Sites: add, connect, and inspect Drupal

Open Sites. The heading reads Sites with a count line, for example "12 sites". Search the list, sort supported columns, and use pagination or the page-size control. The table shows one row per site. Open a site to see its details. The external site link opens the site itself. The times in the table are separate. Last sync is the last data submission from Drupal. Last checked (an optional column) is when the latest finished check of the site's modules against Drupal.org completed, complete or partial. It reads Never only when no check has finished. A queued or failed refresh does not hide an earlier finished check. It cannot be sorted.

Where ticket links are turned on for your organisation, a Sites | Findings switch sits beside the heading. Findings lists the findings of all your sites with their tickets. See Ticket links.

Default columns. The table opens with Select (a checkbox), Site, Status, Security, Other, Drupal core and PHP (only while support status is on), Last sync and Actions.

• Status is one column. While support status is on, it shows the site's fleet status pill with its reason in words. A check that has not finished also shows Assessment and its state, for example Assessment stale. While support status is off, the column shows the security status badge instead and cannot be sorted. There is no separate Assessment column any more. Read the pill and its reason together: a neutral or unknown state is not a healthy one.
• Security and Other are the counts of security updates and other updates. A zero is shown in grey. A blank means Sentinel does not know yet, not zero.
• Drupal core and PHP show the version and its support state. They appear only while support status is on.

Status chips. While support status is on, chips above the table filter the list: All, Not secure, Not supported, Sync issue, Not assessed and Secure. Each shows how many sites it covers, counted with the same rules as the filter. Select a chip to filter. The choice is kept in the address (?fleet_status=), so you can bookmark or share it. The old Status dropdown is gone. With support status off, the chips are not shown.

Filters. The Filters button shows a number when a filter is set. It holds Sites with known stack vulnerabilities and Configuration drift (only while configuration drift is on). Select Clear filters to start again.

Columns. The Columns button turns optional columns on and off: Security score, Modules, Configuration drift (only while drift is on), Last checked and Certificate (only when your deployment runs certificate checks). Your choice is saved in this browser for each signed-in person, so a shared computer does not carry it to another account. It changes only what you see. The download keeps its own fields whatever you choose; Certificate is shown on screen only.

Row actions. Point at a row or move to it with the keyboard to see its actions. On a touch screen they are always shown. A site with no data yet or with a sync issue shows Check connection, which opens the site's Setup tab.

The menu beside it offers Open site, Setup (the site's Setup tab), Download report (the Reports page for that site) and Remove. Remove is shown only to people who can delete sites (organisation administrators and site managers) and opens the usual delete dialog, which still asks you to confirm. Viewers see no remove action, and the server refuses them if they try another way.

Select several sites. Tick rows to show a bar above the table. It offers Download N rows and Clear. Download N rows saves a CSV or JSON file of only the ticked rows. The selection clears when you change the organisation, the search or a filter.

On a phone (screens narrower than 768 pixels), each site is a card with the pill, a reason line and its Security, Other and core counts, and a box to tick it for the selection bar. A Sort by list above the cards takes the place of the column headings, and Columns is not offered. Stack vulnerability markers show beside the site name, as in the table. Tap a card to open the site.

The optional Security score column (turn it on under Columns) shows a percentage from 0% to 100%, using the same per-site score that Home averages. A small Estimate label means the score comes from a check that could not settle every module, so the real score may be lower. Older check means it comes from the site's last check, before its latest change or more than three days ago. It reads Not checked only when the site has never been checked. Select the column heading to sort by score. Not checked sites appear last in both ascending and descending order.

The fleet status pill, the security badge in Status while support status is off, and the security badge on the site's page use the same security status as the browser extension. Critical means a critical advisory or a known exploited stack vulnerability is reported. At risk means there is a security update, another known vulnerability, an unsupported component, or a module without security coverage. Updates waiting means a complete, current assessment and checked stack components found other updates. Secure means that evidence found none of those conditions; it does not guarantee that a site has no security problem. Unknown means the evidence cannot establish a current clear state, including when a stack component has not been checked. Known risks can still be shown while an assessment is incomplete or stale. Read Assessment in the Status column, or the site's assessment details, for coverage and freshness.

