Vulnerability Scanner checks

The Watchful Vulnerability Scanner checks your WordPress and Joomla! sites for security risks, configuration problems, vulnerable software, suspicious files, malware, and other potential issues.

Results from each vulnerability scan are stored in Watchful so you can review previous results, repeat scans, and monitor changes over time.

What the Vulnerability Scanner checks

A vulnerability scan includes the following checks:

• Configuration and security best practices
• Known core and plugin vulnerabilities
• Core filesystem integrity
• File and folder permissions
• Malware signatures
• Website Reputation

Configuration and security best practices

The configuration and security best practices scan checks your site against common security and configuration best practices.

If Watchful detects a problem with your website or server configuration, the issue is displayed in the scan results so you can investigate and correct it.

Depending on your CMS and server configuration, Watchful checks for the following:

• Unsupported PHP versions.
• Presence of two-factor authentication for user logins.
• Presence of the Strict-Transport-Security security header.
• Presence of the X-Frame-Options security header.
• Presence of the Content-Security-Policy security header.
• HTTPS enforcement and certificate expiry.
• Presence of web-accessible .zip or .sql archives in the document root.
• Presence of backend file editors.
• Exposed XML-RPC.
• Enabled debug notices/debug mode.
• Properly configured robots.txt.
• The use of known administrator usernames.
• The presence of .htaccess or web.config.
• Known database table prefixes.
• Additional CMS installations.
• Session lengths longer than 15 minutes.
• Search engine friendly URLs.
• Enabled error reporting/display.
• magic_quotes enabled.
• mod_zlib availability
• mod_xml availability
• Presence of well-known backup restoration scripts.
• Unsafe PHP maximum execution times.
• Presence of installation directories.
• Use of GZIP page compression.
• Use of page caching.
• Changes to configuration files.
• Availability of guest user registration.
• Presence of debug log files.
• Availability of directory browsing in the uploads folder.
• The presence of deactivated plugins or extensions.
• The presence of deactivated themes.
• The presence of the default readme.html file.
• Safe file permissions for configuration files.
• Availability of theme updates.
• Inappropriate information revealed during failed login attempts.
• Database debug mode.
• PHP version information exposed in HTTP headers.
• WordPress version information in meta tags.
• The presence of WordPress security keys and salts.

Known core and plugin vulnerabilities

Watchful checks for known vulnerabilities affecting WordPress and Joomla! core software and installed plugins and extensions.

Detected vulnerabilities are included in the scan results so you can identify affected software and determine what action is required.

Important: Known core and plugin vulnerability detection requires Watchful Premium.

Core filesystem integrity

The core filesystem integrity scan checks whether files distributed as part of WordPress or Joomla! core have been modified or are missing.

If Watchful detects a difference, the affected file path is displayed in the scan results. You can then investigate the change and replace the file with an original copy when appropriate.

File and folder permissions

File and folder permissions determine who can read, modify, or execute files on your server.

Common permissions for PHP-based content management systems include:

• 0644 for individual files
• 0755 for folders

The file and folder permissions scan checks the files and folders in your WordPress or Joomla! installation. Files or folders with unexpected permissions are flagged in the scan results.

Malware signatures

The malware signatures scan performs a deep, server-side scan of your site’s filesystem for common malware signatures and suspicious code.

If suspicious code is detected, Watchful displays the affected file and the suspicious pattern in the scan results.

Website Reputation

The reputation scan checks whether the website is associated with known phishing, malware, or other online threats.

Sites that have been flagged as unsafe will receive significantly less traffic, and most browsers will display strong warnings to visitors.

Watchful’s malware signature and website reputation checks use our own, GDPR-compliant scanning infrastructure. These checks do not require sending your website’s data to third-party scanning APIs, improving privacy while giving Watchful greater control over detection and reporting.

Ignore detected issues

Not every detected issue requires action. For example, you may determine that a particular result is expected for your site or represents a risk you have chosen to accept.

Watchful allows you to ignore a detected issue:

• On a single site
• Across all sites in your Watchful dashboard

Important: Ignoring an issue does not resolve the underlying condition. Only ignore a result after reviewing it and determining that no action is required.

Automate vulnerability scans

You can run vulnerability scans manually whenever you need them.

Watchful Premium also allows you to automate vulnerability scans so your sites are checked regularly without starting each scan manually.

Automated vulnerability scans run every 3 days by default. You can change the frequency for each website, choosing an interval from 1 to 7 days, or disable automatic scanning entirely.

Set the automatic scan frequency

To configure automatic vulnerability scans for a website:

1. Open the Sites Dashboard in Watchful.
2. Locate the website you want to configure.
3. Open its Vulnerability Scan History window.
4. Locate the Automatic vulnerability scan frequency dropdown near the top of the window.
5. Select your preferred interval:
   • Disabled — Turn off automatic vulnerability scans.
   • Every 1 day — Scan daily.
   • Every 2 days through Every 7 days — Scan at the selected interval.
6. Watchful saves your selection automatically and displays a confirmation message.

You can change the frequency at any time by returning to the same window. The setting applies only to the selected website and does not affect other sites in your Watchful account.

Disabling automatic scanning does not prevent you from running manual vulnerability scans using Start New Scan.

Important: Automated vulnerability scans require Watchful Premium.

Enable Vulnerability Scanner notifications

Watchful can send email notifications when a vulnerability scan detects new security issues on your website. These notifications are separate from automated scans and are disabled by default. You must explicitly enable them to receive alerts.

To enable Vulnerability Scanner notifications:

1. Open the Sites Dashboard in Watchful.
2. Select Account Dashboard from the left sidebar.
3. Open Settings and select the Notifications tab.
4. Scroll down to the Security Audit section.
5. Enable the New security issue checkbox.
6. Click Save notification settings to apply your changes.

After enabling notifications, the first vulnerability scan establishes a baseline of your site’s security status. This initial scan does not trigger an email notification, even if security issues are detected.

Subsequent scans, whether started manually or run automatically, are compared against the baseline. Watchful sends an email notification only when a negative change is detected, such as a newly identified security issue.

Important: No email is sent when scan results remain unchanged or when your site’s security improves. This ensures that notifications highlight new problems requiring your attention rather than repeating existing findings.

Scan history and retention

Watchful stores vulnerability scan results so you can review previous scans and monitor changes over time.

Scan results are retained according to your Watchful plan:

Plan	Retention
Free	7 days
Legacy	30 days
Premium	90 days

Troubleshooting

If a vulnerability scan does not complete successfully, see Troubleshooting the Vulnerability Scanner.