AVAR Server Monitor vs Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

AVAR Server Monitor is a privacy-first WordPress health dashboard, uptime monitor, server diagnostics and security insight toolkit built directly into wp-admin. It helps WordPress administrators understand whether their site is technically healthy, available, secure and running on a reliable server environment — without requiring an external SaaS account. Instead of showing scattered technical data across multiple places, AVAR Server Monitor brings the most important signals into one clear dashboard: uptime, SSL status, PHP and database health, server resources, WP-Cron, security checks, activity log, 404 monitoring, diagnostic exports, database maintenance and more. Know what is wrong before visitors notice WordPress sites often break quietly. A cron task stops running. An SSL certificate gets close to expiration. The database grows. Debug errors are exposed. A plugin update changes something important. A server starts running out of memory. A backup directory may be exposed. A WooCommerce store accumulates technical clutter. AVAR Server Monitor helps you spot these problems early and decide what needs attention first. Site Health Score The main dashboard includes a 0–100 Site Health Score that summarizes the technical condition of your WordPress site. The score is based on weighted categories: Core & Updates Server Environment Security Posture Reliability & Monitoring Performance & Storage The score is not just a decorative number. It includes top issues, recommendations, action links and severity caps for critical problems. For example, if a monitored domain is down, an SSL certificate has expired or a snapshot directory is publicly accessible, the score is capped so the site does not appear healthier than it really is. Monitoring and diagnostics in one place AVAR Server Monitor includes practical tools for everyday WordPress administration: Uptime monitoring for one or more domains. SSL certificate checks and expiration warnings. WP-Cron monitor with overdue event detection. Server resource overview with CPU, memory, disk and database information. WordPress environment overview with versions, plugins, themes and updates. Health Advisor for PHP, database, extensions, cache and connectivity checks. Security audit for HTTPS, debug exposure, file editor status, readme.html, REST API, XML-RPC and login hardening. Core file integrity scan against official WordPress.org checksums. Activity Log for important plugin, theme, update, user and login events. 404 monitor for frequently requested missing URLs. Email alerts for downtime, version changes, resource thresholds and summaries. Diagnostic snapshots for troubleshooting and support. Safe Client Health Report for communicating technical status to clients or hosting support. Database cleanup preview with risk labels, impact descriptions and confirmation flow. Maintenance mode with preview, countdown and role-based bypass. Login security and access control AVAR Server Monitor includes a built-in login security layer, so you can harden wp-admin without adding a separate plugin: Two-factor authentication (2FA) with an authenticator app (TOTP — Google Authenticator, Microsoft Authenticator, Authy and others) and/or one-time codes by email, with the method chosen at login when both are enabled. Includes QR-code setup, one-time backup codes, a “require 2FA by role” policy and an optional “remember this browser” duration. Brute-force protection with escalating lockouts, an IP allowlist and blocklist (CIDR and wildcard support) and manual block/unblock of active lockouts. A persistent, paginated login attempt log with per-IP statistics: failed attempts, incidents, lockouts and successful sign-ins, plus top attacking IPs and most-targeted usernames. A login CAPTCHA on the login, registration and lost-password forms — a privacy-first self-hosted math question with honeypot by default, or optional Cloudflare Turnstile, Google reCAPTCHA v2 or hCaptcha with your own keys. An optional custom login URL that serves the login page from a secret slug and returns 404 for the default wp-login.php. These features run locally and require no external account; CAPTCHA providers are contacted only if you explicitly choose one. Privacy-first approach AVAR Server Monitor is not an external monitoring SaaS platform. Most features run locally inside your WordPress installation. The plugin does not require an AVAR cloud account and does not send local health reports, diagnostic snapshots or server data to AVAR servers. Some features may connect to public external services only when