizable in Settings — add your own global terms, or set per-plugin overrides with Impact Sentinel Pro. #### Email Alerts When a scan finds a version change and the changelog scores above your configured threshold, an alert is sent to your recipient list. Set the threshold to Critical only, High and above, Medium and above (recommended), or All. Alerts include the plugin name, version arrow, matched keywords, and a changelog excerpt. #### Relationship Map & Dependency Matrix Map which plugins your custom code depends on. The dependency matrix shows which of your owned plugins would be affected if a given third-party plugin introduced a breaking change. Auto-detection scans your plugin source files and proposes likely dependencies. All relationships can be confirmed, dismissed, or added manually. #### Work Queue When an alert is created, a corresponding work queue item is added for your team. Resolve items with notes, set a default assignee, and track what was done about each update. #### Pending Updates Panel The dashboard shows all WordPress-tracked pending updates for your monitored plugins before they are applied — with version arrows and classification badges so you know which updates need a closer look before you click Update. #### Pro Features Impact Sentinel Pro adds automated nightly scanning, Stage 1 and Stage 2 Claude AI impact analysis, Code Graph (maps which of your functions call into updated dependencies), Conflict Scanner, WP Core monitoring, file integrity monitoring, WPScan CVE vulnerability feed, weekly digest emails, queue history, per-plugin keyword overrides, AI model selection, config export / import, and Safe Update pre-update risk analysis (a risk verdict badge on the Plugins page, with the option to block or warn before auto- updates apply). Learn more at spartanlogicbuilders.com/impact-sentinel/ #### Features * Plugin discovery and inventory — classify all installed plugins by tier and ownership * Version change detection with configurable minimum bump threshold * Changelog fetch from six sources including local files and WP.org API * Risk keyword scoring — high / medium / low tiers, fully customizable * Email alerts with configurable threshold and multiple recipients * Manual changelog paste-in for premium plugins behind member portals * Relationship map and dependency matrix * Work queue — resolve and track alert action items * Pending updates panel on the dashboard * Scan history with type badges, duration, alert count, and site health check * Manual scan trigger from the dashboard * API key via wp-config.php constant or plugin settings UI (AES-256-GCM encrypted) #### Requirements No external account or API key is required to use Impact Sentinel. Email alerts use WordPress’s built-in wp_mail function — delivered through whatever mail configuration your site already has. AI features (Stage 1 and Stage 2 Claude impact analysis) require an Anthropic API key and are available in Impact Sentinel Pro only. ### External Services This plugin connects to the following external services: **WordPress.org Plugin API** (Free) Fetches structured changelog text for plugins listed on WordPress.org. URL: https://api.wordpress.org/plugins/info/1.0/{slug}. json Data sent: Plugin slug only. No visitor or site owner data is transmitted. Privacy policy: https://wordpress.org/about/privacy/ **Anthropic API** (optional — requires API key) Used for AI-powered changelog impact analysis (Stage 1 and Stage 2). URL: https://api.anthropic.com/v1/messages Data sent: Changelog text and plugin source file excerpts. No visitor data is transmitted. Privacy policy: https://www.anthropic.com/privacy **WPScan API** (optional — requires API key) Checks installed plugins against known CVE vulnerability records. URL: https://wpscan.com/api/v3/ Data sent: Plugin slugs and version numbers. No visitor or site owner data is transmitted. Privacy policy: https://automattic.com/privacy/ ### Privacy **No data leaves your site by default.** All plugin data, scan results, alerts, and queue items are stored locally in your WordPress database. Impact Sentinel does not transmit analytics, telemetry, or usage data to Spartan Logic Builders or any third party. **Changelog fetching (optional network requests):** When Impact Sentinel fetches a changelog, it makes an outbound HTTPS request to: * api.wordpress.org — the WordPress.org plugin info API (only for plugins with a WP. org listing) * A URL you have configured for a specific plugin * A probe of common changelog paths on the plugin’s declared Plugin URI These requests are made by the server, not the visitor’s browser. No visitor data is transmitted. **If you enable AI features (optional):** AI analysis transmits changelog text and plugin source file excerpts to the Anthropic API (api.anthropic.com) over HTTPS. No visitor data is ever transmitted. Refer to Anthropic’s privacy policy at https://www.anthropic.com/privacy for details. **WPScan vulnerability feed (optional):** Requires a WPScan API key. Plugin slugs and version numbers are transmitted to wpscan. com to check for known CVEs. No visitor or site owner data is transmitted. WPScan is operated by Automattic — refer to their privacy policy at https://automattic. com/privacy/ for details. ## Screenshots [⌊Configuration — onboarding wizard with Quick Start and Guided Setup options⌉⌊Configuration— onboarding wizard with Quick Start and Guided Setup options⌉[ Configuration — onboarding wizard with Quick Start and Guided Setup options [⌊Dashboard — active high-urgency alert, recent activity panel, and pending updates⌉⌊ Dashboard — active high-urgency alert, recent activity panel, and pending updates⌉[ Dashboard — active high-urgency alert, recent activity panel, and pending updates [⌊Discovery — plugin inventory with tier and ownership classification⌉⌊Discovery— plugin inventory with tier and ownership classification⌉[ Discovery — plugin inventory with tier and ownership classification [⌊Settings — schedule overview with scan frequency and timing configuration⌉⌊Settings— schedule overview with scan frequency and timing configuration⌉[ Settings — schedule overview with scan frequency and timing configuration [⌊Alerts — alert card with full AI impact assessment and keyword highlighting⌉⌊Alerts— alert card with full AI impact assessment and keyword highlighting⌉[ Alerts — alert card with full AI impact assessment and keyword highlighting ## Installation 1. Upload the plugin files to `/wp-content/plugins/slb-impact-sentinel/`, or install through the WordPress Plugins screen directly. 