Security monitoring

Watch header hardening, exposed-file and hijacking signals across your roster — and know what to do the moment one fires.

DeadWatch reads the security posture of every site: are the right headers set, is anything exposed that shouldn't be, and is the page being tampered with. It rolls up into a letter grade and surfaces individual events as they happen.

Read the hardening grade

1. Go to Health & Hardening.
2. Each site shows a Grade (A–F) and a Score, with WP Version status where WordPress monitoring is on.
3. Filter by the Grade Distribution chips (A / B / C / D / F / Unknown) or by WP status to find the weakest sites first.
4. Click Check All to queue a fresh pass across the roster.

You'll know it worked when… your roster trends toward A/B grades and no site sits at D/F.

If a site shows no hardening data, enable wordpress or headers monitoring on its Config tab.

Inspect one site's posture

1. Open a site and go to the Security tab.
2. Review:
   • Security Headers and Missing Security Headers — what's set vs. what's absent
   • Weak Configurations
   • REST API Namespaces and Detected Extensions — the exposed surface
   • Security Issues
   • Hijacking Detection — redirect, cloaking, spam injection, and hidden-link signals
3. The Security card in the Watch Tower (Overview) summarizes hardening %, missing-header count, and cloaking similarity.

Watch the integrity feed

Integrity Events is the cross-site stream of everything that fired in the last 7 days.

1. Go to Integrity Events.
2. Filter by pillar — DNS, TLS/SSL, WHOIS, WordPress, SEO, Keywords, Hijacking, Content, Assets, Links — and by status (Success / Warning / Error).
3. Each row shows the site, the check type, the status, and details.

When a security signal fires

1. See it early — add a Notifications rule for the security events: hijacking.detected, forensics.threats_detected, forensics.integrity_failed, forensics.php_fatal, and forensics.updates_available.
2. Confirm it — open the site's Security tab and read the specific finding (which header is missing, what the hijacking detector saw). Automated checks are a strong signal, but verify a critical finding before acting.
3. Act — set the missing header, remove the exposed file, or clean the injection; for a confirmed hijack, treat it as an incident (Convert to ticket from the incident) and rotate credentials.
4. Re-check — click Check All on Health & Hardening (or Run all checks on the site) and confirm the grade recovers and the event clears.

You'll know it worked when… the finding drops off Integrity Events and the site's hardening grade climbs back up.

Next: Teams & client access → to give the right people the right view.