Version: 1.0.159 (WPBay edition)
Distribution: WPBay marketplace edition
Updated: November 9, 2026
Requirements: WordPress 6.2 or later; PHP 7.4 or later; MySQL/MariaDB advisory-lock support (GET_LOCK / RELEASE_LOCK) for reader-safe chunk storage. Tested up to WordPress 7.1 series on PHP 8.4.4.
Maintain Hero Monitor Pro is a standalone WordPress plugin. The free Maintain Hero Monitor plugin is not required. Premium tools and scheduled Pro monitoring require a valid WPBay purchase-code license. Some features also require a functioning Maintain Hero Cloud connection.
After successful WPBay registration, the plugin attempts to provision Maintain Hero Cloud automatically. A second Cloud license purchase is not required. The service is at https://wpmaintainhero.com/cloud/ and requires outbound HTTPS access. WPBay verification and Cloud authorization are separate checks. A revoked or expired license restricts premium functions; previously saved safe-fix undo remains available for safety. Reactivating a valid license restores premium access and preserves monitoring preferences. Developer Mode sandbox licenses can expire after 24 hours and are intended only for reviewer/developer testing.
If WPBay activation succeeds but Cloud remains unavailable, verify outbound HTTPS connectivity, check WPBay registration for the exact site URL, and retry Cloud connection through the activation interface when available. Contact support if the connection still fails. Do not send purchase codes or site tokens in public messages.
Built-in performance checks work without a Google API key. For Google PageSpeed speed scores and Core Web Vitals, open Maintain Hero → Settings, locate Google PageSpeed Key, follow the linked Google setup guide to obtain an API key, paste it into the field, and save settings. Use Test Google PageSpeed to check connectivity. Google may apply API quotas and availability limits. A configured key is recommended for dependable automated results, and a publicly accessible site URL is needed for Google analysis; local development URLs may not be measurable. When queried, the public home URL and configured key are sent to Google.
Use Fix What's Safe or the issue-specific action only after reviewing the proposed changes. The preview dialog describes what will change. Fixes may affect site behavior; keep backups and test on the site. Undo Last Safe Fixes is available for supported recorded changes even after a license expires. Undo is limited to saved, supported snapshots and is not a general site backup. Vendor theme/plugin files are not intentionally modified by safe fixes. Re-scan after applying or undoing a fix.
Open Reports to view available scan reports and sharing or email controls where supported. Use History to inspect earlier results. Configure schedule and email preferences under Monitoring with an active license. Scheduled Pro monitoring and email summaries pause when the license is inactive. Sending an email depends on WordPress mail configuration and deliverability; check SMTP, recipient, and spam filtering if a report is missing. Avoid exposing report links or diagnostic data to unintended recipients.
Site Scan sends your WordPress home URL to WP Maintain Hero for remote scoring. With an eligible active Pro license, Maintain Hero Cloud automatically attempts hourly synchronization through WP-Cron. Full and event syncs can include issue titles and page titles. Manual-only controls local scanning and does not disable Cloud sync. Disconnect Cloud clears the stored token, but subsequent provisioning or license recovery can restore the connection. Deactivate the plugin to stop its scheduled requests.
Site Scan finalization sends an HTTPS GET to https://wpmaintainhero.com/wp-json/maintain-hero/v1/score with your WordPress home URL in the url query parameter. The User-Agent also identifies the Pro version and home URL. The remote public scanner may fetch publicly accessible pages to calculate the headline score; this request does not upload the local issue list or page content. If the scoring service fails, the plugin uses its internal score. Running Site Scan triggers this request; there is currently no separate end-user switch for remote headline scoring. Avoid running Site Scan if you do not want this transfer. Developers can change the endpoint with mhm_canonical_score_endpoint.
With an active eligible Pro license, WordPress cron automatically attempts Cloud check-in hourly (first scheduled about two hours after plugin activation). This is separate from Daily/Weekly/Manual-only local monitoring: choosing Manual-only does not disable Cloud synchronization. Traffic-driven WP-Cron can delay execution. Test Cloud Connection manually sends a heartbeat. After a scheduled local scan, an event check-in may also be sent when the urgent-issue hash changes.