2. Activate the plugin through the Plugins screen. 3. Navigate to Impact Sentinel in your WordPress admin sidebar. 4. Complete Required Setup — set your timezone, email recipients, and alert threshold. 5. Run Discovery to build your plugin inventory. 6. Classify your plugins by tier and mark the ones you own or maintain. 7. Run your first scan manually from the Dashboard. ## FAQ ### Do I need an API key or external account? No. Plugin discovery, changelog scanning, keyword scoring, email alerts, and the relationship map all work with no external account or API key required. An Anthropic API key is only needed for the AI-powered impact analysis features, which are part of Impact Sentinel Pro. ### How does it fetch changelogs for premium plugins? For plugins not on WP.org, Impact Sentinel attempts a URL probe against common changelog paths and lets you save a direct URL per plugin. For plugins whose changelogs are behind a member portal or login wall, you can paste the changelog text directly into the alert card — it is stored and used for all future analysis of that version. ### Does it work for themes as well as plugins? Yes. Discovery includes installed themes. Version change detection, changelog fetching, and alerts work for themes the same way they do for plugins. ### What does the risk keyword scan actually do? It reads the changelog text for the updated version and looks for words and phrases in a tiered list. High-tier matches (CVE, authentication bypass, remote code execution, etc.) generate a high-urgency alert. Medium-tier matches (breaking change, deprecated, removed) generate medium-urgency. Low-tier matches (performance, updated, minor) generate low-urgency. You configure which threshold triggers an email. ### How is the dependency map built? You can add dependencies manually on the Relationships tab, use the auto-detect tool to scan your plugin source files for likely dependencies, or let Impact Sentinel read the standard Requires Plugins header if the plugin declares its dependencies there. ### Will it slow down my WordPress site? No. All scanning happens in the background via WP-Cron (scheduled) or on demand ( manual trigger). No code runs on the front end of your site. ### Is there a Pro version? Yes. Impact Sentinel Pro adds automated nightly scheduling, Claude AI impact analysis, Code Graph, Conflict Scanner, WP Core monitoring, file integrity monitoring, WPScan CVE feed, weekly digest, and more. Available at spartanlogicbuilders.com/impact- sentinel/ ## Reviews There are no reviews for this plugin. ## Contributors & Developers “SLB-Impact Sentinel – Addon Monitor & Risk Scanner” is open source software. The following people have contributed to this plugin. Contributors * [ spartanlogicbuilders ](https://profiles.wordpress.org/spartanlogicbuilders/) [Translate “SLB-Impact Sentinel – Addon Monitor & Risk Scanner” into your language.](https://translate.wordpress.org/projects/wp-plugins/slb-impact-sentinel) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/slb-impact-sentinel/), check out the [SVN repository](https://plugins.svn.wordpress.org/slb-impact-sentinel/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/slb-impact-sentinel/) by [RSS](https://plugins.trac.wordpress.org/log/slb-impact-sentinel/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 2.2.5 * Removed the last locked/restricted-functionality signal flagged under Guideline 5 (trialware): the full AI model list and saved-model lookup were still present as dead code in the Free build’s Claude analyzer class, even though the active code path already hardcoded Claude Haiku and the Settings UI already presented model choice as a Pro feature. That support code (and the equivalent OpenAI/Gemini provider-key and model-list code) is now excluded from the Free build entirely. * Removed an unreachable Pro upgrade-installer method left as a dead stub in the Free build (its AJAX hook was already excluded from Free, but the method itself, including the string “Pro feature”, still shipped) * Removed a Pro-only admin view (owned-plugin file access, used only for Code Graph) that shipped in the Free build as an inert single-line stub file, invisible to normal navigation but still present on disk — a gap in the Free build’s automated orphan-file removal that only caught the more common two-line boilerplate pattern; the build script’s check is now more robust * Corrected the readme.txt privacy disclosures to remove a data-collection entry describing a Pro-only upgrade flow that has no functioning code path in this Free build #### 2.2.4 * Removed the Safe Update pre-update analyzer and plugins.php risk badge from the Free build entirely — this Pro-only feature previously shipped as two unbootstrapped class files with no way to run, which is itself a locked/restricted-functionality signal under Guideline 5; corrected the readme changelog and in-app Free vs Pro comparison to consistently describe it as a Pro feature * Replaced remaining direct fopen()/fread()/file_get_contents() calls on local files with the