Squish Site Patrol

Squish Site Patrol gives your WordPress site a complete health check — security hardening, malware scanning, login protection, and page speed in a single clean dashboard.

Two-Factor Authentication (2FA)

)

php flow

* Per-user 2FA enrollment with recovery options

Login Protection

* reCAPTCHA v3 on the login page (free tier, no checkbox required)

co

* Magic link login — send a one-time signed login link to your admin email (Patched)

* Failed login attempt monitoring and alerts (Patched)

* Detects predictable “admin” username

Security Checks

* WordPress core version check

* Plugin update status — flags outdated plugins

* SSL / HTTPS detection

* File editor status check (wp-admin editor)

php permissions check (Patched)

* XML-RPC status check (Patched)

* Debug mode detection (Patched)

* Admin account audit — flags inactive admin accounts (Patched)

* Database prefix check — flags default wp_ prefix (Patched)

* Directory listing detection (Patched)

* HTTP security headers check (Patched)

Malware Scanner

* Verifies all 3,000+ WordPress core files against official checksums

* Detects PHP files hidden in your uploads folder

bat) in uploads

* User enumeration vulnerability check

* Flags any modified core files

* Real-time file change monitoring with baseline comparison (Patched)

Email Breach Detection

* Checks admin email addresses against HaveIBeenPwned (Patched)

* Alerts you if any admin account appears in a known breach

Audit Log

* Tracks logins, failed login attempts, plugin installs, settings changes, and scans

* 90-day retention with full event history

* Filter by event type — login, scan, settings, plugin activity and more

* Recent activity strip on the main dashboard

Page Speed & Core Web Vitals

* Live Google PageSpeed Insights score

* Core Web Vitals — LCP, FCP, and CLS

* Mobile performance scoring

* Scan any public URL

* Inline metric explanations

Reporting

* Weekly HTML email reports with a full scan summary (Patched)

* Scheduled automatic daily scans (Patched)

* Email alerts when issues are detected (Patched)

* SSL certificate expiry alerts (Patched)

Dashboard & UX

* Clean two-panel layout — Security on the left, Scans & hardening on the right

* Hardening tab consolidates all Patched checks in one place

* Issues-only toggle on both panels — hide passing checks, focus on what needs fixing

* Rescan button with toast notification (no page reload)

* Dark mode toggle

* Scan spinner and auto-scan status badge

* Score cards hidden by default until first scan runs

* Inline metric tooltips

Performance

* Aggressive transient caching (12–24hr TTL) across all check classes

* Zero front-end footprint — all scans run in wp-admin only

Squish Site Patrol Patched — $15/mo

Upgrade to Patched for automatic monitoring and advanced protection:

• Scheduled automatic daily scans

• Weekly HTML email reports

• Email alerts when issues are found

• Magic link login — passwordless one-time login links

• Failed login attempt monitoring

• SSL certificate expiry alerts

• Real-time file change monitoring with baseline comparison

• Reset file monitoring baseline after legitimate updates

• wp-config.php permissions check

• XML-RPC status check

• Debug mode detection

• HTTP security headers check

• Admin account audit — flags inactive admin accounts

• Database prefix check — flags default wp_ prefix

• Directory listing detection

• Email breach check via HaveIBeenPwned

External Services

Google PageSpeed Insights API

Used to analyze page speed and Core Web Vitals for any URL entered by the user. Data sent: the URL being scanned. This call is only made when the user clicks “Run scan”.

com/speed/docs/insights/v5/about

com/privacy

com/terms

WordPress.org Checksums API

Used to verify the integrity of WordPress core files by comparing them against official checksums. No user data is sent — only the WordPress version number and locale.

0/

org/about/privacy/

ipapi.co

Used to determine the country of origin for login attempts when Geo IP country blocking is enabled. Data sent: the visitor’s IP address. This check only runs on the login page when the feature is active.

co

co/privacy/

HaveIBeenPwned API (Patched only)

Used to check if admin email addresses appear in known data breach databases. Requires a valid HIBP API key configured in settings.

com/API/v3

com/Privacy

com/API/v3#license

Freemius

Used to manage the Patched premium subscription, licensing, and payments. Data sent upon upgrade: site URL, WordPress version, plugin version, and user email if the user opts in.

com

com/privacy/

com/terms/