For web agencies that look after WordPress, Joomla, Drupal and PrestaShop sites
SitePing checks every site from outside, like a visitor, and from inside, with an agent in the CMS. You see new admins, changed core files and PHP hidden in uploads. At night it takes encrypted backups and updates plugins, and if an update breaks the site it goes back to the previous version.
No credit card needed to start.
No port to open on the client's server. Requests are signed in both directions.
Security plugins are also the first thing an attacker switches off. SitePing puts both views together and stores events on its own servers, where someone who breaks into the site can't delete them.
photo.php.jpg.htaccess, index.php, .user.ini and auto_prepend_file, where malware starts before the CMS does.sql backups left in the site folderMany multi-site dashboards are built for WordPress and add other CMSs later. Our agents are native extensions of each CMS and share one core, so monitoring, security and backups reach all of them together.
Joomla 3.10.12 and PrestaShop 1.7.8.11 get no more fixes, and many clients have no budget to migrate right away. Active Shield applies the official fixes released since then, backported file by file from the Joomla and PrestaShop releases. Upgrading is still the real cure: in the meantime the site isn't left open.
| CVE-2024-21726 | Content filter bypass | OK |
| CVE-2024-40749 | Restricted views visible to guests | OK |
| CVE-2024-27185 | Cache poisoning through pagination | OK |
| CVE-2026-74253 | Sourcerer: requests with {source} blocked | OK |
| 70 files | Compared with the official release before writing | OK |
The agent reads what can't be seen from outside: who is an administrator, how the CMS is set up, what sits in the database and in the site folder. Each result says what to do and on which screen.
trusted_host_patterns missing in Drupal| A04 | Super User that Joomla doesn't list | Critical |
| H03 | backup-2025.sql in the site folder | Critical |
| F02 | 2 Super Users without multi-factor authentication | Warning |
| E01 | Database user with rights on the whole server | Warning |
| D04 | HTTPS enforced on the whole site | OK |
When a core file changes you get its exact path, compared with the official release of the installed version. A changed PHP file in the core is critical. An edited template is usually the work of whoever built the site, so it shows up as a warning.
In our tests on clean installs, zero false positives: 3,336 WordPress files, 9,625 Joomla files, 22,269 Drupal 10.6 files and 37,172 files of a PrestaShop 9.2 store.
| libraries/src/Factory.php | Modified | Critical |
| plugins/system/sef/helper.php | Not in the release | Critical |
| templates/cassiopeia/index.php | Modified | Warning |
Whoever injects spam pages usually leaves the home page alone. You find out from hundreds of new URLs in the sitemap, a robots.txt that blocks Google, or a blacklist's red warning screen.
Sudden growth, links to other domains, pages about pills, casinos or loans
Changes, and rules that block search engines
Google Web Risk, Spamhaus DBL and ZEN, SURBL, SpamCop
New A, MX or nameserver records
SEO shield: compares the page served to Googlebot (also checked from inside the site, where cloaking has nowhere to hide) with what a visitor from Google and a mobile visitor get. That is how conditional redirects and hidden links come out. If you like, an AI opinion tells you what to clean up.
A site counts as down only when at least two regions see it down. Warnings and critical alerts go out by email, webhook or Telegram, and when several things happen at once we group them.
Probes in other regions confirm an outage before the critical alert. A firewall that blocks only our IP wakes nobody up.
Link a private chat or a group with a link valid for one hour, and pick warnings and critical, or critical only.
A warning when the hosting disk is 85% full with less than 10 GB left, critical under 512 MB free. Thresholds can be changed per site.
File, line and message of every fatal error, on inner pages and the checkout too.
Lighthouse measures the accessibility of the home page and flags problems that appeared since the last run.
Mobile and desktop scores every week, with an alert when they drop.
Many updates change the database as well, and putting back only the old files leaves the site half broken. Before updating, SitePing saves the plugin's folder and the tables it may touch. If the pages fail afterwards, it puts everything back.
This works today for WordPress plugins and themes. Joomla extensions and staging will follow.
| Site backup | Tonight, 01:30 | OK |
| Restore point | Plugin folder and 3 tables | OK |
| Shop Builder 8.1 to 8.2 | Updated | OK |
| Page checks | PHP fatal error on /shop/ | Critical |
| Rollback | Back on 8.1 in 4 seconds | OK |
The client's server compresses and encrypts the database and files, then uploads them straight to European storage. The work is split into steps of a few seconds, so shared hosting copes.
AES-256, with a different key for each backup. Nothing readable is left on the site or in storage.
From the second backup on, only changed files are sent. Restoring doesn't mean replaying a chain: every backup has the full list of its files.
For example the whole site on the first of the month and the database every night, each kept for as long as you choose. Important backups can be kept forever.
The storage uses Object Lock: until they expire they can't be deleted, even with stolen credentials. With one click we read back every part of a backup and count the database tables, and every 90 days we remind you to test a restore.
Pick the database, the files or both. Before restoring we back up the site as it is now. If you prefer, download .sql.gz and .tar.gz files.
For sites with sensitive data: backups are locked with a key only you have, and without that file nobody can open them, us included. You can decrypt them offline too, from the command line or in the browser.
No shared password files, and no admin accounts made for the agency and then forgotten. The platform asks the site for a login link that works once, for 60 seconds, on that domain only.
