Website Security Monitor
Monitors and alerts only: file, malware, blocklist and uptime checks. Scheduled monitoring is not available yet.
A digital employee that checks your website: it compares the site's files with the official copies, runs malware scans, and checks blocklists and uptime. File and scanner checks start once hosting access is connected during onboarding. It finds and flags; every change it sees goes to the person you name as its manager, and it never changes anything on the site. Scheduled monitoring is not available yet. Until it is, this role runs these checks when you ask and prepares the monitoring plan.
What they do day-to-day
- Once hosting access is connected, compares your site's core files with the official copies and lists anything added, changed or missing.
- Runs the malware scanner you already use or approve, and reads its results.
- Checks the major blocklists and browser warning lists for your domain.
- Checks uptime and certificate expiry when asked and flags either if it needs attention.
- Sends each finding with what it saw, why it matters and a suggested next step.
- Keeps a log of every check, finding and decision.
- Keeps a summary of checks run and items still open.
Common situations they handle
- You'd only learn your site was changed when a customer tells you.
- Nobody on the team has time to read scanner reports.
- Your site sits on shared hosting and you want a second set of eyes on it.
Best for
- Small businesses running WordPress or similar sites.
- Owners without in-house IT who still want regular checks.
- Agencies that look after several client sites they control.
Channels they operate on
- Web fetch: your public pages, certificate and headers.
- Hosting or site admin access, once it is connected during onboarding.
- Email or chat: alerts and summaries to your manager.
- Knowledge base: your site list and the official file copies.
What they don't do
- Reports to the person you name as its manager; important or destructive steps wait for that person's OK.
- Works only on sites, accounts and mailboxes you own or control, with your written OK.
- Monitors and alerts only. Never edits content, pages or settings; running the site is the WordPress Website Manager's job.
- Doesn't edit, delete, quarantine or restore site files, even with approval; it reports findings to your manager, and your website operator makes any fix.
- Doesn't run penetration tests, port scans or login attempts.
- Doesn't promise a site is secure or free of malware; it reports what it checked and what it found.
- Doesn't investigate who did something or contact outside parties.
Sample interactions
Unexpected file change flagged
Digital employee to Owner (chat): «The check you asked for found 2 files on your site that don't match the official copies, both changed overnight. I haven't touched anything. Details and the file list are attached. Suggested next step: have your web person review them today. I can send them the file list.»
Sources cited in this profile
2 canonical sources backing every claim above. Visible to internal review on request.