WordPress monitoring for the AI era — every patch is a chance to break.
More vulnerabilities means more urgent updates to core, plugins and themes — and each one can silently take down checkout, login or payments. Relvato re-verifies your critical flows after every change, so an update never costs you sales.
The update treadmill is speeding up.
Security reports to WordPress’s bug-bounty program held at 20–30 a month for about a decade, then reached 450 in July 2026 and 773 in August as researchers pointed AI models at WordPress (The Repository). Staying secure means updating more often — and every update is a chance to break.
AI finds more vulnerabilities
One September 2026 fix shows the new kind: Click2Shell, found with Claude Opus 5 and a human researcher, let a single link opened by a signed-in administrator install a theme from the official directory and run its code. Patched in WordPress 7.1.1 (write-up).
So you update more often
Every disclosed vulnerability is another urgent core, plugin or theme update you can’t safely skip.
And every update can break things
A patched plugin shifts a selector, a theme update moves a button, WooCommerce bumps a version — and checkout quietly fails.
Relvato keeps you ahead
It re-verifies checkout, login and payments after every change, in a real browser; points out who could do damage with one click — too many or dormant administrators, unused themes and plugins left installed; and alerts you the second something breaks.
Every plugin update is an unattended deploy to your checkout.
No software team ships to production without review, tests and someone watching. A WordPress plugin update skips all three — straight into the site that takes your orders. A typical store gets twenty or thirty of them a month, often at 3am, with nobody awake to notice.
| A deploy at a software company | A plugin update on your store | A plugin update with Relvato | |
|---|---|---|---|
| Reviewed before it goes live | Code review by the team | Not by anyone on your side | Not before — but tested the moment it lands |
| Tested on your setup | Automated tests and staging | Never with your theme, plugins and payment gateway | Your real checkout, login and pages, in a real browser |
| When it goes live | Planned, during working hours | Whenever WP-Cron runs — often overnight | Whenever WP-Cron runs — re-checked within minutes |
| Who is watching | An on-call engineer and monitoring | Nobody | Relvato, after every single update |
| How a break is found | An alert, within minutes | A customer, a support ticket or a dip in sales — days later | An alert within minutes that names the update |
What breaks at 3am — and what we catch
- A checkout field, the pay button or a payment gateway disappears after a plugin or WooCommerce update.
- Customers can’t log in or reach their account after a security or membership plugin updates.
- A theme or page-builder update shifts the layout and hides your add-to-cart or contact form.
- A PHP incompatibility puts a critical-error screen where a product page used to be.
- An SEO plugin update adds noindex or rewrites robots.txt, and pages start dropping out of Google.
- Order-confirmation and password-reset emails quietly stop sending.
How that saves you money
- Hours of lost sales, not days. A checkout that breaks at 3am is flagged by morning — not after a weekend of abandoned carts.
- No manual testing after every update. Relvato does the click-through you would otherwise do yourself, or pay someone to do, twenty or thirty times a month.
- Fixes in minutes, not investigations. The alert names the update that ran and shows the failing step — and Relvato suggests the rollback: one click in WordPress → Relvato puts the previous version back and holds the bad one so it isn't reinstalled.
- Updates stay on. Security fixes keep landing within hours, so you avoid the far bigger bill of cleaning up a hacked store.
More on why switching updates off is no longer the safe option: why you can’t afford to disable WordPress auto-updates.
Event-driven, not once a day.
Most monitoring runs on a schedule, so a 9am change goes unnoticed until the nightly run. Relvato’s plugin signals the change and the affected monitors re-run in seconds.
Install & connect
Install Relvato from WordPress.org and click Connect with Relvato — sign up or sign in, confirm the site, and you're back in WordPress, connected. No token to copy.
It signals every change
Plugin updates, theme switches, WooCommerce upgrades, deploys — the plugin reports the exact change to Relvato.
Relvato re-verifies
Only the monitors that touch that change re-run, in a real Chrome, and you’re alerted the second one breaks.
Checks that need more than a public page.
Public-page monitors work on any site. The plugin adds the authenticated, stateful flows that actually make you money.
Logged-in checkout
Add to cart → pay as a real, signed-in customer — not just a guest.
Payment methods
Every gateway you offer stays available at checkout.
Customer login
The real login form reaches the account area.
Order & reset emails
Confirmation and password-reset emails actually send and deliver.
File integrity
Core & wp.org plugin files match their official checksums.
Background jobs
Action Scheduler keeps draining — no stalled emails or stock sync.
Vulnerability scan
Installed plugins checked for known vulnerabilities and abandonment.
Real-user Web Vitals (RUM)
LCP/INP/CLS from real visitors, p75 per template.
Activity log
Sign-ins, failed logins, updates and setting changes, kept outside WordPress where an intruder can't erase them.
Safe auto-updates
Plugins updated one at a time in your window, verified by your monitors, rolled back if one breaks something.
AI abilities
On WordPress 6.9+, your AI assistant reads monitors, gets fix briefs and reruns them.
AI ability audit
Every ability your plugins give AI assistants, flagged when anyone can run it.
Three steps to continuous verification.
- Install Relvato from WordPress.org: in WordPress, open Plugins → Add New Plugin, search for “Relvato”, then install and activate it.
- In WordPress, open Relvato → Settings and click Connect with Relvato.
- Accept the recommended monitors — Relvato calibrates the rest.
Already relying on WordPress' built-in Site Health? It checks your configuration — but never loads your checkout, your layout or your real-user speed. See exactly what Site Health can't catch, and why Relvato is the continuous safety net around it.
Malware often comes back within hours of a clean-up. Quarantine mode watches files, admins, settings and scheduled tasks for 48 hours and alerts you the moment something changes.
Run a store? See the checkout, payment and order flows Relvato monitors on WooCommerce.
Stop letting updates break your store.
Free forever on one site — 100 runs a month, started by you or weekly, no card. Pro re-runs your monitors by itself after every update.