Setup guide

What you can be told

Each channel can take every event or only the ones you tick. Critical events ignore quiet hours.

• Site down criticalThe front page stopped answering and is still down after 9 minutes (blips that clear sooner are only recorded). Also tells you when it is back.
• Site slow warningThe front page has been slower than the site's limit for 30 minutes.
• Fatal error criticalWordPress recorded a fatal error (critical-error page).
• Connector unreachable warningThe site is up but the Sitecommand connector did not answer.
• SSL certificate warningThe certificate expires within 14 days, or visitors get a warning.
• Domain expiry warningThe domain registration expires within 30 days.
• Nameservers changed warningThe domain's nameservers are not what they were.
• Malware found criticalThe weekly sweep scored the site infected.
• Code Lock refused something warningA locked site refused an install, code or an administrator change.
• Vulnerable plugin warningAn installed plugin or theme version has a known vulnerability.
• Update failed or rolled back warningA verified update did not pass its checks.
• Site moved to another account infoSomeone reconnected the site with another account's key.
• Secrets exposed criticalA .env file, the Git repository or a wp-config.php copy is readable from the web.
• Blacklisted criticalGoogle Web Risk or URLhaus lists the site for malware or phishing.
• Front page changed warningMost of the front page's text changed since yesterday without an update (possible defacement or spam).
• Digest infoThe daily or weekly summary.
• Commander heads-up infoMonday: what will need attention soon (SSL not renewing, sites getting slower, PHP losing support…). Switch off in Settings → Commander.

When an alert is sent

• Down: each site is checked every 5 minutes (every 15 on plans without fast checks). A failure is checked again 15 seconds later; the outage is recorded at once and announced only if the site is still down after 9 minutes, so short blips do not wake you up.
• Back up: sent when the site answers again, only if the down alert was sent. It says how long the outage lasted.
• Slow: announced after the front page has been slower than the site's limit for 30 minutes (the limit is set per site on its page). New channels start with Site slow switched off; the digest still reports it.
• Still open: an incident that stays open is announced again every 6 hours (for example "still down (6 h)").
• Many at once: three or more incidents of the same kind in one check become one message (for example a hosting server taking 12 sites down).
• Everything else (malware, SSL, domain, vulnerabilities, fatal errors…) is announced when it is found and again when it is resolved.

Keeping it quiet

• Quiet hours, per channel, in UTC: warnings and information wait; critical alerts (down, fatal error, malware, exposed secrets, blacklisting) still come through.
• Mute a site from its row on the Alerts page or its site page: for 1 hour, 24 hours, 7 days or until you unmute. Incidents are still recorded while muted.
• Digest: a summary of open incidents and the last period, daily or every Monday (UTC), set by the account owner under the channel list. A channel gets it only if Digest is among its events (it is by default).

Who can set up alerts

• The account owner and members who can edit can add Slack, Discord and Telegram channels, send tests, pause and choose events.
• Webhook channels and the digest are owner-only, because a webhook carries a signing secret.
• Full channel addresses (webhook URLs, bot tokens, signing secrets) are shown to the owner only, under Sends to on each channel. Members see a short hint.
• During launch every plan can add as many channels as it likes.

Checking a channel

• Each channel on the Alerts page shows Sends to, its status (Active, Waiting for its test message, Paused or Last send failed), when it was verified, when it last delivered, and its last 8 sends with any error.
• "The service answered 404" or "403" means the destination was deleted or no longer allows posts: create a new webhook or token and add the channel again.
• "The service did not answer within 8 seconds" or "could not be reached" is usually temporary; press Send test to try again.

Finding the chat id

• Alerts to you: open your bot and press Start (a bot cannot message you before that), then ask @userinfobot for your id: a number like 123456789.
• Alerts to a group: add the bot to the group and send it a command there (for example /start@your_bot). Then open https://api.telegram.org/bot<YOUR_TOKEN>/getUpdates in a browser and copy the chat id: a negative number, usually starting with -100.
• Alerts to a channel: make the bot an administrator that can post. Use the channel's @name for a public channel, or the -100… id from getUpdates for a private one.