Default destination: https://wpmaintainhero.com/cloud/wp-json/maintain-hero-cloud/v1/site/check-in. A provisioned/configured Cloud endpoint can change the destination. Compatibility transports send the same JSON to the Cloud base URL with ?mhc_api=checkin, or its /wp-admin/admin-ajax.php?action=mhc_api&mhc_route=checkin endpoint. The request uses a Bearer site token and a User-Agent containing the plugin version. If a license key is stored, the request also includes a recovery object (_mhm_auth) with the license key, site ID and site URL. These credentials are sent to the Cloud service, not displayed publicly.
Every heartbeat, full and event payload contains sync_mode; site id/fingerprint, URL, name, WordPress version, PHP version and plugin version; health score, last scan timestamp, priority counts, broken-link count, accessibility issue/review counts, confirmed-vulnerability count, total issue count and issue hash; and sent_at timestamp.
Full synchronization is selected initially and when six hours have elapsed since the last successful full sync. In addition to the common fields it includes category scores and up to 150 open issue summaries: issue id, title (up to 140 characters), category (50), priority and page title (100). Event synchronization is selected when the urgent-issue hash changes (or has no prior value), unless a full sync is due; it adds up to 50 critical/high-priority issue summaries with the same fields. Otherwise a heartbeat is selected, without detailed issue summaries or category scores. Monitoring summaries do not include page HTML, page URLs for individual issues, form submissions, user passwords or the configured PageSpeed key; issue and page titles can still contain identifying text.
Controls: Disconnect Cloud removes the stored token and prevents authenticated check-ins until a token is provisioned again. A subsequent eligible admin page load can automatically provision Cloud again. A Cloud request can also attempt to recover a missing or rejected token using an active stored license. Disconnect therefore does not provide a persistent opt-out. There is currently no independent switch for heartbeat versus full/event synchronization. Deactivating this plugin stops its scheduled hooks and requests. Local monitoring frequency and email settings control local scans/emails only. PageSpeed remains an optional separate Google workflow as described above. Make these choices before activating the licensed Cloud workflow or running Site Scan.
Use the plugin's Support interface where available or contact WP Maintain Hero at https://wpmaintainhero.com/. Include the plugin version, WordPress/PHP versions, the affected screen, and a description of the error. Never publish license codes, Cloud tokens, API keys, or passwords.
The complete standalone plugin ZIP contains PHP source, CSS, JavaScript, translations, the official WPBay SDK, readme/changelog and this bundled guide. The separate documentation ZIP contains the same guide as PDF, HTML and Markdown. WordPress, hosting, a theme and a Google API key are not included.
Large scan results, issue states and undo snapshots use base64-encoded chunks. Publication is atomic at the manifest: failed writes preserve the prior generation and report an error. MySQL/MariaDB connection-scoped advisory locks serialize readers, writers and cleanup for each key; unsupported/blocked locks fail closed instead of deleting or overwriting data.
Superseded or explicitly deleted generations are retired and kept for at least one hour. Cleanup runs hourly through traffic-driven WP-Cron, independently of the local scan frequency and license state. Each run scans at most 500 option names, checks at most 100 generation records, and removes at most 200 parts per eligible record. Large backlogs therefore take multiple runs; grace is a minimum, not a promise of deletion at an exact minute. Current manifests and active locked readers are protected. Locks end when the operation finishes or its database connection closes; they do not expire during a long-running reader.
Abandoned or interrupted writes are tracked before parts are created. Older untracked generation/legacy parts are discovered and start their grace period on first observation. Temporary work expires after its supplied transient lifetime, or 24 hours for scan working batches; reading a working manifest renews its lifetime when it is within one hour of expiry. Expired working manifests are unlinked under the same lock, then their parts receive the retirement grace period. Persistent current scan results and undo snapshots do not expire. Deactivation clears the cleanup schedule; it does not delete saved reports or snapshots.
The report's default subject, success messages with or without CC, report button and summary labels use the WordPress request locale. Recipient values, site name and custom subject/message text are preserved. A success response means WordPress accepted the mail request; delivery still depends on the site's mail/SMTP service. Public report links are read-only links intended only for the chosen recipients.