Every module, as the console has it. Where something needs the agent on your server, it says so — a feature list with no boundaries on it is a feature list nobody believes.
What Servertorch can tell you depends on how much of it you install. Moving deeper takes about two minutes and never needs SSH.
Nothing to install
Point Servertorch at a URL. Everything here is measured from the outside, the way your visitors see it.
No CPU, memory, disk, traffic or attack data — none of that is visible from outside.
One file in your web root
Upload a single PHP file. It works on shared hosting, needs no SSH, no root, and no extensions — PHP 7.2 and up.
WordPress plugin and theme inventory needs the WordPress connector.
A plugin, installed the usual way
The same agent, packaged as a WordPress plugin, plus everything that only makes sense inside WordPress.
What we check from the outside, with no agent.
Checks as often as every 30 seconds, with DNS, connect, TLS handshake and time to first byte measured separately. Failures collapse into one incident with a start, an end, a timeline — and a plain-English “why it is marked down”.
In every planExpiry, chain completeness, hostname match and grade, checked continuously. You hear about an expiry weeks ahead, not from a visitor.
Records as they were, with the date each one moved. The most common “the site is down” that is nobody’s server.
Each missing or weak header graded, with the exact line for Apache, Nginx or your CDN that fixes it.
Spam and malware lists, Safe Browsing included, so you learn your domain was listed before your email starts bouncing.
Works out which CDN you are behind and whether your origin still answers directly — the misconfiguration that quietly makes a CDN decorative.
What the agent inside the site reports.
Every request from the server’s own log: path, status, response time and the real visitor IP behind Cloudflare. A live view, people separated from bots, server errors and the slowest pages.
Needs the agent on the sitePHP, web server, database, CMS, plugins and packages — discovered, not declared — matched against published advisories with the version that fixes each one.
Needs the agent on the sitePHP settings that should be off, files that are writable when they should not be, and for WordPress, database hardening checks.
Needs the agent on the siteDetection and blocking.
A request firewall inside the site: SQL injection, XSS, traversal, scanners and brute force, each with the attacker’s own request and an explanation of what was being tried.
Needs the agent on the siteBlock an address or range straight from the evidence, and let the firewall refuse attacks rather than only record them. Enforced on your server.
Needs the agent on the siteA hash of every file, compared on a schedule. Changed, added and deleted files with excerpts, and malware signatures on anything executable — a web shell in uploads/ shows the matched line.
Needs the agent on the siteTrackers before consent, a named grievance officer, retention statements, forms collecting personal data, cookie behaviour. Rechecked weekly, emailed only on change. Findings and fixes, never a verdict.
Scanning the code a monitored site is deployed from.
Connect GitHub or Bitbucket and scan the repository behind your site for secrets, vulnerable code and dependencies. Findings show only once the repository is verified as yours — the agent matches deployed files against the repository, or you commit a token file.
Scan tracked branches daily or weekly without anyone pressing a button.
A GitHub or Bitbucket webhook queues a scan whenever a tracked branch is pushed.
Adds Semgrep, Gitleaks and npm audit to the built-in rules and Composer advisories.
An AI explanation and suggested fix for one code finding. Also needs AI analysis.
Explanations and scheduled summaries.
Nekoba, the assistant, answers questions about your own data — “why was the shop slow on Tuesday?” — and AI triage explains a suspicious file and how to fix it. Metered in credits per month.
Uptime, incidents and security for any period, as a page or a download, and scheduled to your inbox weekly or monthly.
People, integrations and branding.
Bearer-token access to the same JSON API the console uses, for your own dashboards and scripts.
Slack, Microsoft Teams, Telegram and signed webhooks, per site and per severity, alongside email and the in-app centre.
Owners, managers and viewers. A viewer login is how a client sees their own uptime without being able to change anything.
Your colour and logo on the console and reports, so an agency’s clients see the agency.
Grant our team time-boxed access to look at your data with you. You approve it, it expires, and it is logged.
Responsible for sites you don't own.
Separate companies, separate logins, separate data — enforced in every query, not just hidden in the interface.
With white label, the monthly report a client receives carries your logo and colours.
How agencies use ServertorchThe question that gets a monitoring tool bought, and the one most tools answer with a green dot and no evidence.
Read from the access log by the agent, so it is your server’s own record rather than a tag a visitor can block.
The question you cannot answer after the fact unless something was watching before.
India’s DPDP penalties begin on 13 May 2027. This part of the product exists because of that date.
A feature list is a claim. The free readiness check runs the same product on your own domain in about fifteen seconds; the demo puts all of it on your sites.
No tracking cookies here
We only use the cookies needed to sign you in and keep forms safe — no analytics, no ads, nothing to accept.