內容簡介
SLB-Impact Sentinel 是一款監控 WordPress 外掛更新的工具，能自動檢查更新日誌並評估風險，讓使用者在更新前獲得重要資訊，避免潛在問題。
【主要功能】
• 自動掃描已安裝的外掛並建立清單
• 評估更新日誌的風險並發送電子郵件警報
• 支援手動或定時自動掃描功能
• 根據風險關鍵字分類更新
• 自動讀取外掛的相依性聲明
外掛標籤
開發者團隊
② 後台搜尋「SLB-Impact Sentinel – Addon Monitor & Risk Scanner」→ 直接安裝（推薦）
原文外掛簡介
Impact Sentinel keeps watch over your WordPress plugins so you do not have to. When a plugin updates, it fetches the changelog, scores it against a risk keyword list, and sends you an email alert — before you decide whether to apply or roll back the update.
Know what changed before it breaks anything.
Most WordPress sites apply plugin updates without reading what changed. Impact Sentinel reads the changelog for you, flags risky updates (breaking changes, deprecated APIs, security patches), and gives you the information to make an informed decision — not just a blind click on “Update All.”
How it works
Impact Sentinel runs a scan on your installed plugins — either triggered manually from the dashboard or automatically on a schedule (Pro).
When a version change is detected, it fetches the changelog from the plugin’s readme, the WP.org API, or a configured URL.
The changelog is scored against a tiered risk keyword list — security terms, breaking change indicators, deprecations, and more.
If the risk score meets your configured threshold, an email alert is sent to your team.
No AI required. No external account required. Changelog scanning and email alerts work out of the box.
Plugin Discovery & Inventory
On first run, Impact Sentinel scans all installed plugins and builds a persistent inventory. Classify each plugin by tier — Self-Managed (your code), WP.org (community), or Premium (paid third-party) — and mark which ones you own or actively maintain. Classification context appears on every alert so your team knows what they are looking at.
Plugins can declare their dependencies using the standard WordPress Requires Plugins header. Impact Sentinel reads these declarations automatically and seeds the dependency map without any manual input.
Changelog Scanning
Impact Sentinel resolves changelogs through six sources in priority order:
Manual paste — for plugins behind member portals or login walls, paste the changelog text directly into the alert card
Local readme.txt or CHANGELOG.md — reads the file on disk before making any network request
WP.org API — the structured changelog endpoint, not a scrape
Saved URL — a specific changelog URL you have configured for that plugin
URL probe — automatic HEAD requests to common changelog paths (/changelog/, /release-notes/)
Fallback label — when no text is available, the alert is created with a note to check manually
Risk Keyword Scoring
Changelogs are scored against a tiered keyword list. The high tier includes security-focused terms: CVE, XSS, SQL injection, RCE, authentication bypass, privilege escalation, unauthenticated, vulnerability, and more. Medium and low tiers cover breaking changes, deprecations, and general notices.
The keyword list is fully customizable in Settings — add your own global terms, or set per-plugin overrides with Impact Sentinel Pro.
Email Alerts
When a scan finds a version change and the changelog scores above your configured threshold, an alert is sent to your recipient list. Set the threshold to Critical only, High and above, Medium and above (recommended), or All. Alerts include the plugin name, version arrow, matched keywords, and a changelog excerpt.
Relationship Map & Dependency Matrix
Map which plugins your custom code depends on. The dependency matrix shows which of your owned plugins would be affected if a given third-party plugin introduced a breaking change. Auto-detection scans your plugin source files and proposes likely dependencies. All relationships can be confirmed, dismissed, or added manually.
Work Queue
When an alert is created, a corresponding work queue item is added for your team. Resolve items with notes, set a default assignee, and track what was done about each update.
Pending Updates Panel
The dashboard shows all WordPress-tracked pending updates for your monitored plugins before they are applied — with version arrows and classification badges so you know which updates need a closer look before you click Update.
Pro Features
Impact Sentinel Pro adds automated nightly scanning, Stage 1 and Stage 2 Claude AI impact analysis, Code Graph (maps which of your functions call into updated dependencies), Conflict Scanner, WP Core monitoring, file integrity monitoring, WPScan CVE vulnerability feed, weekly digest emails, queue history, per-plugin keyword overrides, AI model selection, config export / import, and Safe Update pre-update risk analysis (a risk verdict badge on the Plugins page, with the option to block or warn before auto-updates apply).
Learn more at spartanlogicbuilders.com/impact-sentinel/
Features
Plugin discovery and inventory — classify all installed plugins by tier and ownership
Version change detection with configurable minimum bump threshold
Changelog fetch from six sources including local files and WP.org API
Risk keyword scoring — high / medium / low tiers, fully customizable
Email alerts with configurable threshold and multiple recipients
Manual changelog paste-in for premium plugins behind member portals
Relationship map and dependency matrix
Work queue — resolve and track alert action items
Pending updates panel on the dashboard
Scan history with type badges, duration, alert count, and site health check
Manual scan trigger from the dashboard
API key via wp-config.php constant or plugin settings UI (AES-256-GCM encrypted)
Requirements
No external account or API key is required to use Impact Sentinel.
Email alerts use WordPress’s built-in wp_mail function — delivered through whatever mail configuration your site already has.
AI features (Stage 1 and Stage 2 Claude impact analysis) require an Anthropic API key and are available in Impact Sentinel Pro only.
External Services
This plugin connects to the following external services:
WordPress.org Plugin API (Free)
Fetches structured changelog text for plugins listed on WordPress.org.
URL: https://api.wordpress.org/plugins/info/1.0/{slug}.json
Data sent: Plugin slug only. No visitor or site owner data is transmitted.
Privacy policy: https://wordpress.org/about/privacy/
Anthropic API (optional — requires API key)
Used for AI-powered changelog impact analysis (Stage 1 and Stage 2).
URL: https://api.anthropic.com/v1/messages
Data sent: Changelog text and plugin source file excerpts. No visitor data is transmitted.
Privacy policy: https://www.anthropic.com/privacy
WPScan API (optional — requires API key)
Checks installed plugins against known CVE vulnerability records.
URL: https://wpscan.com/api/v3/
Data sent: Plugin slugs and version numbers. No visitor or site owner data is transmitted.
Privacy policy: https://automattic.com/privacy/
Privacy
No data leaves your site by default.
All plugin data, scan results, alerts, and queue items are stored locally in your WordPress database. Impact Sentinel does not transmit analytics, telemetry, or usage data to Spartan Logic Builders or any third party.
Changelog fetching (optional network requests):
When Impact Sentinel fetches a changelog, it makes an outbound HTTPS request to:
* api.wordpress.org — the WordPress.org plugin info API (only for plugins with a WP.org listing)
* A URL you have configured for a specific plugin
* A probe of common changelog paths on the plugin’s declared Plugin URI
These requests are made by the server, not the visitor’s browser. No visitor data is transmitted.
If you enable AI features (optional):
AI analysis transmits changelog text and plugin source file excerpts to the Anthropic API (api.anthropic.com) over HTTPS. No visitor data is ever transmitted. Refer to Anthropic’s privacy policy at https://www.anthropic.com/privacy for details.
WPScan vulnerability feed (optional):
Requires a WPScan API key. Plugin slugs and version numbers are transmitted to wpscan.com to check for known CVEs. No visitor or site owner data is transmitted. WPScan is operated by Automattic — refer to their privacy policy at https://automattic.com/privacy/ for details.