Paste the URL and the uptime, SSL, DNS, domain, sitemap and blacklist checks start right away. No plugin needed.
It's a light plugin for WordPress, Joomla, Drupal or PrestaShop. It opens no ports and only answers requests signed with that site's key.
A one-time code links the site to the platform. From then on you get the inventory, security events and integrity checks.
MCM1.eyJ1IjoiaHR0cHM6Ly9hcHAu… Every feature has its own page, with how it works, its limits and the questions agencies ask us.
| WordPress-only dashboards | External scanners | SitePing | |
|---|---|---|---|
| WordPress, Joomla, Drupal and PrestaShop in one dashboard | Rarely | No | Yes |
| Checks from inside: new admins, core files, uploads | Yes | No | Yes |
| Checks from outside: uptime, DNS, blacklists, sitemap spam | Partly | Yes | Yes |
| Joomla core integrity | Rarely | No | Yes |
| One-click admin login | Yes | No | Yes |
| Backups encrypted on the site, incremental | Partly | No | Yes |
| Update rollback including the database | Rarely | No | Yes |
| Joomla 3 and Drupal 7 still in production | No | Partly | Yes |
| Security fixes for Joomla 3.10 and PrestaShop 1.7 | No | No | Yes |
From the public pages of widely used tools, September 2026. Features differ between plans.
The agent only answers requests signed with HMAC-SHA256, with a timestamp and a nonce that works once.
A firewall page or a cached error can't be taken for an answer from the agent.
For the configuration and other sensitive files we only receive hashes, to notice when they change.
While the site serves pages the agent only records fatal errors. The rest happens in small steps, when the platform asks.
The plugin you download only accepts the platform you downloaded it from. A forged connection code can't hand the site to anyone.
Two-factor login is required for every account. On every release, automated tests check that one agency can't read or control another agency's sites.
These features don't exist yet. We list them because agencies ask for them.
Search Console data next to the SEO spam checks, and pages read the way a browser shows them, JavaScript included.
Updates tried on a copy of the site first, screenshots of pages before and after, safe updates for Joomla extensions too.
Agency licences come in blocks of 5 sites, and the price per site goes down as the licence grows. All the sites of a licence get the same tier.
$2.50 per site / month
for the first 5 sites, down to $1.50 from site 41
The agent in every site, for agencies that handle backups elsewhere.
$3.75 per site / month
for the first 5 sites, down to $2.25 from site 41
Essentials plus backups and updates that roll back on their own.
$5.00 per site / month
for the first 5 sites, down to $3.00 from site 41
Pro plus the checks for sites that live on Google traffic or run an old CMS.
$0.00 per month
Uptime monitoring for up to 50 sites, without the agent.
$5.00 per month
One site with the Pro features, for freelancers.
Calculator, brackets and every feature by tier
Prices before VAT and taxes, which checkout adds for your country.
No. Uptime, SSL, DNS, domain expiry, sitemap and blacklist checks only need the URL. The plugin is for what can only be seen from inside: new admins, core and file integrity, vulnerabilities, one-click login.
During page views it only registers a handler for fatal errors. Scans and checks run when the platform asks, in steps of a few seconds, and are built for shared hosting.
After three failed contacts you get an alert, and the outside checks carry on. The last known state of the site stays on our servers.
WordPress 5.0 and later with PHP 7.4 or later. Joomla 4, 5 and 6, plus Joomla 3.9 and 3.10 with a separate plugin that runs even on PHP 7.1. Drupal 7 and 8.9 to 11, PrestaShop 1.7.6 to 9.2.
Yes. Any address can be checked from outside, an API too (with a check on a JSON field), and so can a TCP port such as a mail server. For Laravel, Symfony or custom PHP code there is a connector for PHP 7.1 or later: file scans, upload folders, watched files and configuration checks. It can't check core integrity or vulnerabilities, because a custom application has no official list to compare with.
Monitoring, core integrity and backups work there too. On Joomla 3.10.12 and PrestaShop 1.7.8.11 you can turn on Active Shield, which applies the official security fixes released after end of life. Versions 3.9, 1.7.6 and 1.7.7 first need the last release of their branch. The migration still has to happen, but in the meantime the site isn't left open.
Before updating we save the plugin's folder and the tables it may change, and check the pages. If errors, missing text or PHP fatal errors show up afterwards, we put files and database back and let you know. For three days you can also roll back by hand.
They leave the site already encrypted and stay encrypted in European storage, locked against deletion. Each backup has its own key, which the platform keeps encrypted. If you want, a site's backups are locked with a key you hold: we have only the public half, and without your file nobody can open them.
Wordfence Intelligence for WordPress core, plugins and themes, the Joomla Security Centre for the Joomla core, and OSV.dev (GitHub and drupal.org advisories) together with drupal.org release data for Drupal core and modules. For PrestaShop we use OSV.dev and the Friends of Presta advisories for third-party modules. The same vulnerability published by several sources raises one alert.
Email, webhooks and Telegram, in a private chat or a group. On Telegram each chat gets warnings and critical alerts, or critical only. Slack and Microsoft Teams aren't there yet.
Yes, on the Pro and Complete plans. You give a person of your client a login: they see the status, uptime, backups, updates and monthly reports of their own sites under your name, and they change nothing. Each month they can also get their report by email, as a PDF with your logo.
Connect your first sites today and see what SitePing finds on them.
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.