Check every site at once: when an organisation is selected and has live sites, Re-check all sites appears above the table. It checks every live site of that organisation against the latest Drupal.org releases and security advisories. Organisation admins and site managers can use it. Viewers do not see the button. It is available on paid plans, and on installations with billing disabled. On the Free plan, or when the subscription is overdue, unpaid or paused and no site is covered, the button is not shown. If only some sites are covered, those sites are checked and the message adds "N sites not included." A site that is busy storing a new data submission when the check reaches it is also counted as not included.

While the check runs, the button reads Checking… and is disabled, and the text beside it reads, for example, "Checking 12 of 40 sites". Each site's Last Checked value updates when the whole run finishes. When it is done the text reads "All sites last checked" with the date and time. The check uses the same background line as Sentinel's scheduled checks, so on a busy day results can take several minutes. If you select the button again during a run, you follow that run. An organisation can start one run every 15 minutes, shared by all its members and counted from when the run was asked for. During that time the button is disabled and the text reads "You can check all sites again after" the date and time. If a run does not finish, the text reads "The last check of all sites did not finish. You can try again." and you can try again straight away. Sites added later are included in any later run, and a new site is checked anyway when it first reports. If the text says "N sites could not be checked", Sentinel checks those sites again by itself, or you can select Re-check now on the site. Platform administrators use the administration console instead.

This is separate from Re-check now on a single site, which keeps its own 3 minute limit and is unchanged. It is also not the same as Sync now in Drupal. Sync now resends the Drupal site's module inventory to Sentinel. A re-check does not contact your site: it compares the inventory Sentinel already holds with the latest Drupal.org data. To refresh the inventory first, use Sync now in Drupal, then re-check.

Download the list: beside Add site, Download CSV saves the sites as a spreadsheet file. The caret next to it opens Download JSON. The buttons appear when the list has at least one site, and every member who can read the Sites list can use them, viewers included. The file holds every site that matches your current search, filters (including the status chip) and sort, not just the page on screen. It always keeps every field, whichever columns you chose to show. To save only some sites, tick them and use Download N rows, up to 5,000 sites. Over that, the page shows a message and saves no file; narrow the search or filters and try again. Files are named like sites-example-agency-2026-10-31.csv, dated in your organisation's time zone.

The columns are Site, URL, Status, Security, Total modules, Security updates, Other updates, Configuration drift, Last sync, Last checked, Drupal core, Drupal core support, PHP version, PHP version source, PHP support, Web server, Web server version, Web server version source, Database, Database version, Database version source, and PHP, Web server and Database known vulnerabilities (the number of open matches). Status, Drupal core support and PHP support appear only while support status is on, and Configuration drift only while configuration drift is on. The file has no security score. Times are in UTC. Anything Sentinel does not know is empty in the CSV and null in the JSON, never 0. This includes update counts before a site's assessment finishes, total modules before a site first reports, the known vulnerabilities of a component that was not checked, and a version that is neither reported nor declared. Each version column has a matching version source column: Reported came from the Connector, Declared was entered by your team in Edit site and may be out of date. Use the file to find sites on an outdated PHP version or an affected web server version.

A site needs configuration when Sentinel has never received a data submission from it. For these sites, a message above the table says Configure your site to start receiving monitoring data. Select Configure [site name] to open that site's Setup tab. The exclamation-mark icon to the left of its name opens the same tab. Point to the icon or focus it with the keyboard to read Please configure this site.

The message lists sites on the current results page. After you add a site, its setup link also stays available if search or pagination hides its row, or if you chose another organisation in the add dialog. This extra link clears when you switch organisations; the table still shows only the selected organisation's sites. Clear search or change pages to find other sites that need setup.

The setup message and icon clear when the list receives confirmation of the first data submission. They do not depend on an assessment result. A site that has reported before does not need initial setup again because its assessment is pending, failed, stale or unknown. Check its Setup tab and assessment details for the next action. The links are available to members who can view the site on all plans; an organisation administrator must manage its API key.

If a temporary network or server error prevents a check of the new site, its setup link keeps the last known state. Wait for the next refresh, or open Setup to check again. The link is removed if the site is no longer available or you no longer have access.

The Sites with known stack vulnerabilities option under Filters shows only sites that match known vulnerabilities in their PHP, web server or database version (at least one open match that is shown in the Platform list on the Updates tab). If nothing matches, the list reads No sites match these filters; select Clear filters to see all sites again.

