The Early Warning Audit automatically monitors your websites for unexpected changes to critical files, software, and services. By detecting changes that may indicate security issues or unauthorized activity, Watchful helps you identify potential problems before they become serious.
Audits run automatically every three hours by default. For more frequent monitoring, you can upgrade individual sites to hourly audits (see below).
What does the Early Warning Audit monitor?
The Early Warning Audit checks for changes across five categories:
| Monitored item | Category |
|---|---|
| Main configuration file | File |
| Main website and administrator index files | File |
.htaccess files | File |
| Active theme or template files | File |
| Installed, updated, or removed plugins, extensions, themes, templates, and languages | Add-on |
| Available software updates | Add-on |
| Backup status, including failed, outdated, or missing backups | Add-on |
| Website URL and IP address | IP/URL |
| Administrative user accounts and privileges | System |
| PHP, database, and web server versions | Service |
| Website availability (uptime) | Service |
File monitoring includes changes to file size, checksum, or modification timestamp.
Administrative user monitoring includes newly created or deleted administrator accounts and changes to existing users’ administrative privileges.
The specific files and settings monitored depend on whether your website uses WordPress or Joomla!.
Audit frequency
Watchful automatically runs the Early Warning Audit every three hours for each monitored website.
You can also trigger an audit manually at any time using the Refresh Data button on the Sites Dashboard.
To view the most recent audit and the next scheduled audit, expand the site’s site drawer on the Sites Dashboard.
Early Warning Audit notifications
When the Early Warning Audit detects changes to monitored files, software, or services, Watchful can send an email notification.
To receive these alerts, ensure that the relevant notifications are enabled in your Watchful account settings.
Not every detected change indicates a security problem. Legitimate software updates, configuration changes, and routine maintenance can also trigger alerts.
Review unexpected changes to determine whether further investigation is necessary.
What happens when a change is detected?
When Watchful identifies a change, you can review the affected website to determine what has changed.
For example, the audit may detect:
- A modified critical system file.
- A newly installed or removed plugin or extension.
- A change to an administrative user account.
- A change to the website’s IP address.
- A change to the PHP or database version.
- A failed or outdated backup.
If the change was expected, such as a planned software update, no further action may be necessary.
If the change was unexpected, investigate the affected website to determine whether corrective action is required.
Early Warning Audit and website security
The Early Warning Audit provides an additional layer of website monitoring by identifying changes that might otherwise go unnoticed.
However, it is not a replacement for regular backups, software updates, or using our dedicated vulnerability and malware scanning tool.
For more comprehensive protection, use the Early Warning Audit alongside Watchful’s Vulnerability Scanner and backup monitoring features.
Upgrade to hourly audits
For websites that require more frequent monitoring, Watchful offers optional hourly audits.
To enable hourly audits for a site:
- Open the
Sites Dashboard. - Locate the website you want to monitor more frequently.
- Open the site’s
Edit Sitemodal. - Scroll to the
Site add-onssection. - Select the
Hourly auditscheckbox. - Save your changes.
Once enabled, Watchful performs the Early Warning Audit every hour instead of every three hours.
You can disable hourly audits at any time by returning to the Edit Site modal and clearing the checkbox.
Hourly audits are an optional paid add-on.