Scan after deploy
cURL
One HTTP request from any CI, script or host.
Integration guide
Scan your WordPress site after every update
Add a few lines of PHP and Rookflare scans your WordPress site each time WordPress finishes updating core, plugins or themes.
Overview
What the WordPress integration does
What it does
- Hooks into upgrader_process_complete, the action WordPress runs when an upgrader finishes installing or updating core, a plugin, a theme or translations.
- Covers updates started from the admin and from WP-CLI, such as wp plugin update --all.
- Sends the WordPress version as the ref and waits at most 10 seconds for Rookflare, so an update never hangs on the call.
Before you start
- A Growth and Agency plan. The 14-day free trial runs on Growth, so you can set it up before you pay.
- A verified website in Rookflare with monitoring turned on, and the owner or admin role.
- Access to wp-config.php and to the plugin folder (or a must-use plugin folder) on the server.
Setup
Set up WordPress step by step
-
Step 1
Create the deploy hook in Rookflare
Open the website, go to the Settings tab and select “Create deploy hook” in the “Scan after deploy” card. Copy the token right away: this is the only time Rookflare shows it in full. The card keeps the endpoint and the last four characters of the token.
The Scan after deploy card right after “Create deploy hook”: the full token is shown once, with the endpoint below it. -
Step 2
Define the token in wp-config.php
Add this line above “That’s all, stop editing!”. Keeping the token in wp-config.php keeps it out of the plugin code and the database, and out of backups of the database.
define('ROOKFLARE_DEPLOY_TOKEN', 'YOUR_DEPLOY_TOKEN');Sample endpoint and placeholder token. The dashboard fills in yours.
-
Step 3
Add the hook
Put this in a small custom plugin, or as a single PHP file in wp-content/mu-plugins so nobody can deactivate it by accident. Your theme’s functions.php works too, but switching themes would drop the hook.
add_action('upgrader_process_complete', function () { wp_remote_post('https://app.rookflare.example/api/webhooks/deploy', [ 'headers' => [ 'Authorization' => 'Bearer ' . ROOKFLARE_DEPLOY_TOKEN, 'Content-Type' => 'application/json', ], 'body' => wp_json_encode(['ref' => get_bloginfo('version')]), 'timeout' => 10, ]); });Sample endpoint and placeholder token. The dashboard fills in yours.
-
Step 4
Update a plugin
Update any plugin from Dashboard → Updates, or run wp plugin update with a plugin name. When the update finishes, “Last used” changes on the Rookflare card and the website’s Scan history shows a scan with the trigger “After deploy”.
The website’s Scan history: the newest scan has the trigger “After deploy” and is scanning; below it a scheduled scan and an earlier deploy scan, both completed.
Troubleshooting
If it does not work
-
Two plugin updates on one day, one scan
The ref is the WordPress version, and calls with the same ref within 24 hours return the scan that ref already started. A plugin update later on the same day therefore does not start another scan; the scheduled scans still cover it.
-
A critical error after adding the hook
The hook reads the ROOKFLARE_DEPLOY_TOKEN constant. Install it only on the site whose wp-config.php defines that constant, such as production, and not on staging copies without it.
-
Code deployed by Git or SFTP does not start a scan
upgrader_process_complete only runs for updates through WordPress’s upgrader. If you ship theme or plugin code from a repository, call the deploy hook from that deploy script with the cURL request.
-
Rookflare answers with an error code
401 means a wrong, rotated or revoked token, 402 a plan or daily limit, 409 an unverified or paused website and 429 more than 30 calls a minute. The cURL guide explains each answer and what to do.
What happens when I update five plugins at once?
The first call starts a scan and the calls that arrive while it runs join it. The hook sends the WordPress version as the ref, so updates on the same day with the same version start one scan.
What happens when the plugin with the hook is updated itself?
WordPress runs the old copy of a plugin during its own update, so the hook still fires. If you keep the hook in a must-use plugin, it is never part of a plugin update.
Does it scan when I publish a post?
No. It runs after updates only. New content is covered by your scheduled scans.
Start monitoring your website
Add your address, pick the pages and approve the first scan as your baseline.
Plans start at €19 per month. Prices are provisional.