Stackwatch and Patchstack: what counts for WordPress

The short version

Patchstack specializes in WordPress: a plugin on every site, its own database of vulnerabilities in plugins, themes and core, and virtual patches that block attacks on known vulnerabilities on the site until you update. Stackwatch installs nothing on the site, reads only the plugin list and currently reports vulnerabilities in WordPress plugins as early warnings, not from a plugin database of its own. If you only look after WordPress, Patchstack gives you more for WordPress; Stackwatch pays off when repos with your own code and runtimes need watching alongside the sites.

What Patchstack does

• Detect. The Patchstack plugin reports the site’s software to the Patchstack App: plugins, themes, WordPress core, plus PHP and database versions. The app shows which components are vulnerable or outdated and sorts them by patch priority. The plugin syncs software data twice a day and whenever plugins or themes change.
• Protect. On paid plans, protection modules run on the site: vPatches against specific vulnerabilities in plugins, themes and core, a module against common WordPress attacks and a shared IP blocklist. A vPatch blocks targeted requests without changing the code. Patchstack itself says: mitigated is not fixed, the update remains the actual fix.
• Update. Plugins, themes and core can be updated from the app, one at a time or all outdated ones across all sites. Patchstack no longer runs automatic updates.
• Alert and report. Alerts go out by email or Slack. A PDF of the current state is available to all users, periodic reports on the Developer and Enterprise plans, your own logo on reports only on the Enterprise plan.

What Patchstack does not do: scan files for malware. For that, Patchstack recommends server-level tools.

What Stackwatch does for WordPress

You approve an application password for Stackwatch in WordPress. Stackwatch uses it to read the list of installed plugins (slug, version, active or inactive) and only that, changes nothing and installs no plugin. Stackwatch reads the WordPress version from what the site shows publicly (generator tag, feed, readme.html); if the site hides it, core is missing. Stackwatch does not read themes.

Matching is where the difference is largest. For WordPress plugins, Stackwatch does not use a vulnerability database of its own. New plugin vulnerabilities arrive as early warnings from publications by WordPress.org, Wordfence, Patchstack, Sucuri, WPScan and other sites, are checked against the slug and version of your plugins and appear in the live feed as an unconfirmed notice. An email goes out only once the sources are confirmed: by the WordPress.org security release or by at least two independent sources. Stackwatch offers no protection on the site.

A note on the approval: the application password has the permissions of the account that approves it, usually administrator for the plugin list. Ideally, create a separate account for it. Details are on security and privacy.

The comparison

As of 5 November 2026. Stackwatch details refer to the beta.

When Patchstack alone is enough

If you only look after WordPress sites and maintain no code of your own in repos, Patchstack covers more than Stackwatch: themes, a vulnerability database of its own for WordPress and above all protection on the site, which buys time until the update is in. That matters most on client sites where you cannot update right away because changes need testing or sign-off from the client first.

When Stackwatch comes in

• Besides WordPress sites you also maintain your own code: themes and plugins in a Git repo, Laravel or Node.js applications, Dockerfiles with a pinned PHP version. There, Stackwatch reports vulnerabilities in runtime and packages with evidence from file and line, for example for PHP2Shell.
• You want one channel for repos and sites instead of two dashboards.
• You do not want to, or may not, install another plugin on individual client sites and want to read from the outside only.

For agencies with many client sites

With Patchstack you install the plugin on every site, also scripted via WP-CLI, and can store a default policy for the settings that applies on first activation. Sites can be organized in groups, for example by care plan. The Developer plan includes 25 sites and 3 team seats; each additional 5 sites cost 12.50 US dollars a month, additional seats 24 US dollars a month. Periodic reports for clients are available from the Developer plan, with your own logo on the Enterprise plan.

With Stackwatch you approve each site individually in WordPress. Nothing stays installed on the client site, and when you disconnect, Stackwatch deletes the credentials. A record of alerts and responses is kept in the audit log. Stackwatch does not offer reports branded for your agency. Which tools exist outside WordPress is shown in the overview Dependabot alternatives in 2026.

Sources

• Patchstack Docs: Start using Patchstack
• Patchstack Docs: Pricing plans
• Patchstack Docs: Does Patchstack have a free version?
• Patchstack Docs: Protection modules
• Patchstack Docs: Site packages (mitigated is not fixed, automatic updates)
• Patchstack Docs: Packages overview
• Patchstack Docs: How often does Patchstack sync with my site?
• Patchstack Docs: Alerts and Creating a trigger
• Patchstack Docs: Reports overview and Reports whitelabeling
• Patchstack Docs: Groups, Policy and WP CLI commands
• Patchstack Docs: Does Patchstack have a malware scanner?
• Patchstack Docs: Data Processing Agreement (DPA) and GDPR
• Patchstack: Pricing