Patchstack Developer

What a vulnerability match shows

Patchstack compares the WordPress core, add-ons, and themes installed on a website with its vulnerability database. The match identifies known issues in those components; the Personal (Free) plan does not perform external checks. Its dashboard covers up to three websites and includes vulnerability notifications, email alerts, remote update management, and snapshot security reports. The security research community can provide up to 48 hours of early warning about newly found vulnerabilities.

Patchstack Developer is a paid plan that builds on this visibility with automatic protection and additional security controls. Detection, logs and analytics, snapshot PDF reports, and email alerts are also included in the Personal plan.

How a finding leads to a vPatch

When Patchstack detects a specific vulnerability in a plugin or theme on a site, it deploys a targeted virtual patch, or vPatch, for that site. Each vPatch is a firewall rule designed to block exploit attempts against the known issue while the vulnerable component is addressed. The rule does not modify the component’s code. Paid plans include access to more than 12,000 individual protection rules for WordPress extensions and themes.

Controls for site-specific security

Developer includes preventive controls that can be configured for a site’s needs:

• Advanced WordPress hardening rules and remote options, including .htaccess, login protection, and reCAPTCHA
• Two-factor authentication and CAPTCHA
• A community IP blocklist of known malicious addresses
• Advanced security settings
• Unlimited custom firewall rules and alert triggers

Developer and Enterprise visitors can make custom protection rules and schedule periodic security reports. Developer also includes Slack alerts and unlimited Patchstack App API usage. The App centralizes security visibility across connected sites, with logs, analytics, and reports available for review.

Connect and manage a site

Install the Patchstack WordPress extension, register in the Patchstack App, add the site, then paste the API key into the plugin. Once connected, review vulnerability findings in the App and configure alerts, reports, hardening settings, and custom rules. The Personal plan also lets users manage core, plugin, and theme updates from the dashboard, with optional automatic updates for vulnerable plugins.