Watch your customers' websites from the outside, the way an attacker would
Made and supported by Projektif Digital Ltd. Runs inside PD Modules, the panel every module installs into.
PD Site Sentinel watches the websites you host from the outside, the way an attacker would. It looks for the things that give a host a bad afternoon: an exposed .env file or backup archive, a directory listing anyone can browse, an expired or mismatched certificate, mixed content that breaks the padlock, missing security headers and a CMS advertising an old version. Every finding is written in plain words, so you can forward it to a customer without translating it first.
There is no agent to install, no server access and nothing to put on the customer's site. It uses ordinary read-only web requests, exactly as a visitor would, and never logs in, uploads or changes anything. It is built for hosting companies who want to catch problems on customer sites before the customer, or a stranger, does. The core is free; Pro adds change and defacement watching and blocklist checks.
Found from the outside, so nothing to install. Because it only makes the requests a browser makes, it works on any site you host, whatever it runs on, with no access to the server and no code on the customer's site.
Findings people trust. A 200 response is not enough to raise an exposed-file finding. The body has to look like the file: an .env needs KEY=value lines, a Git config a [core] section, a SQL dump real SQL, and anything served as an HTML page is treated as an error page. That is the difference between a scanner you act on and one you switch off.
Worst first, in words a customer understands. The list puts the most serious findings at the top, and each says what was found and what it means. Missing security headers are graded advisory, never urgent, and a CMS version is described as a hint.
Honest about what it could not see. A site that cannot be reached is reported as unreachable, not as clean and not as a security problem. Without a Google Safe Browsing key the blocklist check stays off and nothing implies it ran.
Coverage without setup. Customer websites are added automatically from their services and removed with them. A site you added by hand is never removed automatically.
Alerts that stay meaningful. Only new serious findings are emailed, to the addresses you set or your system address. Warnings and advisories are not, so an alert still means something.
PD Site Sentinel is free. All the checks above, automatic enrolment, alerts and the customer summary cost nothing for up to ten sites (you can set the limit from 1 to 25). Sites beyond it are listed and labelled Not scanned (free limit), so you are never left believing a site is watched when it is not.
Pro is £12 per month. It lifts the limit and adds change and defacement watching and blocklist checks. It upgrades in place on the same licence, with nothing to reinstall.
If Pro lapses you get a 14-day grace period with everything working. After that scanning carries on as the free tier, your sites and findings are kept, and change watching and blocklist checks stop.
No. Everything is done from the outside with ordinary read-only web requests, exactly as a visitor's browser would. No agent, nothing installed on the customer's site, and no server access — which also means it works for a site you host on someone else's infrastructure.
No, and it does not claim to be. It cannot see inside a file it cannot read. What it does see is the outside view: what an attacker and Google can find without any access at all — an exposed credentials file, a browsable directory, a defaced page, a blocklisting.
That is the main thing it was designed against. A 200 response is not enough to raise an exposed-file finding — the body has to look like the file, and anything served as HTML is treated as an error page. Mixed content counts resources only. The page fingerprint ignores scripts, timestamps and counters. A site we could not reach produces one advisory note, not a page of findings.
Turn off change watching for that one site on the Sites tab. Every other check keeps running.
Yes — a handful of ordinary GETs per site, spread across a batch. Nothing is exploited, written or brute-forced. You are checking sites on your own infrastructure for security problems, which is what a responsible host should do.
Because no Google Safe Browsing API key has been supplied. Rather than skip the check silently and let an absence of findings look like a clean result, the module leaves it off and says so. Add a key in Settings and it starts working.
The summary, yes. The detail is off by default for a good reason: "your .env file is downloadable" in the client area is itself a disclosure, visible to anyone with access to that account. Turn it on for technical customers only.
Scanning continues as the free tier. Your sites and findings are kept; change watching and blocklist checks stop.
The free tier never expires — it arrives with your PD Modules licence and keeps working, with no trial clock and nothing that switches off later. If you add Pro and then let it lapse, only the Pro features step down, in stages: a 14-day grace period where everything still works, then the Pro features lock and the module carries on as the free version. Nothing is deleted, nothing you configured is lost, and adding Pro again restores it immediately.
Only what you already pay your provider, plus Pro if you add it. The free tier costs nothing and Pro is a flat subscription — neither takes a cut of your provider usage. PD Site Sentinel connects to your own account with your own credentials, so the provider bills you directly at your rates.
Your customers' data stays in your WHMCS. To confirm your licence, the platform sends us four things and nothing else: your licence key, the domain, your server's own IP address and the directory it is installed in — the four values recorded against your licence in your client area. Alongside that we see which module and version you run and whether its licence is healthy, so we can ship compatible updates. We never receive your clients' personal data, your credentials, or the contents of your WHMCS. Crash reports are off unless you turn them on, and a diagnostic report is only ever sent when you send one, after showing you a preview you can edit.
WHMCS 9 or later, on PHP 8.2 or later. It installs alongside whatever else you run — it adds its own tables and templates rather than modifying WHMCS files, so it does not collide with other vendors' modules or with a customised theme. Uninstalling removes its own tables and settings and leaves no orphans behind.
Open a ticket from your client area, or use Get help inside the PD Modules panel, which attaches a diagnostic report — you see a preview of exactly what it contains, and can exclude any part of it, before anything is sent. Support is included with an active subscription; bug reports are welcome whatever your licence state.
Featured
WHMCS security & environment guard
Stop fake signups & order fraud before they provision
Monitors that create themselves — every service you provision is watched from the moment it goes live
Prove the retainer is worth paying, automatically, every month
Terms and Conditions · Privacy Policy
PD Hosting is the trading name of Projektif Digital Ltd, registered in England and Wales, company number 12482555.