WP_Filesystem API across Discovery, changelog fetching, and dependency auto-detection, including one instance still flagged after the 2.2.3 fopen()/ fread() swap * Fixed a PHP fatal parse error in the Settings screen license tab (Pro build only; not present in the Free build, which strips the affected code) caused by a stray else with no matching if #### 2.2.3 * Removed remaining locked/restricted-functionality signals flagged under Guideline 5 (trialware): the AI model/provider selection form fields are now correctly stripped from the Free build’s save handler (previously reachable even though the Settings UI already hid them), and 14 Pro-only class/view files that shipped as unbootstrapped stubs are now excluded from the Free package entirely * Reworded Free-tier AI model messaging to describe what Impact Sentinel Pro adds as a separate product, rather than describing Free functionality as “locked” * Replaced direct file_get_contents() calls on local plugin files with fopen()/ fread() across Discovery, changelog fetching, and dependency auto-detection * Corrected an invalid WPScan privacy policy URL in this readme (wpscan.com/privacy returns 404; WPScan is Automattic-owned, now points to automattic.com/privacy) * Activation-triggered background source/changelog resolution now correctly respects the external-requests consent setting before making any outbound request * Version number synchronized across plugin header, version constant, and this readme (previously drifted out of sync between releases) #### 2.2.0 * Added consent card — all external network requests (WP.org API, changelog URL probes, AI analysis) are now gated behind a one-time admin consent prompt on first use * Extracted all inline scripts and styles to enqueued asset files for improved Content Security Policy compatibility * Fixed database migration stability — corrected option read and value serialization in upgrade routines * Plugin renamed to SLB-Impact Sentinel for WordPress.org submission; text domain updated to slb-impact-sentinel #### 2.1.6 * Renamed database columns `claude_summary` and `claude_stage` to `ai_summary` and `ai_stage` (provider-agnostic names; migration runs automatically) * Fixed Google Fonts external import in Help & About page (replaced with system font stack) * Fixed bare function names to use `imsn_` prefix throughout #### 2.1.5 * Fixed update badge JavaScript selector — badge now reliably appears on the WordPress plugins page #### 2.1.4 * Fixed fatal error on plugins.php when WordPress passes null to auto-update filter * Fixed all Settings form fields not saving after v2.1.1 prefix rename * AI analysis tab restructured — provider selector now first, LLM-agnostic labels, updated model lists #### 2.1.3 * Fixed tab navigation broken across all admin views after v2.1.1 prefix rename #### 2.1.2 * Fixed API key not saving after v2.1.1 prefix rename (JS/PHP field name mismatch) #### 2.1.1 * Internal prefix rename for WordPress.org compliance — no functional changes #### 2.1.0 * Added Safe Update: Pre-Update Intelligence — risk verdict badge on plugins.php, blocks or warns before auto-updates based on changelog analysis (Pro) * Multi-provider AI support — Anthropic, OpenAI GPT-4o, Google Gemini selectable in Settings (Pro) #### 2.0.0 * Visual Dependency Map — SVG force-directed graph of plugin relationships (Pro) * WordPress Admin Dashboard Widget — last scan, open alerts, pending updates * Conflict Scanner — detects hook collisions and namespace conflicts between any two plugins (Pro) * Code Graph split into Impact Analysis and Conflict Scanner sub-tabs #### 1.9.2 * Added Schedule tab in Settings — consolidated run time, scan frequency, and a live overview of all seven background jobs and their next scheduled run * Completed Free/Pro tagging pass across all PHP classes, templates, and JavaScript #### 1.9.1 * Security hardening: path traversal fix in plugin access verification, status allowlist on alert update, uncast ID echoes corrected in queue view, unguarded wp_kses corrected in scan history * Fixed wrong API key constant reference (LF_ PS_) in settings template * Applied Free/Pro build markers across admin views, cron class, notifier, alert engine, data port, and main plugin file #### 1.9.0 Initial public release. * Plugin discovery and inventory with tier and ownership classification * Version change detection with configurable bump threshold * Six-source changelog pipeline including Update Interceptor for zip installs * Tiered risk keyword scoring with security-focused defaults * Email alerts with configurable threshold and recipients * Manual changelog paste-in for member-portal plugins * Relationship map, dependency matrix, and auto-detection * Work queue with resolve, dismiss, and default assignee * Pending updates panel on dashboard * Scan history with site health check column * Manual scan trigger * WP event hooks — scan fires automatically on plugin update, activation, auto- update, and recovery mode ## Meta * Version **2.2.5** * Last updated **8 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.0.4** * PHP version ** 8.0 or higher ** * Tags * [alerts](https://wordpress.org/plugins/tags/alerts/)[changelog](https://wordpress.org/plugins/tags/changelog/) [plugin monitor](https://wordpress.org/plugins/tags/plugin-monitor/)[security](https://wordpress.org/plugins/tags/security/) [updates](https://wordpress.org/plugins/tags/updates/) * [Advanced View](https://wordpress.org/plugins/slb-impact-sentinel/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/slb-impact-sentinel/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/slb-impact-sentinel/reviews/) ## Contributors * [ spartanlogicbuilders ](https://profiles.wordpress.org/spartanlogicbuilders/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/slb-impact-sentinel/)