Karetaker is a watchtower, not a wall.
Most security plugins either shout at you all day or quietly lock you out of your own
site. Karetaker does neither. It watches the handful of changes that actually mean
something went wrong, keeps a readable record, and emails you only when a human needs
to act.
What it watches
- Scripts: new external JavaScript domains after a local baseline (home, and cart/checkout when WooCommerce is active)
- Search engine cloaking: once a day, compares your home page as a visitor and as Googlebot, and flags hidden spam links
- Integrity: core and plugin file changes, checked against published WordPress.org checksums
- Options: changes to the settings that matter, plus curated suspicious option names and unusual new autoload names
- Privileges: role and capability changes, new administrators, user promotions
- Uploads: files appearing in
wp-content/uploadsthat do not belong there - Cron drift: scheduled tasks that vanish, stall, or appear from nowhere
- Plugin risk: closed or abandoned plugins on WordPress.org, and plugins whose listed owner changed
- Optional vulnerability lookup: when you enable it, active plugin versions are checked against public WPVulnerability data (off by default)
One-checkbox catastrophes
The quiet business killers that no scanner reports, because technically nothing is “hacked”:
- Search engine visibility switched off
- Site email failing to send
- No administrators left on the site
- Invalid or unreachable admin email
Opt-in hardening, with receipts
A small set of hardening toggles, every one of them off until you turn it on, and
every one reversible from Karetaker Harden. Each toggle shows Desired next to
Live now, so you always see what is actually in effect rather than what was merely
requested.
How it reaches you
- Visibility is pull: the Karetaker admin screen, WP-CLI, or an optional signed REST status endpoint
- Notification is push: email to the site owner, on ACT-severity events only
- Optional Slack / Telegram / Discord / Microsoft Teams: webhooks or Bot API, off until you turn them on
- Optional weekly summary: one short email on Monday mornings, off until you turn it on
- Pause alerts for 1 to 4 hours while you work on the site; one catch-up email afterwards if something needed you
- Client report: printable HTML summary from the Reports tab, emailed to a client only when you press the button
- Hardening is off until each toggle is switched on
Who it is for
- Site owners who want to know their site is fine without reading a dashboard every morning
- Agencies handing a site over to a client, who still need to know if something breaks later
- Maintenance providers who need one read-only status endpoint per site instead of another login
It is deliberately not
- A WAF or request firewall
- A malware signature scanner
- A login lockout or hide-login product by default
- A writer of
wp-config.php,.htaccess, or server config
Agency status endpoint
An optional read-only endpoint at /wp-json/karetaker/v1/status stays off until you
generate a token. The token never grants remote control, status only. Regenerating it
invalidates the old one.
Kill switch
Define KARETAKER_DISABLE as true in wp-config.php, or place an empty file at
wp-content/karetaker-disable. The plugin then boots nothing. Uninstall removes the
plugin’s table, options, and scheduled hooks.
Open source
Karetaker is GPL, built by Team Krikir. It does not phone
home, load third-party scripts, or show ads. Issues and pull requests are welcome.
Credits
Karetaker ships no third-party code, fonts or images. It relies on these projects and services,
and thanks them:
- WordPress and the WordPress.org APIs for core and plugin checksums, plugin directory information, and security keys
- WPVulnerability for the optional public vulnerability database (vulnerability details shown in Karetaker come from WPVulnerability and the sources it links to)
- Simple Icons for the destination logos shown in Settings (CC0 1.0)
- Slack incoming webhooks, the Telegram Bot API, Discord webhooks and Microsoft Teams workflows for the optional alert channels
- PHP_CodeSniffer, WordPress Coding Standards and PHPCompatibilityWP, used during development only
WordPress is a registered trademark of the WordPress Foundation. Microsoft and Microsoft Teams
are trademarks of the Microsoft group of companies. Slack is a trademark of Slack Technologies, LLC.
Discord is a trademark of Discord Inc.
Google and Googlebot are trademarks of Google LLC. Telegram and all other trademarks are the property of their
respective owners. Karetaker is an independent project by Team Krikir. It is not created,
endorsed, sponsored or certified by any of these companies; their names are used only to
describe the services Karetaker can connect to.
Screenshots
Home when something needs you: a plain-language headline and a card per problem, each with "Show me what to do".
Home when there is nothing urgent: worth a look, but it can wait.
Home on a quiet week, because staying silent is the point.
Activity: everything Karetaker recorded, grouped by day and written in plain words.
Protection: optional protections you can switch on or off. None of them can lock you out.
Settings: where alerts go, the weekly summary, a one-hour pause, site type, and Advanced mode for agencies.
The one-minute setup that runs on first activation.