needed, such as the WordPress.org API for checksums and version information, or geolocation providers for server location lookup. Built for safety Because monitoring and diagnostics can touch sensitive areas, AVAR Server Monitor includes a dedicated Advanced Tools safety model. Higher-risk tools are locked by default and require explicit activation. Advanced Tools include features such as: Diagnostic snapshots. Full phpinfo(). wp-config.php debug switches. Cron run/unschedule actions. Database cleanup. Table optimization. Force HTTPS. HSTS. Selected exports and filesystem operations. Sensitive actions use capability checks, nonces, confirmations, safety warnings and safer defaults where appropriate. Safer HTTPS and HSTS handling Force HTTPS and HSTS are not simple checkboxes. They are enabled through protected safety flows with pre-flight checks, host validation and typed confirmation for HSTS includeSubDomains. This reduces the risk of locking yourself out of the site or accidentally applying strict HSTS rules to subdomains that are not ready for HTTPS. Database cleanup with preview Database cleanup can be useful, but it should never feel like a blind “delete everything” button. AVAR Server Monitor analyzes cleanup candidates first and shows what can be removed, the risk level and the likely impact. Riskier actions require typed confirmation. Revision cleanup supports retention rules. WooCommerce content in Trash is detected and order-like records are excluded unless explicitly selected. The plugin uses WordPress APIs where appropriate, such as when deleting posts and comments, so other plugins and WordPress hooks can respond correctly. Diagnostic snapshots Diagnostic snapshots are designed for troubleshooting, support and quick technical review. They use private storage by default when possible, long random archive names, self-healing protection files, public-access checks and safer file exclusions. Snapshots are a diagnostic aid, not a replacement for a full disaster recovery backup strategy. For complete recovery protection, use hosting-level backups or a dedicated backup plugin. Who is AVAR Server Monitor for? AVAR Server Monitor is useful for: WordPress administrators who want a clear technical overview. Freelancers maintaining client websites. Small agencies managing business sites. WooCommerce store owners who want to catch technical risks early. Website owners who want monitoring without an external SaaS account. Developers who need quick diagnostics inside wp-admin. Support teams that need safe technical reports from clients. What makes it different? Many tools focus on only one area: uptime, backups, security, debugging, logs or server information. AVAR Server Monitor focuses on the practical day-to-day question most WordPress administrators have: “Is this site technically healthy, and what should I check first?” It combines health scoring, monitoring, security checks, cron visibility, diagnostics, reports and safer maintenance tools into one privacy-first WordPress dashboard. Typical use cases Use AVAR Server Monitor to: Check whether your site is currently healthy. Monitor uptime and SSL status. See if WP-Cron is running correctly. Review PHP, database and server environment health. Detect security configuration issues. Track important plugin/theme/update activity. Find repeated 404 requests. Export a safe client or support report. Review database cleanup candidates before deleting anything. Create a diagnostic snapshot for troubleshooting. Understand which issues deserve attention first. Important note AVAR Server Monitor provides monitoring, diagnostics and safety-focused maintenance tools. Some Advanced Tools can change configuration, delete data or access sensitive diagnostic information. Read warnings carefully, keep regular backups and test higher-risk actions on staging sites whenever possible. External services AVAR Server Monitor may connect to external services only for specific features: WordPress.org API — used for WordPress core checksums, plugin/theme information and version-related checks. Geolocation provider APIs — used when server location lookup is enabled or requested. The monitored site URLs — used by the uptime monitor to check availability of configured domains. CAPTCHA providers (only if you choose one) — Cloudflare Turnstile, Google reCAPTCHA or hCaptcha receive the challenge token and visitor IP to verify a login/registration attempt. The default self-hosted math + honeypot CAPTCHA uses no external service. The plugin does not require an AVAR cloud account and does not send diagnostic snapshots or local health reports to AVAR servers.

Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate. Really simple, Effective and Performant WordPress Security Really Simple Security is the most lightweight and easy-to-use security plugin for WordPress. It secures your WordPress website with SSL certificate generation, including proper 301 https redirection and SSL enforcement, scanning for possible vulnerabilities, Login Protection and implementing essential WordPress hardening features. We believe that security should have the absolute minimum effect on website performance, user experience and maintainability. Therefore, Really Simple Security is: Lightweight: Every security feature is developed with a modular approach and with performance in mind. Disabled features won’t load any redundant code. Easy-to-use: 1-minute configuration with short onboarding setup. Security Features Easy SSL Migration Migrates your website to HTTPS and enforces SSL in just one click. 301 redirect via PHP or .htaccess Secure cookies Let’s Encrypt: Install an SSL Certificate if your hosting provider supports manual installation. Server Health Check: Your server configuration is every bit as important for your website security. WordPress Hardening Tweak your configuration and keep WordPress fortified and safe by tackling potential weaknesses. Prevent code execution in the uploads folder Prevent login feedback and disable user enumeration Disable XML-RPC Disable directory browsing Username restrictions (block ‘admin’ and public names) and much more.. Vulnerability Detection Get notified when plugins, themes or WP core contain vulnerabilities and need appropriate action. Login Protection Allow or enforce Two-Factor Authentication (2FA) for specific user roles. Users receive a two-factor code via Email. Improve Security with Really Simple Security Pro Protect your site with all essential security features by upgrading to Really Simple Security Pro. Advanced SSL enforcement Mixed Content Scan & Fixer. Detect files that are requested over HTTP and fix them to HTTPS, both Front- and Back-end. Enable HTTP Strict Transport Security and configure your site for the HSTS Preload list. Firewall Really Simple Security Pro includes a performant and efficient WordPress firewall, to stop bots, crawlers and bad actors with IP and username blocks. 404 blocking – Blocks crawlers as they trigger unusual numbers of 404 errors. Region blocking – Only allow/block access to your site from specific regions. Automated and customisable Firewall rules. IP blocklist and allowlist. Security Headers Security headers protect your site visitors against the risk of clickjacking, cross-site-forgery attacks, stealing login credentials and malware. Independent of your Server Configuration, works on Apache, LiteSpeed, NGINX, etc. Protect your website visitors with X-XSS Protection, X-Content-Type-Options, X-Frame-Options, a Referrer Policy and CORS headers. Automatically generate your WordPress-tailored Content Security Policy. Vulnerability Measures When a vulnerability is detected in a plugin, theme or WordPress core you will get notified accordingly. With Vulnerability Measures, you can configure simple but effective measures to make sure that a critical vulnerability won’t remain unattended. Force update: An update process will be tried multiple times until it can be assumed development of a theme or plugin is abandoned. You will be notified during these steps. Quarantine: When a plugin or theme can’t be updated to solve a vulnerability, Really Simple Security can quarantine the plugin. Advanced Site Hardening Choose a custom login URL Automated File Permissions check and fixer Rename and randomize your database prefix Change the debug.log file location to a non-public folder Disable application passwords Control admin creation Disable HTTP methods, reducing HTTP requests Login Protection Secure your website’s login process and user accounts with powerful security measures. Two-Step verification (Email login) 2FA (two factor authentication) with TOTP Passwordless login with passkey login Enforce strong passwords and frequent password change Limit Login Attempts With Limit Login Attempts you can configure a threshold to temporarily or permanently block IP addresses or (non-existing) usernames. You can also throw a CAPTCHA after a failed login (hCaptcha or Google reCaptcha) Access Control Restrict access to your site for specific regions. Add specific IP addresses or IP ranges to the Blocklist or Allowlist. Useful Links Documentation Security Definitions Translate Really Simple Security Issues & pull requests Feature requests Love Really Simple Security? If you want to support the continuing development of this plugin, please consider buying Really Simple Security Pro, which includes some excellent security features and premium support. About Really Simple Plugins Our mission is to make complex WordPress requirements really easy. Really Simple Security is developed by Really Simple Plugins. For generating SSL certificates, Really Simple Security uses the le acme2 PHP Let’s Encrypt client library, thanks to ‘fbett’ for providing it. Vulnerability Detection uses WP Vulnerability, an open-source initiative by Javier Casares. Want to join as a collaborator? We’re on GitHub as well!