Tailwatch is a WordPress security and site management plugin that gives you real-time visibility into what is happening on your website.

It combines security, monitoring, and backups into one lightweight system, managed from your WordPress dashboard. Optionally connect a free Tailwatch account to receive event-based push notifications so you stay informed wherever you are.

Core Features

Activity Logs (logins, failed logins, registrations, password resets)
HTTP Error Logs (4xx / 5xx monitoring)
Email / SMTP Logging with custom SMTP server support
Security Hardening Audit
File & Permission Protection
Smart SSL Monitoring & Expiry Alerts
File Integrity Monitoring (baseline + change detection)
Full Site Backups (files and database)
Restore & Migration (put a backup back onto the site, or move a whole site between two installs by carrying the backup across)
Search & Replace (safe database-wide updates with serialized data handling)
Content Restrictions (browser-level protection controls like copy/inspect restrictions)
Database Optimization Tools
Broken Link Scanner
Cron Job Manager
301 Redirect Manager
User Management (create, edit, delete users and manage roles)
Login Defender (IP-based brute-force protection: failed-login throttling, automatic temporary lockouts, login logs kept for 30 days)
Geo-blocking (allow/block individual IPs or IP ranges; whitelist trusted IPs to bypass restrictions)
Username Hardening (audits for common high-risk usernames such as admin and administrator)
Process Monitoring & Recovery (detect stuck long-running tasks and re-schedule them)
Disk Space Monitoring
Event-based Push Notifications

Notifications

Once connected to a free Tailwatch account, your site can send event-based push notifications for:

Login activity (logins, failed logins, registrations, password resets)
Backup completion and backup failures
File integrity changes (added, modified, deleted files)
SSL expiry alerts and certificate status changes
Security Hardening Audit results (scan completed, issues detected)
Security feature configuration changes
Search & Replace completion results
HTTP error spikes (4xx / 5xx monitoring)
Database optimization results
Broken link scan results
Cron job failures
Email delivery (success or failed)
Login Defender events (IPs blocked after repeated failed logins, brute-force attempts detected)

Notifications are delivered to the Tailwatch mobile app using Firebase Cloud Messaging (FCM), routed through api.wptailwatch.com (the plugin does not contact Firebase directly).

Push delivery uses notification credits from your Tailwatch account. When the credits run out, Tailwatch skips the push; the event itself is still recorded in the plugin’s logs.

Tailwatch Pro

Tailwatch Pro extends the free version with:

Malware Guard (cloud malware scanning, suspicious file detection, cleanup, and push alerts for risk-detection events)
Country blocking (allow or block visitors by country, applied to login forms or your entire site)
Role-based Two-Factor Authentication (2FA)
Advanced User Management (account-expiry rules, “login as another user”, per-user 2FA status surfaced in the user list)
Expanded notification credits
Advanced scheduling controls for backups and maintenance tasks
Automatic site-to-site migration (the two sites transfer the backup between themselves, with nothing to download or upload by hand)
Database-only or files-only restore
Priority support

External Services

This plugin connects to several external services. Each service, the data sent, and the conditions under which the connection is made are listed below. Most connections only occur when the corresponding optional feature is enabled by the site administrator.

Tailwatch API (api.wptailwatch.com)

Used for license verification, push notification delivery, and optional deactivation feedback submission. License verification and push notification delivery are active only after you connect a free Tailwatch account from the plugin’s License screen. The deactivation feedback submission is independent of any account connection and is sent only if you voluntarily submit it (see below).

What is sent and when:
– License verification: your anonymized Tailwatch user identifier and your site URL (query string), plus an X-Tailwatch-Header-Key request header containing the license credential issued when you connected your account. Sent on dashboard visits (throttled by a short server-side cache), every 12 hours while your account is connected, and on demand when you click “Verify License”. No system metadata is included in this request;
– Mobile push notifications: anonymized user identifier, your site domain, and the notification type/severity tag, sent to a single relay endpoint authenticated with a per-site routing token (the plugin sends no pre-written title or body; the service composes those from the event context). When mobile notifications are enabled, an event-context payload is also stored on api.wptailwatch.com so the mobile app can show details when you tap a push: the event name and feature, the action and any before/after state change, the timestamp, the IP address and user agent of the request (the acting admin’s, or a visitor’s for events such as failed logins and error pages, together with the username tried), and per-event display fields (for example, an Email/SMTP event’s recipient address and subject line). It never includes message bodies, credentials, tokens, or license keys. This payload stays on api.wptailwatch.com and is not forwarded to Firebase Cloud Messaging (below), which only ever receives the slim title/body/type payload. The Recovery Mode alert for a critical site error is sent whenever your account is connected, even with mobile notifications off; its event context is the HTTP status code and the address of the page that failed.
– Deactivation feedback: site domain, deactivation reason, plugin version, your “keep data / delete data” choice from the deactivation modal, and optional free-form comments — sent only if you voluntarily click “Submit & Deactivate” (the “Skip & Deactivate” button avoids any transmission).

