Daily security, production-readiness, SEO and AI-readiness checks for your WordPress sites. WPSeal turns what it finds into a short list of prioritized fixes, each with evidence, an owner and an effort estimate.
Results arrive in a web console, in reports you can share, and inside Claude.
example-forms 2.4.1 is installed. The issue is fixed in 2.4.3.
Fix
Update example-forms to 2.4.3 or later. WPSeal re-checks the finding when the agent reports the update.
Owner
Developer
Effort
S
Four angles, checked every day
A read-only plugin reports from inside WordPress. External checks run from WPSeal's servers. The rules read both.
Security
Known vulnerabilities in core, plugins and themes
Closed or abandoned plugins and end-of-life PHP
New administrators, missing two-factor, application passwords
Core and plugin file integrity against wordpress.org checksums, PHP files in uploads
Exposed files, user enumeration, security headers, HTTPS and cookies
DNSSEC and CAA; Cloudflare SSL, TLS and origin exposure when connected
Production readiness
Site down, pending core updates, debug output and logs
Cron and Action Scheduler backlogs, autoload size, PHP errors
Email delivery tested end to end, SPF and DMARC
WooCommerce health and payment gateways left in test mode
Cookies and trackers set before consent, JavaScript errors
Core Web Vitals, lab performance and time to first byte
SEO
Indexing switched off, a noindex homepage, robots.txt blocking everything
Sitemaps, sampled across child sitemaps, and failing or noindex sitemap URLs
Titles, meta descriptions, H1s, canonicals, language and hreflang
Invalid structured data and www or non-www canonicalization
Search Console click drops, spam queries, sitemap errors and homepage indexing, when connected
AI readiness
AI search crawlers blocked in robots.txt or at Cloudflare
Homepage content that appears only after JavaScript runs
Search snippets withheld with nosnippet or max-snippet:0
llms.txt errors
AI provider keys kept in the WordPress database
One readiness level with its reasons: Ready, Partly ready, Not ready or Not determined
How it works
Add your site
Add it in the WPSeal console and prove you control it, through the plugin or a DNS record.
Install the agent
Download the WPSeal Agent plugin from your console, activate it and paste the enrollment token. It reports once a day and shortly after security-relevant changes.
Connect what you use
Optional: Cloudflare through a read-only API token, and Google Search Console. Each one adds checks.
Work the list
Findings are ranked by severity and grouped by who should act: you, your developer, your host or Aspida Labs.
Findings you can act on
A monitor that cries wolf gets ignored. WPSeal says what it found, what it could not check, and why.
No false passes. A check that cannot run reports inconclusive, never pass. A check that does not apply to your site, such as WooCommerce health on a site without a shop, reports not applicable.
Evidence with every finding. Each one carries the evidence, the fix, an owner and an effort estimate of S, M or L.
Signals joined across angles. Correlation rules join signals, for example an unpatched plugin on an origin that can be reached around Cloudflare.
Probes read by who answered. WPSeal tells your origin's answer from a Cloudflare block or challenge page, so a path your server refuses reads as not exposed instead of as a failed check.
Gaps on the record. Every report lists the checks that could not run and the reason.
A read-only agent
The WPSeal Agent is a GPL plugin for WordPress 5.8 or later on PHP 7.4 or later. It sends signed reports and changes nothing on your site.
What it reports
Versions of WordPress, PHP, the database, plugins and themes, with their update status
File integrity results as paths and hashes
User counts by role and two-factor status, without names or email addresses
Configuration flags such as debug and file editing, never secret values
Error counts, Wordfence status and WooCommerce health, when installed
What it never does
Send posts, pages, comments, orders, customer data or passwords
Change settings, files or users
Run code sent by the service
Install an update whose release signature does not verify
Each site has its own Ed25519 key, and every request is signed and time-stamped. File contents leave the site only as redacted excerpts for the optional AI review below. To test mail delivery, the plugin also sends a test email through your site's own mailer about once a week, to WPSeal's test inbox only.
Ask Claude about your sites
WPSeal includes a remote MCP server. Connect it to Claude and ask in plain language:
Which of my sites need attention this week? Start with anything critical.
Explain the top security finding on my shop and give me the exact steps to fix it.
What changed in the last 7 days, and does any change look risky?
Eight tools read your sites, findings, reports and action lists. Two write to WPSeal only and need the admin role: requesting a scan, and marking a finding as an accepted risk with a reason and an expiry, a false positive, or open again. The connector cannot change your WordPress sites. Sign-in uses OAuth through Cloudflare Access, and your chats run on your own Claude plan.
Advisory AI, under your control
Code review. When a PHP file is flagged (a plugin file that differs from its wordpress.org release, a modified or unknown core file, PHP in uploads, or a file Wordfence flags), two open models on Cloudflare Workers AI review a redacted excerpt independently. Code checks every quote they make.
Content suggestions. For title, meta description, H1, structured data and llms.txt findings, a small open model drafts replacement text from your public page, on up to three pages per scan.
Report summaries. Add your own Anthropic, OpenAI or Google Gemini key and the model you choose writes the executive summary. WPSeal holds no model key of its own.
AI output sits next to the finding. It never opens, closes or changes one. Owners can turn code review and suggestions off.
Security and data handling
The console and the MCP server sit behind Cloudflare Access, and the service validates the Access token on every request.
Every site operation is authorized against your organization, and each site's data lives in its own isolated store.
Credentials and reports are encrypted with a key per organization (AES-256-GCM). Deleting an organization deletes its key.
Text that comes from a monitored site is treated as untrusted data in the console, the reports and the MCP server.
Monitoring data is stored in Cloudflare's EU jurisdiction.
Plans
Every plan includes all four angles, daily checks, the console, reports and the Claude connector. Contact us for pricing.
Feature
Starter
Pro
Agency
Sites
Up to 3
Up to 10
Up to 50
Search Console checks
Included
Included
Included
Browser checks: cookies and trackers before consent, JavaScript errors, rendered content
Not included
Included
Included
Report summaries with your own AI provider key
Included
Included
Included
On-demand scans per day
2
5
10
Questions
Does WPSeal change my site or block attacks?
No. WPSeal monitors and reports. The agent is read-only, and WPSeal does not sit in front of your traffic, so keep your firewall and security plugin. WPSeal reads Wordfence status when it is installed.
What data leaves my WordPress site?
A signed report of versions, configuration flags, file integrity results as paths and hashes, user counts and error counts. No posts, orders, customer data or passwords. With AI review on, redacted excerpts of PHP files the agent flagged, at most three files an hour, kept encrypted for seven days.
Do I need Cloudflare or Search Console?
No. Both are optional. A read-only Cloudflare API token adds edge checks such as SSL and TLS settings, origin exposure, AI crawler settings and login attack pressure. Search Console adds click, indexing and sitemap signals.
Which WordPress sites are supported?
Single sites on WordPress 5.8 or later with PHP 7.4 or later. Multisite networks are not supported yet.
Where is my data stored?
In Cloudflare's EU jurisdiction, encrypted with a key per organization.
See WPSeal on your sites
Tell us how many WordPress sites you run and who maintains them. We reply within one business day.
