We’ve all been there: it’s 2:00 AM, an automated routine or developer runs a routine WooCommerce or plugin update, WordPress creates a temporary .maintenance file in the site root, and your monitoring system immediately starts screaming into your Slack channel that the site is down.
Thirty seconds later, the update finishes, the site comes back up, and you’re awake staring at your phone.
Even worse? Those thirty seconds of planned update downtime get counted as an outage, dragging down your 99.9% uptime figure on your client care plan report at the end of the month.
In Clockwork Control v1.5.0, we fixed that.
1. Universal Maintenance Mode Detection (No More 2:00 AM False Alarms)
Uptime monitoring should be smart enough to know the difference between a crashed server and a 15-second WordPress update.
v1.5.0 introduces Universal Maintenance Mode Detection:
[Uptime Probe] ──> Checks https://client-site.com
│
HTTP 503 Service Unavailable
│
Is WordPress in maintenance mode?
├── Yes: Mark "In Maintenance", Suppress Alerts, Keep SLA Clean
└── No: Trigger Downtime Escalation & Notify On-CallHow It Works
- Native
.maintenanceEnvelope Check: When an uptime check returns HTTP 503, Clockwork Control inspects the response payload to verify whether WordPress is actively running a core or plugin update. - Alert Suppression: We suppress immediate notifications during standard maintenance windows, so your team doesn’t get paged for normal routine operations.
- SLA Protection: The time spent in verified maintenance mode is tracked separately from unexpected server outages. When you export client care plan reports, your 99.9%+ uptime numbers stay accurate and honest.
2. S3 Glacier Air-Gap Backup Relays
I tell every agency owner who asks about disaster recovery: if your backups are stored on the same server as your WordPress site, you don’t have backups.
If the server gets compromised, or the VPS provider has a hardware failure, your backups disappear right alongside the site.
Clockwork Control’s Backup Relay already routes database and file dumps offsite to S3-compatible storage. In v1.5.0, we added S3 Glacier Archive Enumeration:
- Cold-Storage Life-Cycle Tracking: For clients with compliance requirements where you need 6-month or 1-year historical archives, you can now track archives that have transitioned into Amazon S3 Glacier or DigitalOcean Spaces cold storage.
- Expandable Rows: View individual archive sizes, checksum hashes, and retention dates right from the dashboard without logging into AWS or DigitalOcean consoles.
- Integrity Verification: Clockwork Companion checks the integrity of the local dump before pushing it across the wire to the relay.
3. Security Hardening Review
We also completed a thorough internal security audit and hardened several key subsystems:
- Strict Session Invalidation: When an operator logs out or updates credentials, all existing sessions across devices are invalidated immediately.
- SSRF Defenses on Custom Webhooks: Custom webhook dispatchers now strictly block private IP ranges (
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.1) to prevent internal network scanning. - 5-Minute Replay Window: All HMAC-SHA256 authenticated API requests outside a strict 300-second window are rejected to prevent replay attacks.
- Dev Login Safeguards: All local development bypasses and testing credentials are automatically disabled when
APP_ENV=production.
Update Your Instance
To update your Clockwork Control installation, run:
php artisan clockwork:updateIf you manage client care plans, this release will save your team dozens of false alarms every month. Let me know how it works for you!