Service provider: WP Tailwatch
Privacy policy: https://wptailwatch.com/privacy-policy
Terms: https://wptailwatch.com/terms-of-services

Tailwatch Dashboard (dashboard.wptailwatch.com)

The web dashboard for your account. Your browser opens it only when you connect or disconnect your site, or follow an account link in the plugin.

What is sent: connecting creates this connection’s credentials (a client ID, client secret and header key that let the dashboard and mobile app manage your site, and a standard WordPress recovery-mode cookie so the dashboard can help you regain access if the site becomes unreachable), then opens the dashboard sign-in page with your site URL, the label “production” and these four credentials in the page address. They reach dashboard.wptailwatch.com before you sign in and can stay in your browser history. Disconnecting opens it with your site URL and account email in the address. License information is stored in your WordPress database after you sign in. If you connect a site directly from the dashboard (remote provisioning), the dashboard sends your license details to your site over an HTTPS request you authorize with a WordPress Application Password approved on your own site; the plugin stores them locally, records who approved the connection and when, and emails the site administrator a connection notice.

Service provider: WP Tailwatch
Privacy policy: https://wptailwatch.com/privacy-policy
Terms: https://wptailwatch.com/terms-of-services

Firebase Cloud Messaging (fcm.googleapis.com)

Used to deliver mobile push notifications to your paired mobile devices. Only active when (a) you have connected a Tailwatch account, (b) you have enabled mobile notifications in plugin settings, and (c) you have toggled on the specific per-feature notification. The Recovery Mode alert needs only (a), so it reaches you even with mobile notifications off.

What is sent: an anonymized device token and the notification payload (title, body, type tag) — routed via api.wptailwatch.com to Firebase Cloud Messaging for delivery to your paired device.

Service provider: Google LLC
Privacy policy: https://firebase.google.com/support/privacy
Terms: https://firebase.google.com/terms

Smart SSL Monitoring — host certificate inspection

The Smart SSL feature connects to your own site’s domain (from home_url()) to read its certificate metadata (issuer, validity dates, chain) and issues an HTTP HEAD probe to detect HTTP to HTTPS redirection. Only your own site is contacted; no third-party service is involved. Disable Smart SSL in plugin settings to stop these requests.

Broken Link Checker — external URL scanning

The Broken Links scanner issues GET requests to URLs found in your own post content, pages, term descriptions, user meta, and options to check whether they return 4xx or 5xx errors. The URLs contacted are controlled entirely by your site’s content; Tailwatch maintains no external list. Disable the Broken Links feature in plugin settings to stop these requests.

MaxMind GeoLite2 database download (download.maxmind.com)

The optional GeoIP integration downloads the MaxMind GeoLite2-Country database so the plugin can resolve visitor IP addresses to a country (used to display the country of an event in the Login Defender logs, and — with the Pro add-on — for country-based access rules). This connection is made ONLY when you have entered your own MaxMind license key on the Integrations screen, and ONLY on an explicit action you take: when you save the key, and when you click “Check for updates”. There is no automatic, background, or scheduled download.

What is sent: your MaxMind license key and the requested database edition (“GeoLite2-Country”), in a request to https://download.maxmind.com/app/geoip_download. The downloaded database file is stored inside your site’s uploads directory. You must obtain your own (free) MaxMind account and license key; the GeoLite2 data is provided by MaxMind under the MaxMind GeoLite2 End User License Agreement. Remove the license key on the Integrations screen to delete the database and stop all such requests.

Service provider: MaxMind, Inc.
Privacy policy: https://www.maxmind.com/en/privacy-policy
GeoLite2 EULA: https://www.maxmind.com/en/geolite2/eula

WordPress.org — plugin, theme, and core updates & rollback

The optional Updates & Rollback feature contacts WordPress.org (api.wordpress.org for available-update and version information, downloads.wordpress.org for packages) to update or roll back your plugins, themes, and WordPress core through WordPress’s own upgrade routines (WP_Upgrader / Core_Upgrader). Only official WordPress.org packages are downloaded; no third-party source is contacted. These requests are made when you open the Updates screen or click Update or Rollback and, if you turn on automatic updates (core limited to minor and security releases), on WordPress’s own auto-update schedule for the types you switch on, while the feature is enabled. Disable the feature (or the individual automatic-update toggles) in plugin settings to stop these requests.

