2.1.175 refuses a hash_check restore that extracts files unless the archive still lists file hashes. Extra Show stays passwordless. 2.1.174 refuses a bound restore when extracted files are not in the listed hashes. Extra Show stays passwordless. 2.1.173 refuses a hash_check restore that lists a SQL dump unless db.sha256 still stays. Extra Show stays passwordless. 2.1.172 checks listed db size on a bound restore even without db.sha256. Extra Show stays passwordless. 2.1.171 refuses a bound restore that lists db.sha256 unless hash_check still stays. Extra Show stays passwordless. 2.1.170 refuses a 2.1.114 bind when the archive lists file hashes the bind does not cover. Extra Show stays passwordless. 2.1.169 checks listed file hashes on a bound restore even without hash_check. Extra Show stays passwordless. 2.1.168 refuses a restore archive that names this Site ID unless its bind still verifies. Extra Show stays passwordless. 2.1.167 puts a Hub operator password rotate on the eight-try operator password burst before the Hub operator password. Extra Show stays passwordless. 2.1.166 puts a Hub operator Extra enable or disconnect on the eight-try operator billing burst before the Hub operator password. Extra Show stays passwordless. 2.1.165 puts Extra enable or disconnect on the eight-try Extra burst before the Hub password. Extra Show stays passwordless. 2.1.164 puts saving or removing bucket keys on an eight-try bucket burst. Extra Show stays passwordless. 2.1.163 puts a Cloudflare token save or disconnect on an eight-try Cloud token burst. Extra Show stays passwordless. 2.1.162 puts a Site key rotate on an eight-try rotate burst. Extra Show stays passwordless. 2.1.161 puts a Site disconnect on an eight-try disconnect burst. Extra Show stays passwordless. 2.1.160 puts signing out one device, other devices, or all devices on an eight-try session burst. Extra Show stays passwordless. 2.1.159 puts a Hub two-factor start, finish, or disable on an eight-try two-factor burst. Extra Show stays passwordless. 2.1.158 puts a plan cancel, resume, switch, or close on an eight-try plan burst. Extra Show stays passwordless. 2.1.157 puts Remove selected sites on the eight-try seat burst. Extra Show stays passwordless. 2.1.156 puts Buy more seats on an eight-try seat burst. Extra Show stays passwordless. 2.1.155 puts GET Cloud bound-zone ruleset refresh on an eight-try Cloud ruleset burst. Extra Show stays passwordless. 2.1.154 lists a Hub Extra refresh from Hub support under Account activity. Extra Show stays passwordless. 2.1.153 lists a Hub Extra enable or disconnect from Hub support under Account activity. Extra Show stays passwordless. 2.1.152 puts a Hub virtual-patch validate on the eight-try virtual-patch burst. Extra Show stays passwordless. 2.1.151 puts a Hub operator password rotate on the eight-try operator password burst. Extra Show stays passwordless. 2.1.150 puts a Hub Extra enable or disconnect on the eight-try Extra burst. Extra Show stays passwordless. 2.1.149 puts a Hub operator billing portal or export on an eight-try operator billing burst. Extra Show stays passwordless. 2.1.148 puts a Hub site rotate or license override on an eight-try operator console burst. Extra Show stays passwordless. 2.1.147 puts a Hub Care claim, start, or complete on an eight-try Care queue burst. Extra Show stays passwordless. 2.1.146 puts a Hub virtual-patch stage, publish, or rollback on an eight-try virtual-patch burst. Extra Show stays passwordless. 2.1.145 puts a Hub support connect or reset email on an eight-try support burst. Extra Show stays passwordless. 2.1.144 treats Extra as available when Extra is configured. Extra Show stays passwordless. 2.1.143 lists a Shield Care cleanup fee under Account activity. Extra Show stays passwordless. 2.1.142 lists a sites, activity, billing, or Care handoff CSV downloaded from Hub support under Account activity. Extra Show stays passwordless. 2.1.141 lists a site suspend, complimentary Pro, or override clear from Hub support under Account activity. Extra Show stays passwordless. 2.1.140 lists a connect or sign-in email from Hub support under Account activity. Extra Show stays passwordless. 2.1.139 lists a Site key rotate, restore, or revoke from Hub support under Account activity. Extra Show stays passwordless. 2.1.138 lists a password reset email under Account activity. Requesting a password reset stays a click. Site keys revoked after a password or 2FA change are listed under Account activity. Extra Show stays passwordless. 2.1.137 lists a Care follow-up note or site details save under Account activity. Saving a Care follow-up note or site details stays a click and refuses a ninth try in 15 minutes.

2.1.136 lists a Care WordPress access save or revoke under Account activity. Saving or removing Care WordPress access stays a click and refuses a ninth try in 15 minutes.

2.1.135 lists a weekly summary or setup reminder change under Account activity. Saving email preferences stays a click and refuses a ninth try in 15 minutes.

2.1.134 lists a Hub sign-in lockout under Account activity.

2.1.133 lists a site label save under Account activity. Saving a site label stays a click and refuses a ninth try in 15 minutes.

2.1.132 lists a billing portal open under Account activity. Opening Manage billing stays a click and refuses a ninth try in 15 minutes.

2.1.131 lists a sites, activity, billing, or Care handoff CSV under Account activity. Export downloads stay a click and refuse a ninth try in 15 minutes.

2.1.130 puts Protect settings save, guided lockdown, admin two-factor, virtual-patch raise, and login tighten on the same eight-try Protect burst. Protect settings save stays a click and refuses a ninth try in 15 minutes. Guided lockdown, admin two-factor, virtual-patch raise, and login tighten stay a click and share the Protect burst.

2.1.129 puts Watch alert settings on the same eight-try Watch burst. Watch alert settings stay a click and refuse a ninth try in 15 minutes. A restore preview is listed under Account activity. Preview restore stays a click and refuses a ninth try in 15 minutes.

2.1.128 lists a Watch URL save, a Watch check, a Watch test, and Watch alert settings under Account activity. Watch URL, Check now, and Send test stay a click and refuse a ninth try in 15 minutes. A backup download stays a click and refuses a ninth try in 15 minutes.

Watch is a Hub check from the outside. It pings the public https address, reads the lock (SSL), snapshots DNS, looks at public blocklists, and fetches a few public pages. This still works if the plugin is off or missing.

If a card says waiting, click Check now. That pings the site, reads the https lock, refreshes DNS, and scans public pages. Later clicks do the same work, then wait a minute so you cannot hammer the site.

Down means three failed checks in a row. One blip does not count. A new valid https lock is a normal renewal, not an alarm. An empty DNS lookup is a miss, not a wipe. Basic checks about every 15 minutes for pings and daily for the rest. Pro and Shield Care ping about every 5 minutes, and run SSL, DNS, and blocklist about every 6 hours, with a public-page scan about twice a day.

Instant alerts can go to email, Slack, a signed webhook, or SMS. SMS stays off until the operator adds provider keys. The signed webhook secret is shown once when you save. Quiet hours are optional UTC windows (London winter time). PHP at risk (PHP2Shell) and takeover signals still send in that window. An AI-style attack wave can be muted. A test alert still sends. The weekly email on Account does not go away.

Blocklist checks need a Google Safe Browsing key from the operator. Until then Watch shows "not set up" for that part. A junk-mail list hit on the server IP is common on shared hosting and does not send an instant alert.

You never change DNS. Open Watch or Update alerts.