Patchstack compares the WordPress core, extensions, and themes installed on a site with its vulnerability database to identify known issues. Its Personal (Free) plan includes vulnerability detection, email alerts, remote update management, snapshot security reports, and a central dashboard for up to three sites. The security research community can provide up to 48 hours of early warning about newly found vulnerabilities.

Automatic protection with vPatches

Patchstack Developer is a paid plan that adds automatic vulnerability protection. When Patchstack detects a specific vulnerability in a plugin or theme on a website, it can deploy a targeted virtual patch, or vPatch, for that site. These firewall rules are designed to block exploit attempts without modifying the vulnerable component’s code. The paid plans include access to more than 12,000 individual protection rules.

Developer and Enterprise also include advanced hardening settings, two-factor authentication, CAPTCHA, a community IP blocklist for known malicious addresses, and advanced security settings. These controls work alongside vulnerability detection to help teams manage protection across their WordPress websites.

Alerts, reports, and custom rules

The Patchstack App delivers a central view of connected sites, findings, logs, and analytics. Developer includes email and Slack alerts, weekly or monthly PDF security reports, unlimited custom firewall rules, unlimited custom alert triggers, and unlimited Patchstack App API usage. The Personal plan already includes email alerts and snapshot reports.

Who uses Patchstack

Agencies can monitor customer sites covered by WordPress care or maintenance plans. WooCommerce site owners can track vulnerabilities as part of their security work, and hosting companies can apply targeted protection across sites. Individual site owners can review findings and reports through the App.

Install and connect

1. Install the Patchstack extension on the WordPress site.
2. Register in the Patchstack App and add the site.
3. Copy the API key into the plugin.

After connecting, review the security overview and configure alerts, reports, hardening settings, and custom rules for the site.