Service provider: WordPress.org (The WordPress Foundation)
Privacy policy: https://wordpress.org/about/privacy/

Third-Party Libraries

Bundled PHP libraries

Tailwatch bundles the following open-source PHP libraries. They run entirely on your server. Each library’s license is named below; all are compatible with this plugin’s GPLv2-or-later license (the Apache-2.0 ones through GPLv3, which “or later” allows).

MaxMind GeoIP2 PHP API + MaxMind-DB Reader — reads a GeoLite2-Country database (which you either download on the Integrations screen using your own MaxMind license key, or upload manually to your site’s uploads directory) to resolve visitor IPs to a country for the IP Management / Login Defender geolocation feature. Runs under the Tailwatch\Vendor\MaxMind\* namespace. Source: https://github.com/maxmind/GeoIP2-php and https://github.com/maxmind/MaxMind-DB-Reader-php — License: Apache-2.0 (full text in Vendor/MaxMind/LICENSE)
Firebase JWT (firebase/php-jwt) — encodes and verifies the signed HS256 JSON Web Tokens that authenticate the Connect REST API (used by the mobile app and cloud dashboard). Runs under the Tailwatch\Vendor\Firebase\JWT\* namespace. Source: https://github.com/firebase/php-jwt — License: BSD-3-Clause (full text in Vendor/Firebase/JWT/LICENSE)

All server-side HTTP requests use WordPress core’s built-in HTTP API (wp_remote_get / wp_remote_post / wp_remote_head). No external PHP HTTP client libraries (e.g. Guzzle) are bundled.

Bundled JavaScript libraries

The plugin’s admin dashboard is a React single-page application. Its compiled bundle in Admin/View/Static/js/ and Admin/View/Static/css/ is built from the following open-source libraries, all under GPL-compatible licenses:

React + ReactDOM (UI framework) — https://react.dev — License: MIT
Redux, Redux Toolkit, and React-Redux (state management) — https://redux.js.org — License: MIT
React Router (react-router-dom) (client-side routing) — https://reactrouter.com — License: MIT
React Hook Form (form state and validation) — https://react-hook-form.com — License: MIT
Axios (HTTP client) — https://github.com/axios/axios — License: MIT
SweetAlert2 (modal dialogs) — https://sweetalert2.github.io — License: MIT
Recharts and react-d3-speedometer (charts and gauges) — https://recharts.org — License: MIT
@tanstack/react-virtual (long-list virtualization) — https://tanstack.com/virtual — License: MIT
react-loading-skeleton, react-top-loading-bar, and @ramonak/react-progress-bar (loading indicators) — License: MIT
react-hot-toast and react-toastify (toast notifications) — License: MIT
react-tooltip (tooltips) — https://react-tooltip.com — License: MIT
react-slick + slick-carousel (carousels) — https://react-slick.neostack.com — License: MIT
lucide-react (License: ISC) and react-icons (License: MIT) — icon sets. The react-icons sets used are Font Awesome Free (CC BY 4.0), Material Design, Remix and Grommet (Apache-2.0), Circum (MPL-2.0), Simple Icons (CC0 1.0) and MIT-licensed sets
@uppy/core (file selection) — https://uppy.io — License: MIT
file-saver (client-side file downloads) — https://github.com/eligrey/FileSaver.js — License: MIT
i18n-iso-countries and countries-list (country names and metadata for country name and flag display) — License: MIT
DOMPurify (HTML sanitisation for user-supplied strings rendered in the dashboard) — https://github.com/cure53/DOMPurify — License: Apache-2.0 / MPL-2.0
prop-types (runtime prop checks) — https://github.com/facebook/prop-types — License: MIT
classnames (conditional CSS class-name joining) — https://github.com/JedWatson/classnames — License: MIT
decimal.js-light (arbitrary-precision decimal math used by the charts) — https://github.com/MikeMcl/decimal.js-light — License: MIT
Tailwind CSS (utility-first styling) — https://tailwindcss.com — License: MIT

Bundled font

Noto Color Emoji (flags-only subset) — a small subset containing only country-flag glyphs, bundled in Admin/View/Static/fonts/ so country flag emoji render consistently across platforms, including Windows (whose system emoji font omits flag glyphs). Source: https://github.com/googlefonts/noto-emoji — License: SIL Open Font License 1.1 (full text in Admin/View/Static/fonts/OFL.txt).

No JavaScript library is loaded from a remote CDN at runtime; the bundle is served entirely from the plugin directory.

Tailwatch – Security, Backups, Monitoring & Management

About this plugin