While configuration drift reporting is on, the Configuration drift column can be turned on under Columns. It shows only the state as a word with an icon: Clean, Drift or Unknown, with no counts or names (open the site for those). Select the column heading to sort: descending puts sites with drift first (most objects first), then Unknown, then Clean. A Configuration drift select under Filters filters the list to All sites, Drift, Unknown or Clean. The choice is kept in the address (?config_drift=), so you can bookmark or share it. If nothing matches, the list reads No sites match these filters; select Clear filters. Every member who can read the site, viewers included, sees the column and filter.

Select a cell in the table to open that part of the site page. The whole cell is the target, not only the figure. Modules (optional column) opens the Updates tab with the All modules list. Security and Other open the Updates tab with the security or the other updates list open. Configuration drift opens the drift section on the History tab; the column is optional and shows only while drift reporting is on. PHP opens the Updates tab with the Platform list; the column shows only while support status is on and is hidden on narrow screens. Last sync opens the Setup tab, and Last checked (optional column) opens the Updates tab. Selecting anywhere else in the row opens Overview; with a keyboard or screen reader, use the link on the site name. The site link in the row still opens the site itself. Every member who can read the site, viewers included, can use these links.

When the organisation has no sites, the empty page depends on whether you can read billing. An administrator who can read billing sees Create your first site on a current paid or trial plan, and Create your site on Free, after a cancellation, when billing is switched off, or when the billing summary cannot be loaded. Both include Create site. An administrator who cannot read billing sees Create your site and Create site, and the page does not request the billing summary or plans. A viewer sees No sites yet and is asked to have an organisation admin or site manager add the site. Site managers see the same first-site action as administrators.

Add or edit a site

An organisation admin or site manager can use Add site or the first-site action. Viewers do not see them. The dialog lists only organisations where you can add sites. A visible add button does not mean that you have an eligible organisation to select. If the list is empty, ask an organisation admin or site manager to add the site. Enter a name and full HTTP or HTTPS URL, check the organisation, and optionally choose a security patching SLA and a maintenance update SLA, each with its own choice of how it applies. The SLA fields appear when the selected organisation's plan includes it; otherwise the dialog says why it is unavailable. Then create the record. Plan capacity is checked on the server. If refused, review billing or ask the organisation administrator.

Adding sites to a pay as you go or Agency plan

On a Pay as you go or Agency account, Add site saves the site as inactive and then opens Add sites to your plan. The site is not monitored and nothing is charged until you finish the steps below. Accounts on the older plans are not affected: their new sites are active straight away and plan capacity is checked as above.

1. Step 1 of 2 · Choose sites. The list shows the organisation's saved inactive sites with a checkbox each. The site you just created is ticked and marked Just added. Use Select all or Clear selection, or tick other waiting sites to add them in the same payment. A summary shows how many sites you chose, Includes your free first site when the Pay as you go free site covers one, and the estimated amount Added to each renewal (the price per site times the sites that are charged, before tax). With a running subscription you pay today only for the days left in the current billing period, up to its end date; if no site is paid for yet, your first paid site starts a monthly subscription today and that date becomes your billing date. On Agency, sites within the package add nothing to the bill, so no per-site estimate is shown. Select Not now to close; the sites stay saved and inactive. Select Review price for N sites to continue.
2. Step 2 of 2 · Review and pay. The heading reads Review N sites. Check the quote details, tick the consent box and select Confirm and pay. With an existing subscription, the amount due now is pro rata: it covers the days left until the renewal date, from that date your monthly bill is the new renewal amount, and your billing date does not change. For the first paid site, the page says this starts your monthly subscription today and renews on the same date every month after. Select Change sites to cancel the quote and go back to step 1. If the card needs attention, select Replace or verify the payment card: it opens the card verification step, and once the card is verified you return to the Sites page with the same quote. It does not start another purchase. If the quote cannot be prepared because the card is expired or not verified, select Verify or replace the payment card, then add the sites again.
3. When payment succeeds, the message Sites added to your plan appears and the sites start to be monitored once Drupal sends data. If your bank asks for verification, complete it; you return to the Sites page and the same quote reopens so you can finish.

Sites you saved but did not add show a banner on the Sites page, for example "Example is saved but not on your plan yet" or "3 sites are saved but not on your plan yet". Select Add to plan to open step 1 with every waiting site ticked.

