Monitoring WordPress without installing a plugin
You don’t need code running inside a WordPress install to know it’s in trouble. Most of the tells are visible from the public internet — if you know where to look.
A plugin that watches WordPress from the inside is a plugin that can break WordPress from the inside — and one more thing a client’s next “harmless” update can silently disable. Vigil takes the opposite stance: everything we can learn from outside the install, we learn from outside.
Version drift, from the markup
WordPress leaks its version in more places than most people patch. The generator meta tag is the obvious one, but readme.html, the REST API root, and the query-string versions on enqueued assets all corroborate it. Vigil cross-checks them and flags an install that has fallen behind the current release train.
The endpoints that shouldn’t answer
xmlrpc.php is a brute-force and pingback amplifier that almost nobody needs anymore. A reachable /wp-content/debug.log is a running confession of everything going wrong on the box. Author enumeration via ?author=1 hands an attacker valid usernames. Each is a single request to confirm.
The best WordPress monitoring touches nothing inside WordPress.— the RD-10 design note
Because these checks are intrusive by nature, Vigil only runs them against units whose domain ownership you’ve verified. You can’t point them at a site you don’t control — that gate is built into the engine, not bolted on.