---
title: "WordPress integration"
description: "A few lines of PHP start a Rookflare scan whenever WordPress finishes updating core, plugins or themes. Setup, test and troubleshooting."
url: "https://rookflare.com/integrations/wordpress/"
---

# WordPress integration

Add a few lines of PHP and Rookflare scans your WordPress site each time WordPress finishes updating core, plugins or themes.

## What the WordPress integration does

### What it does

- Hooks into upgrader_process_complete, the action WordPress runs when an upgrader finishes installing or updating core, a plugin, a theme or translations.
- Covers updates started from the admin and from WP-CLI, such as wp plugin update --all.
- Sends the WordPress version as the ref and waits at most 10 seconds for Rookflare, so an update never hangs on the call.

### Before you start

- A Growth and Agency plan. The 14-day free trial runs on Growth, so you can set it up before you pay.
- A verified website in Rookflare with monitoring turned on, and the owner or admin role.
- Access to wp-config.php and to the plugin folder (or a must-use plugin folder) on the server.

## Set up WordPress step by step

### 1. Create the deploy hook in Rookflare

Open the website, go to the Settings tab and select “Create deploy hook” in the “Scan after deploy” card. Copy the token right away: this is the only time Rookflare shows it in full. The card keeps the endpoint and the last four characters of the token.

### 2. Define the token in wp-config.php

Add this line above “That’s all, stop editing!”. Keeping the token in wp-config.php keeps it out of the plugin code and the database, and out of backups of the database.

```php
define('ROOKFLARE_DEPLOY_TOKEN', 'YOUR_DEPLOY_TOKEN');
```

### 3. Add the hook

Put this in a small custom plugin, or as a single PHP file in wp-content/mu-plugins so nobody can deactivate it by accident. Your theme’s functions.php works too, but switching themes would drop the hook.

```php
add_action('upgrader_process_complete', function () {
    wp_remote_post('https://app.rookflare.example/api/webhooks/deploy', [
        'headers' => [
            'Authorization' => 'Bearer ' . ROOKFLARE_DEPLOY_TOKEN,
            'Content-Type' => 'application/json',
        ],
        'body' => wp_json_encode(['ref' => get_bloginfo('version')]),
        'timeout' => 10,
    ]);
});
```

### 4. Update a plugin

Update any plugin from Dashboard → Updates, or run wp plugin update with a plugin name. When the update finishes, “Last used” changes on the Rookflare card and the website’s Scan history shows a scan with the trigger “After deploy”.

Sample endpoint and placeholder token. The dashboard fills in yours.

## If it does not work

### Two plugin updates on one day, one scan

The ref is the WordPress version, and calls with the same ref within 24 hours return the scan that ref already started. A plugin update later on the same day therefore does not start another scan; the scheduled scans still cover it.

### A critical error after adding the hook

The hook reads the ROOKFLARE_DEPLOY_TOKEN constant. Install it only on the site whose wp-config.php defines that constant, such as production, and not on staging copies without it.

### Code deployed by Git or SFTP does not start a scan

upgrader_process_complete only runs for updates through WordPress’s upgrader. If you ship theme or plugin code from a repository, call the deploy hook from that deploy script with the cURL request.

### Rookflare answers with an error code

401 means a wrong, rotated or revoked token, 402 a plan or daily limit, 409 an unverified or paused website and 429 more than 30 calls a minute. The cURL guide explains each answer and what to do.

## WordPress integration questions

### What happens when I update five plugins at once?

The first call starts a scan and the calls that arrive while it runs join it. The hook sends the WordPress version as the ref, so updates on the same day with the same version start one scan.

### What happens when the plugin with the hook is updated itself?

WordPress runs the old copy of a plugin during its own update, so the hook still fires. If you keep the hook in a must-use plugin, it is never part of a plugin update.

### Does it scan when I publish a post?

No. It runs after updates only. New content is covered by your scheduled scans.

## Related integrations

- [cURL deploy hook](https://rookflare.com/integrations/curl/)
- [GitHub Actions integration](https://rookflare.com/integrations/github-actions/)
- [Netlify integration](https://rookflare.com/integrations/netlify/)

[Start the free trial](https://app.rookflare.com/register/).