Sunsetly – End-of-Life & Vulnerability Alerts Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Sunsetly tells you what is coming: when your PHP and database versions stop receiving security fixes, which installed software has known vulnerabilities, and what to do about it, in plain English. It helps you plan maintenance as a scheduled job.
End-of-life countdowns
- PHP end-of-life countdown – the number of days until your PHP branch stops getting security fixes, with optional emails at 90, 60, 30, 14, 7, 2 and 1 day (configurable).
- Missing PHP patch detection – for example “PHP 8.2.10 is 24 patch releases behind 8.2.34”.
- Database lifecycle – the same countdown for MySQL and MariaDB.
- Maintenance calendar – upcoming deadlines in one timeline.
Vulnerability alerts (optional)
- Matches WordPress core, installed plugins and themes (active and inactive) and PHP against WPVulnerability.net (no key needed) or Wordfence Intelligence (your own free API key).
- Labels pending updates as “Security update – apply now” or “Routine – can wait”.
- Shows a warning under an affected plugin on the Plugins screen.
- Tells you when no patch exists yet.
Maintenance helpers
- Abandoned and closed plugin detection – flags plugins not updated in 24 months (configurable) or closed on WordPress.org.
- PHP upgrade readiness – checks each active plugin before you move to a newer PHP version.
- Message for your host – a ready-to-send request asking your host to upgrade PHP, with the reason and dates filled in.
- Health grade A–F with trend history and an optional dashboard widget.
- Site Health tests, WP-CLI (
wp sunsetly scan --fail-on=high) and a REST endpoint for administrators.
Privacy first
- Online checks are off by default. Out of the box Sunsetly only runs local checks: your PHP version against built-in end-of-life dates and the update information WordPress already has. It contacts no external service until an administrator turns on “Online checks” on the Sunsetly screen or under Sunsetly Settings.
- No site address, email address, user data or analytics are ever sent. See “External services” below for exactly what is sent where.
- At most one admin notice for urgent issues, and it can be snoozed for 7 days or turned off.
External services
Sunsetly can look up public security and lifecycle data from the services below. None of them is contacted unless an administrator has turned on “Online checks” (off by default). When online checks are on, requests are made when an administrator clicks “Scan now” or runs wp sunsetly scan, and during the background scan that runs twice a day. Responses are cached (12 hours to 3 days) to keep requests to a minimum. Requests carry a user-agent such as “Sunsetly/1.0.0; WordPress/7.1” and never include the site address, email addresses or any personal data.
WPVulnerability.net
Used to find known vulnerabilities in WordPress core, your installed plugins and themes, and PHP. This is the default vulnerability source.
Data sent: the slug and installed version number of each installed plugin and theme, the WordPress version and the PHP version (one request per item).
Provided by WPVulnerability (ROBOTSTXT): License / terms of use, Legal notice, Privacy policy.
Wordfence Intelligence (optional)
Used as an alternative vulnerability source, only if you enter your own Wordfence Intelligence API key in Settings.
Data sent: your API key (to authenticate the download). The complete public vulnerability feed is downloaded at most every 12 hours and matched on your server; nothing about your site or installed software is sent.
Provided by Defiant Inc.: Wordfence Intelligence terms and conditions, Terms of service, Privacy policy.
endoflife.date
Used to get release, active-support and end-of-life dates for PHP, MySQL and MariaDB.
Data sent: only the product name (“php”, “mysql” or “mariadb”). No version or site information is sent.
endoflife.date is an open-source community project that does not publish separate terms or a privacy policy; its content is MIT-licensed and the site is hosted by Netlify: License, Netlify privacy statement, Netlify terms of use.
php.net
Used as a fallback to find the latest patch release of your PHP branch.
Data sent: only your PHP branch number (for example “8.3”).
Provided by The PHP Group: Copyright and terms, Privacy policy.
WordPress.org API
Used to detect plugins that were closed or have not been updated for a long time, and whether your WordPress version is marked insecure.
Data sent: the slug of each installed plugin (one request per plugin, cached for a day). The list of insecure WordPress versions is downloaded without sending any site data.
Provided by the WordPress Foundation: Privacy policy.
Screenshots
The Sunsetly dashboard: health grade, PHP and database end-of-life countdowns, and the issues to fix first.
Online checks are off until an administrator turns them on; the screen lists exactly what each service receives.
Issues to fix first with plain-English fixes, the maintenance calendar and a ready-made request for your host.
Settings: online checks, vulnerability data source, email alerts and countdown milestones.
The optional health widget on the WordPress dashboard.
