Watchfox AI

Description

Get a plain email when a plugin, theme or WordPress on your site has a known security problem, with what to do and by when. No jargon, and no email when all is quiet.

Watchfox AI keeps an eye on the plugins, themes, WordPress and PHP version on your site. When one of them has a known security hole, it tells you how serious it is and what to do: today, this week, or when you can.

Who it’s for

• Site owners who are not developers and want to know, in words they understand, when something needs updating.
• Small businesses and shops that rely on a WordPress site but have nobody watching it.
• Freelancers and agencies who look after client sites and want security alerts by email in one place (Agency plan).

How it works

1. Install and activate, then enter your email and choose English or Spanish.
2. Every hour your site compares its versions with a public, signed list of known problems. It never changes anything without your OK.
3. When something needs you, you get an email with what to do and the proof behind it. You can also see it any time in WordPress.

Free and paid

Every finding shows in WordPress on every plan, free included. The plan only changes which emails you get.

• Free: 1 site for each email address, one safety-check email a month, and the first “Today” warning each month in full by email.
• Paid (Pro, or Agency for up to 10 sites): checked all day, every day, every warning by email in full with its proof, “This week” and “When you can” warnings, optional early warnings from the news, “Sorted” emails when you fix things, and an optional weekly summary.

Why it is different

• Plain words. Each warning says who is at risk, what to do and by when, so you can act or forward it to whoever looks after your site.
• Proof, not scare. Every warning shows where it comes from, such as a trusted security source and an official ID, so you can check it.
• Early warnings. The AI runs on our service to read public security news, so new problems can be added to the list early; the plugin itself only compares versions and runs no AI.
• Quiet by design. You only hear from us when something needs doing.

What you get:

• A plain page in your WordPress admin that lists what needs doing, with the proof behind each warning.
• An email when something needs you, so you do not have to remember to look.
• Warning emails in English or Spanish, your choice.
• A “Fix it now” button that updates a risky plugin or theme in one click, after you confirm. It saves a copy first and puts it back if your site breaks.
• Auto-fix (free, off until you turn it on): updates plugins and themes with a known security problem by itself, with a backup and an automatic undo.
• After an update, it checks that your home page, login, cart and checkout still work.
• “Is this update safe?”: how the same update went on other sites, before you press the button.
• It never changes anything without your OK.

How it works in detail: Watchfox AI downloads a public, signed list of known problems and compares it with the versions on your site. If you sign up for emails, your site sends back only the problems it found, so we can write to you.

External services

Watchfox AI uses four outside services. Nothing is sent to any service until you finish setup.

1. api.watchfox.site (run by the Watchfox AI team, https://watchfox.site). This is the service behind the plugin. Terms: https://watchfox.site/terms. Privacy policy: https://watchfox.site/privacy.
   • Threat list download: your site fetches the public list (an index and small files). Only the files that match what is installed are fetched. The request carries no account or site details, but each file name is a short hash prefix of an installed item, and your server address is visible like in any web request.
   • Site registration: when you finish setup, your site sends the email address and language you chose, your site address and wp-admin address, and the Watchfox AI, WordPress and PHP versions, so we can email you.
   • Reports: after each check your site sends only the problems it found (an ID, the item folder name, its version, a status, how serious it is, what kind of item it is and its display name), the IDs of warnings a trusted source has withdrawn, your email and warning settings (including which warnings you muted), your wp-admin address (so the “Fix it now” button in an email opens the right page), and the Watchfox AI, WordPress and PHP versions. It never sends your full list of plugins and themes. Reports are signed with a secret that belongs to your site.
   • What Watchfox changed: if you use “Fix it now” or Auto-fix, the next report also says what was done: how many fixes and put-backs there were, and for each one the warning ID, the item folder name and display name, the version before and after, how serious the warning was, whether it worked, could not be checked or was put back (and why), and whether you or Auto-fix did it. On paid plans we use this to email you “Fixed for you” or “We put it back”. No file contents and no backup data are ever sent.
   • Safety ratings: when an update is ready, your site downloads a small public file to see how that update went on other sites. The request carries no account or site details, but the file name is a short hash prefix of the item, like the threat list files. When you use “Fix it now” or Auto-fix, whether the update was kept or put back is pooled anonymously with the same result from other sites. Only rounded totals (such as “100+ sites”) are published, and only once at least 10 different site owners reported the same update.
   • Removal: when you delete the plugin, your site tells the service to stop watching it.
   • Emails and payments: when you press “Send it again” or “Send me a sample warning”, or choose a paid plan, your site asks the service to send that email or to prepare a payment link (with the plan you picked and your site ID).
2. Brevo (https://www.brevo.com), through api.watchfox.site. Brevo delivers our emails (the confirmation, warnings, a sample warning, a weekly all-quiet note, and on paid plans “Fixed for you” or “We put it back” after a fix) from alerts@watchfox.site. Your email address and the name and address of your site are passed to Brevo only to deliver those emails. Terms: https://www.brevo.com/legal/termsofuse/. Privacy policy: https://www.brevo.com/legal/privacypolicy/.
3. Dodo Payments (https://dodopayments.com), only if you choose a paid plan. Your browser opens a Dodo Payments page, the merchant of record, which collects the payment and handles taxes. Card details go only to Dodo Payments, never through your site or Watchfox AI. Cancelling also happens on a Dodo Payments page that the plugin links to. Buyer terms: https://dodopayments.com/legal/buyer-terms. Privacy policy: https://dodopayments.com/legal/privacy-policy.
4. api.wordpress.org (https://wordpress.org). Once a day, for a few plugins that WordPress.org used to list but no longer does, your site asks the WordPress.org plugin information API whether the plugin was closed. Once a week, for each plugin from WordPress.org, it asks when the plugin was last updated, so a plugin nobody has updated for two years can be pointed out. Each request sends the plugin folder name and your server address. When you press “Fix it now” (or Auto-fix runs), WordPress itself downloads the update from its normal update source, exactly as the Update button on the Plugins screen does; Watchfox AI never downloads or runs code from our service. Terms and privacy: https://wordpress.org/about/privacy/.

After an update made with “Fix it now” or Auto-fix, your site also loads a few of its own pages (home, login, and the WooCommerce cart, checkout and a product page if you use WooCommerce) to check that they still work. These requests go only to your own site.

The plugin contains no tracking, ads or hidden links.