How to monitor WordPress sites without alert fatigue

说明与用途

配置 WordPress 集群监控，避免警报疲劳：收集详细数据、订阅漏洞信息、使用签名请求和累积故障检测器，并智能路由警报。

问题

Monitoring many WordPress sites generates excessive alerts and noise, making it hard to identify real issues.

结果

By collecting detailed data from each site, signing requests, classifying failures, using an accrual detector, and routing alerts intelligently, the monitoring system reduces alert fatigue and improves incident response for a fleet of WordPress sites.

工作流

• Deploy a small agent plugin on each WordPress site to report version, plugins, themes, admins, server and PHP details.
• Configure the monitoring panel to pull data from each site using a signed RPC endpoint, then admin-ajax.php, then REST API variants.
• Sign every request with HMAC-SHA256, include timestamp and nonce, and reject replays or out-of-window requests.
• Classify failures into types and use a φ accrual failure detector to determine when a site is truly down.
• Stream the Wordfence Intelligence feed and match installed plugins and themes against it every 15 minutes.
• Aggregate pending updates and vulnerability findings across the fleet into a prioritized list.
• Route alerts to appropriate channels based on minimum severity, per-site or fleet-wide routing, quiet hours, daily digest, delivery log, and all-clear messages.
• Test alert delivery and maintain an audit log of all actions.

证据

A homepage returning 200 OK tells you very little. A site can be "up" while it is: running a plugin with a published critical vulnerability, three major versions behind on PHP, about to lose its TLS certificate, or quietly carrying a new administrator account nobody created.

来源

What works better is to have the panel pull data from each site, trying more than one route to reach it: a dedicated, signed RPC endpoint, then admin-ajax.php, then REST API variants, and remember which route works for each site.

来源

Sign every request with HMAC-SHA256 using a secret created when the site is paired. Include a timestamp and a nonce, and reject replays and requests outside a small time window.

来源

Use a φ (phi) accrual failure detector. Instead of a fixed timeout, it learns each site's normal response rhythm and outputs a suspicion level that rises the longer a site stays quiet compared with its own history.

来源

Fleet Sentinel sends these to Google Chat as rich cards titled with the site's name, but the same rules apply to Slack, Teams or email.

来源