Skip to the content
WellKept

// Server patch posture

Know what needs patching before it matters.

WellKept watches the servers and sites you look after. A small read-only agent reports what is out of date, exposed or about to expire. Every finding comes with the exact commands to fix it.

Start free Read the docs

Free for 2 servers. No card to start.

// Install

$ curl -fsSL https://wellkept.fullwerks.co.uk/install.sh | sudo bash -s -- --token wk_enrol_…

One command, run on the server as a user who can use sudo.

EXAMPLE FINDING

High

5 security updates are waiting on web-1

The flaws they fix are public. A server with known-vulnerable packages is the easiest way into a client's site.

# Fix, from the playbook
sudo apt-get update
sudo apt-get install --only-upgrade openssl libssl3 …
0
Ports the agent opens
4
Read-only commands as root
26
Checks, each with a playbook
5 min
Between full reports

Counted from the agent's sudoers file, the check catalogue and the agent's default intervals. Ubuntu and Debian servers only for now.

// How it works

From a server you have not looked at in a month to a list you can work through.

  1. // 01 Install

    Run one command

    Add a server in the dashboard and copy the command it gives you. The installer checks the agent's signature, creates an unprivileged user and starts the service. The server appears as soon as the agent enrols.

  2. // 02 Report

    The agent reads, and reports

    Every minute it says it is alive. Every five minutes it sends the server's posture: pending updates, SSH and firewall settings, PHP versions, what is listening where, and the sites the web server serves.

  3. // 03 Fix

    Follow the playbook

    Each finding says why it matters, what to check first, the exact commands for your distribution, how to verify the fix and how to undo it. Press Re-check now and the finding clears when it is true no longer.

// What it watches

The server, the sites on it and the view from outside.

On the server

  • Pending and security updates, and reboots that are due
  • SSH root login and password logins
  • An inactive firewall, a missing fail2ban
  • PHP versions past end of life
  • MySQL, Redis or PostgreSQL listening on a public address
  • Disk and inode use, broken apt repositories, errored PM2 processes
  • WordPress core behind the current release
  • Known vulnerabilities in WordPress core, plugins and themes

From outside

  • Uptime checks every 1, 5 or 15 minutes
  • Keyword checks, for a page that answers but is wrong
  • SSL certificate expiry
  • Domain expiry, read from the registry
  • Cron heartbeats, for the backup job nobody checks
  • An incident opens after two failed checks in a row

When something changes

  • Email to members, Slack, or a signed webhook
  • A burst of findings arrives as one message
  • Quiet hours, with the rest held for a daily digest
  • Serious findings and incidents are never held

// What the agent will not do

It reads. It never changes anything.

You are putting software on servers that belong to your clients. So the agent is small, read-only and boring on purpose, and the documentation lists every file it reads and every command it may run.

What the agent reads and why

  • Read-only. It never runs a fix. Every fix is a command you read and run yourself.
  • Nothing sensitive. It never reads .env, wp-config.php, database credentials, private keys or logs.
  • Nothing listening. Outbound HTTPS only. No port opened, and nothing the API sends back is ever run as a command.
  • Least privilege. It runs as an unprivileged user. Four exact commands may run as root, and each one only reads.
  • Signed. Releases carry an Ed25519 signature that the installer checks before anything runs.

// Pricing

One price per server. Unlimited sites.

Security findings are never paywalled. Every alert channel type, quiet hours and the daily digest come with every plan. Plans are monthly.

Free

£0

  • 2 servers, any number of sites
  • 1 seat
  • 10 monitors
  • 2 alert channels
  • 30 days of history
Start free

Pro

£12 a month

  • 10 servers, any number of sites
  • 3 seats
  • 100 monitors
  • 10 alert channels
  • 365 days of history
  • Extra servers at £2 a month each
Start free, upgrade later

Agency

£39 a month

  • 30 servers, any number of sites
  • 10 seats
  • 300 monitors
  • 25 alert channels
  • 365 days of history
  • Extra servers at £2 a month each
Start free, upgrade later

Paid plans can add up to 100 extra servers at £2 a month each. How plans and limits work.

// Start

Add your first server in about two minutes.

Copy one command, and the first findings appear as soon as the agent reports in.

Start free