> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wisepim.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Watchtower

> Record the platforms, plugins and runtimes your store runs, see which known vulnerabilities affect your versions, and get reviewed warnings by email.

![WISEPIM Security watchtower with the security email toggle and a list of recorded technologies such as WooCommerce, WordPress and PHP marked Version verified](https://mintcdn.com/swiftsyncai/gzdqtcY_QetlL5e0/images/marketing-screenshots/settings/settings-security-watchtower-light-branded.webp?fit=max\&auto=format\&n=gzdqtcY_QetlL5e0\&q=85\&s=a64d786376245fadac7878444353c584)

Security watchtower keeps an eye on vulnerabilities in your store's platforms, plugins and underlying technology. You record what you run, WISEPIM matches it against a database of known vulnerabilities, and a person reviews every warning before it is sent to you. It is included in every plan, Free included.

**What this page enables:** you can see at a glance which known vulnerabilities apply to the exact versions you run, read in plain language what each one means and what to do, and receive a reviewed email when something affects your store.

**Where to find it:** go to **Settings** > **Security watchtower**. It is the last item in the project sidebar, below Team. You need a project selected; without one the page says "Select a project to open Security watchtower."

Three tiles at the top summarize the project: **Recorded technologies**, **Confirmed matches** and **Recent reviewed warnings**.

## Your security emails

The **Email me approved security warnings** toggle is on by default for every WISEPIM user. You can turn it off at any time. It is a personal setting: every member of the project decides for their own address.

A warning email only goes out when two things are true:

* A person at WISEPIM has reviewed and approved the warning.
* The vulnerability affects a version that was recorded and verified in your project.

> [!NOTE]
>
> This toggle is separate from the **Security watchtower** notification type under [Notification Settings](https://docs.wisepim.com/en/settings/notifications.md). That type controls the bell notification in the app. This toggle controls the email.

## Record your technologies

The **Recorded technologies** section lists the exact products and packages your store runs, with their versions. Without a known version WISEPIM cannot tell whether a vulnerability affects you, so this list is the foundation of everything else on the page.

### Automatic discovery from your connections

When you test a store connection under [Integration Settings](https://docs.wisepim.com/en/settings/integrations.md), the watchtower reads the technology behind it and records it for you:

| Connection | What gets recorded |
| - | - |
| **WooCommerce** | WooCommerce, WordPress, PHP and MySQL or MariaDB versions, plus every active plugin by slug and version |
| **Shopware** | The `shopware/core` package and its version |
| **PrestaShop** | The PrestaShop release |
| **Magento 2** | The Magento release |

Discovery needs a clean public HTTPS store URL. Records that come from a connection get the same badges as manual ones, so check them and edit anything that looks off.

### Add a technology by hand

Click **Add technology** to open the **Technology details** form. Fill in:

* **Technology family**: a searchable picker over the catalogue of 184 families. Filter by category: Runtimes, Libraries, Infrastructure, Databases & cache, Message queues, Search, Frameworks, Frontend, Ecommerce, Content management, PIM & product data, Automation, Marketing, Analytics, Operations, Identity & access, Collaboration, ERP & warehouse, Payments, CRM, Shipping and AI services. Search by package name, such as `symfony/http-kernel`, or by an alias, such as `postgres`.
* **Product or package**: the exact ecosystem name. For Composer packages that is the vendor and package, such as `shopware/core`. For WordPress plugins and themes it is the exact name or the wordpress.org slug, such as `elementor`. API versions are not installed software versions.
* **Installed version**: the version you run, for example `6.5.8.2`.
* **Currently in use**: turn this off for software you keep recorded but no longer run. It then shows as **Inactive**.
* **Version evidence**: where you read the version, for example `composer.lock`, your hosting panel or the admin footer.
* **I verified this version against the deployed installation**: tick this once you have checked the version on the live store, not on a staging copy.

Click **Save technology**. Each record shows a status badge:

| Badge | Meaning |
| - | - |
| **Version unknown** | No version recorded. Nothing can be matched until you add one. |
| **Needs verification** | A version is recorded but you have not confirmed it against the live installation. |
| **Version verified** | The version is confirmed. Only verified versions can trigger a warning email. |
| **Inactive** | The record is kept but **Currently in use** is off. |

> [!TIP]
>
> For WooCommerce, WordPress and other platforms with an extension ecosystem, most vulnerabilities live in plugins, apps and themes. Record each one as its own entry in that family, with its exact name or slug and version. The form reminds you of this when you pick such a family.

> [!NOTE]
>
> Vendor-managed services, such as a hosted SaaS tool, show **Vendor managed**. The vendor applies the fixes, so you record them for context only. Their versions are not matched against known vulnerabilities.

The page shows the first 300 technology records. If your inventory is larger, contact support to review the rest.

## Known vulnerabilities in your stack

![Known vulnerabilities in the Security watchtower, each with What it is, What could happen and What to do, badged Affects your version and Actively exploited](https://mintcdn.com/swiftsyncai/gzdqtcY_QetlL5e0/images/marketing-screenshots/settings/settings-security-watchtower-advisories-light-branded.webp?fit=max\&auto=format\&n=gzdqtcY_QetlL5e0\&q=85\&s=a3266d5ae8d630fba58f825c6d4b4cd5)

This section lists up to 50 known vulnerabilities for the technology you recorded. The ones that affect your versions come first, followed by older issues you may not know about. A listed vulnerability does not mean your installation is affected.

