The site is up. That is not the same as fine.

An uptime check reports a WordPress site with a known-exploited plugin as perfectly healthy — because it is serving 200s. IT Watch looks at what the site is actually running, and at what it leaves open to the internet.

The problems IT Watch solves

A plugin nobody updated
The average WordPress site runs a couple of dozen plugins from a couple of dozen authors. One of them ships a fix for something publicly exploited, the site does not take it, and nothing anywhere tells you — least of all an uptime check, which sees a healthy 200.
It announces its own version
A default WordPress install publishes its exact version in the page source, leaves readme.html readable, lists its usernames through the REST API, and often serves a browsable uploads directory. None of that is an outage. All of it is a shortlist for somebody scanning.
Auto-update is not the whole story
Core auto-updates cover core. Plugins and themes drift, a lapsed licence stops one updating silently, and the update that did apply may be the one that broke checkout. Watching versions and watching the page are different jobs.
Nobody notices a defacement at 2am
The site stays up. The content changes. A content watch on a phrase that should always be on the page catches that, and a botched deploy, and an expired licence blanking a section.

What IT Watch monitors

Core and plugin versions
Compared against what is current on wordpress.org, and against known CVEs from the National Vulnerability Database. A known vulnerability is critical; a patch release behind is a notice.
Exposure checks
REST user enumeration, readme.html, browsable uploads, XML-RPC, wp-login reachability and missing security headers — the things a default install leaves open.
Content and defacement watch
Alert when a phrase that should be on the page is not, or when one that should never appear is.
Everything else, on the same site
SSL expiry, domain renewal, uptime, DNS changes, SPF/DKIM/DMARC and Certificate Transparency — one account, one timeline.
We never attack your site
Every check is a plain read of a public URL. We report that wp-login is reachable; we do not hammer it to find out whether it is rate limited.
WordPress health is part of the Agency plan ($29/month, 150 sites). Free covers 1 site with the six standard checks.