Skip to the content
WellKept

// Start here

Getting started

What WellKept does, and the path from sign-up to your first fixed finding.

What WellKept does#

WellKept looks after the patch posture of the servers you run for other people. A small agent on each server reports what is out of date, exposed or misconfigured. WellKept turns that into findings, and every finding comes with a playbook: why it matters, what to check first, the exact commands, how to verify the fix and how to undo it.

It also watches from outside. Monitors check that a site answers, that its certificate is not about to end and that its domain is not about to lapse. Alerts tell you by email, Slack or a signed webhook.

WellKept only reads. It never changes anything on a server. Every fix is a command you read and run yourself.

From sign-up to a fixed finding#

  1. Create an account. Registering creates an organisation with you as its owner. A new organisation starts on the Free plan.
  2. Add a server. Choose Add a server, give it a name if you like, and copy the install command. It works once and expires after an hour. Installing the agent lists what the server needs.
  3. Run the command on the server, as a user who can use sudo. The page you copied it from follows along: it says when the agent has enrolled and when the server is connected, which usually takes under two minutes.
  4. Open the first findings. The first full report arrives within five minutes and is checked straight away. Findings are sorted most serious first. Open one to see its playbook.
  5. Fix it, then press Re-check now. The agent sends a fresh report on its next heartbeat, and the finding clears when it is no longer true.
  6. Watch a site and choose where alerts go. Add a monitor for each site that matters, and an alert channel so a problem reaches you without opening WellKept.

The dashboard keeps a short checklist of these steps until the first four are done.

What you need#

  • An Ubuntu or Debian server, on x86-64 or ARM64. Other distributions are not supported yet.
  • A login on it that can use sudo.
  • Outbound HTTPS (port 443) from the server. The agent opens no port.

Where to go next#