Each entry carries one or more badges:

| Badge | Meaning |
| - | - |
| **Affects your version** | The recorded version falls inside the affected range. |
| **Needs checking** | The vulnerability concerns a technology you recorded, but WISEPIM cannot confirm the match, usually because your version is unknown or not yet verified. |
| **Actively exploited** | Attackers are using this vulnerability in the wild, according to CISA. |

Every card explains the issue in plain language:

* **What it is**: the vulnerability in one or two sentences.
* **What could happen**: the realistic consequence for a store.
* **What to do**: the fix, naming the release that closes the issue.

Expand **Show the original report text** to read the source advisory as published, or click **Read the original report** to open it at the source.

When nothing matches, the section says "No known vulnerabilities match your recorded technology yet. That does not prove your store has none."

### How matching works

Matching is deliberately conservative. A warning is only worth something if it is right.

* Versions match on exact numbers or numeric ranges from the advisory. An unknown version never matches.
* WordPress core never matches a plugin or theme vulnerability. A plugin matches only when you recorded it by its exact name or slug.
* Vendor-managed services are never matched.

### Coverage and data sources

The watchtower follows Magento and Adobe Commerce, WooCommerce and WordPress, Shopware, PrestaShop, OpenCart, PHP, MySQL and MariaDB. For WordPress it also includes more than 42,000 plugin and theme records from Wordfence Intelligence, including vulnerabilities that have no fix yet.

Sources are CVE.org, the CISA Known Exploited Vulnerabilities catalogue, OSV, publisher advisories on GitHub, NVD and Wordfence. Each card names its source and license under **Data sources and licenses**. The monitor checks for new and changed records every 15 minutes.

## Understand your technology stack

Below the inventory, **Understand your technology stack** suggests related components worth checking, based on the architecture of what you recorded. Each suggestion tells you the relationship:

* **Extends this platform**: a plugin, app or theme that runs inside a platform you recorded.
* **Built on this technology; verify the deployed release**: a dependency the platform ships with.
* **May use this component; verify the actual configuration**: an optional component that is common but not guaranteed.

It also tells you whether that component is already recorded on the same connection, elsewhere in the project, or not at all. Each suggestion has its own button, such as **Add MySQL**, that opens the form with the family already chosen. **Browse the technology catalogue** opens the full list of 184 families, with **Likely in your stack** highlighted.

> [!WARNING]
>
> Suggestions are not confirmed installations, compatible-version guarantees or security findings. They tell you what to verify, not what you run.

## Warning history and the email

**Recent reviewed warnings** lists your latest 20 approved warning emails that the email provider accepted. Provider acceptance does not confirm inbox delivery, so check your spam folder if you expect one and it is missing.

A warning email:

* Has a subject that starts with "Security watchtower:".
* Opens with "This does not mean your store has been hacked", because it is about a known vulnerability in a version you run, not about an intrusion.
* Carries the same **What it is**, **What could happen** and **What to do** sections as the card on this page, and says "Actively exploited, according to CISA" where that applies.
* Has a **Read the original report** button and a per-project unsubscribe link, which is the same as turning off the toggle above.

Every accepted warning also appears as a bell notification in the app if the **Security watchtower** notification type is on.

## What it is not

Security watchtower is an early-warning service. It is not a penetration test, it does not scan your store for intrusions, and it does not install patches. A warning identifies a known vulnerability in a verified version; your team stays responsible for assessing the guidance, applying the update and checking the result. If WISEPIM does not know your version, it will not guess.

## Permissions

* Project **editors**, admins and the owner manage technology records.
* **Viewers** see the page and the vulnerabilities, but can only change their own email preference. The page says so: "A project editor can manage technology records. You can manage your own email preference."
* The email toggle is always personal, whatever your role.

## Act on what you find

> **A warning email arrived**
>
> Open the project it names and go to **Settings** > **Security watchtower**. Find the card with **Affects your version**, read **What to do** and update to the named release on your store's own update screen. Then edit the technology record with the new version and tick the verification checkbox. The vulnerability drops out of your confirmed matches once the version is outside the affected range.

> **A plugin you run is not in the catalogue**
>
> Pick the platform family it belongs to, such as WordPress or Shopware, and enter the plugin in **Product or package** by its exact name or slug. Plugins you built yourself, or premium plugins that have never had a public report, cannot be matched because there is nothing to match against.

> **A record shows Version unknown or Needs verification**
>
> Look the version up at the source: the admin footer, your hosting panel or `composer.lock`. Edit the record, enter it under **Installed version**, note where you found it under **Version evidence** and tick the checkbox. Until then the record cannot trigger a warning, and matching vulnerabilities show **Needs checking** instead of **Affects your version**.

> **Auto-discovery recorded nothing for your WooCommerce store**
>
> Open [Integration Settings](https://docs.wisepim.com/en/settings/integrations.md), make sure the store URL is a public HTTPS address without extra path segments, and test the connection again. Discovery runs on a successful test.

> **You get too many emails, or none at all**
>
> Turn the **Email me approved security warnings** toggle off to stop emails for this project. If you expect emails and see none, check the toggle is on, check **Recent reviewed warnings** for accepted sends, and remember that only verified versions with an approved warning trigger an email.

## Related

> **[Notification Settings](https://docs.wisepim.com/en/settings/notifications.md)**
>
> Decide whether security warnings also appear as a bell notification in the app.

> **[Security Settings](https://docs.wisepim.com/en/settings/security.md)**
>
> Protect your own WISEPIM login with two-factor authentication and session control.

> **[Integration Settings](https://docs.wisepim.com/en/settings/integrations.md)**
>
> Connect and test your store so the watchtower records its technology automatically.

> **[WooCommerce Integration](https://docs.wisepim.com/en/integrations/woocommerce.md)**
>
> Set up the connection that discovers WordPress, PHP, the database and every active plugin.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.