Vigil Health & Cron Monitor for WordPress
A health check endpoint for your WordPress site that any monitoring tool can read, the same checks in Tools › Site Health, and a dashboard widget. It works on its own: no account, nothing sent anywhere until you choose to connect it.
What it does for free
Health endpoint
GET /wp-json/vigil-health/v1/health, protected by a random secret created on activation (send it in the vigil-health-secret header). The answer is JSON in the Oh Dear health format, so Oh Dear, Vigil or any tool that can read a JSON field can poll it.
{"finishedAt": 1759480000, "status": "warning",
"checkResults": [
{"name": "database", "label": "Database", "status": "ok",
"notificationMessage": "", "shortSummary": "3 ms", "meta": {"query_ms": 3}},
{"name": "cron", "label": "WP-Cron", "status": "warning",
"notificationMessage": "4 scheduled events are late by up to 22 minutes.",
"shortSummary": "4 overdue (oldest 22 min)", "meta": {"overdue_events": 4}},
...]}
HTTP 200 whenever the secret is right, so "the site answered and the database is slow" is not confused with "the site is down". Wrong or missing secret: HTTP 401 and nothing else.
Nine checks
| Database | Connectivity and the time of a trivial query: warning from 500 ms, failed from 2 s. |
| WP-Cron | DISABLE_WP_CRON, number of overdue events and the oldest one's age. Overdue by an hour means cron is not running. |
| Updates | Pending core, plugin and theme updates, read from WordPress' own update data. |
| PHP version | Compared with the official PHP end-of-life dates; warns 90 days ahead. |
| Disk space | Free space on the disk holding wp-content/uploads. |
| Object cache | When Redis or Memcached is installed: a write and read-back round trip. |
| HTTPS and site URL | Site address and WordPress address on the same host, both on https. |
| Debug mode | WP_DEBUG (and WP_DEBUG_DISPLAY) on in a production environment. |
| Uploads writable | The uploads directory exists and PHP can write to it. |
They also appear as Site Health tests and in an admin dashboard widget. Developers can add checks with the vigil_health_check_results filter.
Install
- Download vigil-health.zip.
- In WordPress go to Plugins › Add New › Upload Plugin, choose the zip, then Activate.
- Open Settings › Vigil Health. You will see the checks, the endpoint URL and its secret.
- Try it:
curl -H "vigil-health-secret: YOUR_SECRET" https://example.com/wp-json/vigil-health/v1/health
Optional: alerts from Vigil
If you want to be told when something breaks, paste a Vigil API key (Settings › API keys in Vigil; the free plan is enough) under "Alerts with Vigil" and tick the consent box. The plugin then:
- creates an App health monitor in Vigil that polls your endpoint with the secret, and alerts per check ("Database is failed"), not just "site down";
- creates a heartbeat monitor and pings it every hour from WP-Cron, so you hear about it when WP-Cron stops running; when a check is failing the ping goes to /fail with the check names;
- shows both monitors' status in the dashboard widget.
It uses Vigil's public REST API (/docs): POST /api/v1/monitors to create the two monitors, PUT /api/v1/monitors/{id} to keep the URL and secret in sync when you generate a new secret, and /ping/<token> for the heartbeat. Alerts go to whatever channels you set up in Vigil: email, Slack, Telegram, WhatsApp, webhooks and more. Running Vigil yourself? Enter your own address next to the key.
What is sent: the API key, the endpoint URL and secret, the site's host name, and once an hour the name, status and one-line summary of each check. No posts, users or visitor data. Disconnect removes the key from your site and can delete the two monitors. Terms · Privacy.
Create a free Vigil account What else Vigil monitors
FAQ
Do I need a Vigil account?
No. The endpoint, the Site Health tests and the widget work without one. The connection only adds alerting.
My site has little traffic. Will the WP-Cron heartbeat raise false alarms?
WP-Cron only runs when someone visits. If your site can go 90 minutes without a visit, call wp-cron.php from a real cron job and set DISABLE_WP_CRON; the heartbeat then tells you when that job stops.
Is it on wordpress.org?
Not yet: the wordpress.org listing is coming soon. Until then, install the zip from this page.