Telegram Bot API: getUpdates

If the test does not arrive

• 400 (chat not found): press Start on the bot, or check the group id includes the minus sign and the bot is still in the group.
• 403: the bot was blocked or removed, or is not an admin of the channel.
• 401: the token is wrong or was revoked. Get a new one from @BotFather and add the channel again.

If the test does not arrive

• 404: the webhook, app or channel was removed. Create a new webhook and add the channel again.
• 403: your workspace restricts apps or posting there. Ask a workspace admin.
• 410: the channel was archived.

If the test does not arrive

• 404: the webhook was deleted. Create a new one and add the channel again.
• 401 or 403: the URL was copied incompletely or the webhook was reset. Copy it again.
• 429: Discord is rate-limiting a very busy channel; that alert is not resent. Give Sitecommand a channel of its own.

Endpoint rules

• https only, on a public address. Private and local addresses are refused, checked again at every send.
• Answer with any 2xx status within 8 seconds. Do slow work after answering.
• Redirects are not followed and failed sends are not retried: the error shows on the channel. The incident stays on the Alerts page, and open incidents are re-announced every 6 hours.

Headers

• Content-Type: application/json
• User-Agent: Sitecommand-Alerts/1.0
• X-Sitecommand-Event: the event name (below)
• X-Sitecommand-Signature: sha256=<hex>, the HMAC-SHA256 of the raw request body with the channel's signing secret

Body

{
  "event": "down.opened",
  "severity": "critical",
  "title": "client-shop.com.au is down",
  "body": "The server answered 503.\nhttps://client-shop.com.au\nhttps://siteconnector.vercel.app/<your-account>/sites/…",
  "site": { "name": "Client Shop", "url": "https://client-shop.com.au" },
  "incident": { "id": "4f6c…", "kind": "down", "opened_at": "2026-11-06T10:00:00Z", "closed_at": null },
  "sent_at": "2026-11-06T10:09:02Z"
}

• event: <kind>.<phase>, where phase is opened, closed (resolved) or still_open (the 6-hourly reminder); plus digest and test.
• Kinds: down, slow, fatal, connector, ssl, domain, ns_changed, malware, lock, vulnerability, update_failed, moved_out, exposed, blacklisted, content_changed, heads_up.
• severity: critical, warn or info (a resolved incident is info).
• site and incident are null for the digest, the test and messages that fold several sites into one.

Check the signature: Node.js

import crypto from "node:crypto";

// raw = the body exactly as received, before JSON.parse
function isFromSitecommand(raw, header, secret) {
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(raw).digest("hex");
  return header?.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(header), Buffer.from(expected));
}

Check the signature: PHP

$raw = file_get_contents("php://input");
$expected = "sha256=" . hash_hmac("sha256", $raw, $secret);
if (!hash_equals($expected, $_SERVER["HTTP_X_SITECOMMAND_SIGNATURE"] ?? "")) {
    http_response_code(401);
    exit;
}
$alert = json_decode($raw, true);

Check the signature: Python

import hmac, hashlib

def is_from_sitecommand(raw: bytes, header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header or "")

Using a bridge (no code)

Zapier, n8n and Make each give you a URL that receives webhooks; use it as the endpoint and pass the alert on to SMS, email, Microsoft Teams, PagerDuty or anything they reach. PagerDuty and Teams need their own message format, so go through one of these.

Zapier: trigger Zaps from webhooks n8n: Webhook node Make: webhooks

Troubleshooting

• "The service answered 3xx": the URL redirects (for example http → https or a missing trailing slash). Use the final address.
• "The service answered 401/403": your endpoint rejected the request. Check the secret matches the one under Sends to and that you sign the raw body, not re-encoded JSON.
• "The webhook address now points to a private network": the domain resolves to a private address. Use a public endpoint.