If you close the dialog while a payment is still waiting for your bank or needs attention, a banner says the payment has not finished. Select Continue to reopen it. The banner also comes back when you return to the Sites page later in the same browser. Until it settles you cannot start another quote or change sites on the plan.

Only the owner of the billing account who also administers each organisation involved can add sites to the plan. This includes sites in organisations covered by the owner's account. For anyone else, Add site says the billing account owner adds sites to the plan, and nothing is saved or charged; ask the owner to add the site.

If the billing account owner has a Black membership (see "Black membership" under Billing), Add site does not open Add sites to your plan. The site is created active straight away, with no quote, card setup or payment, in every organisation that the owner's billing accounts cover. Organisation admins and site managers of those organisations add sites the same way, without needing to be the billing owner.

On the site page, open the Setup tab. In the Site details card, use Edit site to change the name, URL, available SLA settings (security patching and maintenance update) or Slack notifications for this site. Add site and first-site setup do not include Slack; add channels after the site exists. Organisation admins can choose one or more channels, keep existing settings or turn Slack off for this site. The site and changed Slack settings save together; a refused Slack change does not save a partial site edit. See Workflow integrations below for the setup steps.

The site address must agree with its Drupal Connector configuration. Save the edit, then update the Connector when needed.

Stack versions

Edit site also has a Stack versions section for PHP, Web server and Database. Use it for versions the Connector cannot see, such as a web server behind a CDN or a managed database. Each component shows an In use line: for example "Nginx 1.24.0, reported by the connector", "MariaDB 10.11.6, declared", or "Not known" when nothing has been reported or declared. Sentinel never probes your site from outside to read versions.

To declare a version, choose the product and enter the version. The web server choices are Nginx, Apache, LiteSpeed, Microsoft IIS and Caddy. The database choices are MySQL, MariaDB and PostgreSQL. PHP has no product choice. A version can only contain numbers and dots, such as 1.24.0. To remove a declaration, clear the product and version and save.

A version reported by the Connector always wins. If you have declared one as well, Sentinel keeps your value and the dialog says it is not in use because the connector reports a version. If the Connector later stops reporting a version, your declared value applies again.

Tick Installed from operating system vendor packages for a component that comes from the operating system, for example Debian or Red Hat. These vendors fix vulnerabilities without changing the version number, so matches for that component are treated as low confidence and are not shown. When Sentinel turns on its Ubuntu and Debian checks, an Ubuntu or Debian package is checked against that vendor's own security data instead, so a match the vendor says is not yet fixed in your build still shows. See The Platform list.

The declared versions save together with the other changes when you select Save changes. If the site details save but the stack versions do not, the dialog says so; select Save changes again to retry the stack versions. Sentinel checks reported and declared versions against known vulnerabilities and tells you about serious matches; see Known vulnerability alerts.

Organisation admins and site managers see Edit site (on the Setup tab) and can declare versions. Viewers can read them but not change them. The section is available on all plans.

Known vulnerabilities marker

The Platform panel on the site page (Overview tab) lists the Drupal core, PHP, Web server and Database versions. The web server and database appear when Sentinel has stack data for the site. Next to a version that matches known vulnerabilities, a Known vulnerabilities tag with a warning icon appears. The icon colour follows the highest open severity. Hover over the tag, focus it with the keyboard or select it to open a tooltip, for example "PHP 8.1.2 matches 4 known vulnerabilities (highest: High). Fixed in 8.1.31. This is a version check; your host may already have patched it." Press Escape to close it.

The tooltip links to View on the Platform list (the Platform chip on the Updates tab) and, while the knowledge base is on, What this means. A match comes from the version number alone. Your host may have fixed the problem without changing the version, so treat it as a prompt to check, not as proof that the site is affected.

When every match has been acknowledged, a muted check icon shows instead. Its tooltip says, for example, "PHP 8.1.2: 4 known vulnerabilities, all acknowledged as not affecting this site. Last acknowledged 12 Oct 2026 by Sam Lee."

Some versions show no marker. Not checked yet means Sentinel does not match that product (LiteSpeed, Microsoft IIS, Caddy or SQLite). PHP, Nginx, Apache, MySQL, MariaDB and PostgreSQL are all checked. Unknown means no version has been reported or declared. A version with no matches shows nothing extra.

In the Sites list, a small icon appears beside the site name for each affected component, with the same tooltip. Selecting the icon opens the tooltip and does not open the site.