---
title: "Sites: logs and threat scanning"
description: "Two tools help you work out why a site is misbehaving: the **log viewer**, which tails the web server, PHP and WordPress logs, and the **Security Scan Report**, which reports known vulnerabilities in the WordPress plugins and themes installed on…"
url: "https://rackhelm.com/documentation/sites-logs-and-security/"
updated: "2026-09-24"
category: "Client Portal: Managing Your Services"
---

# Sites: logs and threat scanning

Two tools help you work out why a site is misbehaving: the **log viewer**, which tails the web server, PHP and WordPress logs, and the **Security Scan Report**, which reports known vulnerabilities in the WordPress plugins and themes installed on the site. Both work across Enhance, cPanel and Plesk hosting, but how much each one can show you depends on which panel your site is on, and this article says where the limits are.

## The log viewer

The log viewer is not on the site toolbar. Reach it at `/sites/{id}/logs`, where `{id}` is the number in the address bar of the site's dashboard.

![The site log viewer with source, level, grep and since filters above a dark log pane](/wp-content/uploads/rackhelm-docs/portal-services-site-logs.png)
The filters are applied by the server before the log is returned.

The log loads automatically when you open the page and asks for up to 10,000 lines.

### Filters

| Filter | Accepted values |
| --- | --- |
| **Source** | *Any Source*, **nginx** (web server), **php-fpm** (PHP errors) or **wordpress**. |
| **Level** | *Any Level*, **info**, **warn** or **error**. |
| **grep** | Free text to match, up to 200 characters. Useful for a URL path, an IP address or an error string. |
| **since** | A timestamp in ISO 8601 form, for example `2026-08-21T09:00:00Z`. Only later entries are returned. |

Set the filters and select **Apply**. The page reloads with them in the address, so a filtered view can be bookmarked or sent to support.

### What each panel can actually give you

| Panel | What you get |
| --- | --- |
| **Enhance** | All four filters are passed to the panel and applied there, across nginx, PHP-FPM and WordPress logs. |
| **cPanel** | The site's Apache error log only, newest lines last. **grep** is applied — as a plain, case-insensitive text match — but **Source**, **Level** and **since** are ignored. With no log written yet the pane reads "No log entries yet." |
| **Plesk** | Nothing usable — see the warning below. |

> **Warning:** On Plesk hosting the log viewer always shows **"No data."**, however healthy the site and however wide the filters. The portal reads Plesk's logs in one shape and the page expects another, so nothing reaches the pane. It is not evidence that your site is quiet. Read the logs in Plesk itself (**Logs** on the domain), or open a ticket and quote the time the problem happened.

> **Note:** When chasing a 500 error on Enhance, set **Source** to **php-fpm** and **Level** to **error**, then reproduce the error and reload. The newest lines are at the bottom. On cPanel those two filters do nothing, so use **grep** with part of the URL instead.

### When logs are not available

If the site has not finished provisioning, or the portal cannot reach the control panel, the pane reads "Logs are unavailable right now — the site is pending provisioning, or the hosting panel could not be reached." A failure part-way through the request shows "Could not retrieve logs right now." Neither means anything is wrong with your website itself.

## The Security Scan Report

When your provider has the cPGuard scanner enabled on your server, a **Security Scan Report** panel appears on the site dashboard. It loads separately from the rest of the page, so a "Running Security Scan…" spinner is normal for a few seconds. The scanner is configured per server and runs alongside Enhance, cPanel and Plesk alike, so which panel you are on makes no difference here.

![The Security Scan Report panel listing vulnerable plugins with CVSS ratings](/wp-content/uploads/rackhelm-docs/portal-services-site-threats.png)
Each component expands to show the individual vulnerabilities and how to fix them.

The header states how many vulnerable components were found and shows an overall **CVSS Score**. Below it, two tables list **Vulnerable Plugins** and **Vulnerable Themes**:

| Column | Meaning |
| --- | --- |
| **Component Name** | The plugin or theme. |
| **Current Version** | What is installed on your site now. |
| **Patched Version** | The version that fixes the problem. Update to at least this. |
| **CVSS Rating** | The severity score and its label. 7.0 and above is shown in red; below that in amber. |

Select a row to expand it. Each vulnerability lists its own score, a title, a description and a **Remediation** line telling you what to do.

When the scan finds nothing, the panel says so instead: a green **Site is Secure!** banner reading "No major vulnerabilities detected by cPGuard."

![The Security Scan Report panel showing a green Site is Secure banner](/wp-content/uploads/rackhelm-docs/portal-services-site-threats-clear.png)
A clean scan. The panel still loads; it just has nothing to list.

> **Note:** The panel is advisory — there is no button on it to apply an update, and the draft controls for one were taken out rather than shipped half-finished. The endpoints they would have used are still registered but deliberately answer "not available yet", so nothing in the portal can update a plugin or theme for you today. Fix the findings by updating the plugin or theme inside WordPress, or by removing it if it is no longer maintained. Updating WordPress core itself is available from the site dashboard on some panels; see [WordPress tools](/docs/sites-wordpress-tools/).

> **Warning:** If the scanner has no record of your domain — a mistyped domain, a site the scanner has not seen yet, or a scanner address the portal will not call because it is not publicly reachable — the panel renders as *nothing at all*. The "Running Security Scan…" spinner disappears and empty space is left where the report should be. A blank space is therefore not the same as a clean result: a clean result always shows the green **Site is Secure!** banner. If the area goes blank, ask your provider whether the scanner is seeing this domain.

### Acting on the findings

1. Take a [backup](/docs/sites-backups-and-restores/) before updating anything. On cPanel and Plesk, restores are done by your provider, so ask before you start if the site matters.
2. Deal with the highest CVSS scores first — anything 7.0 or above should be treated as urgent.
3. Update the component to at least the **Patched Version** shown.
4. If no patched version exists, remove the component. An abandoned plugin will not be fixed.
5. Reload the dashboard after a few minutes to confirm the finding has cleared.

Findings are cached for five minutes per domain, so a fix will not disappear from the panel instantly.

## Troubleshooting

| Symptom | Cause / fix |
| --- | --- |
| The log pane says "No data." on Plesk hosting. | Expected, and unrelated to your site. See the warning above; read the logs in Plesk instead. |
| The log pane says "No data." on Enhance or cPanel. | Nothing matched the filters. Widen them — set Source and Level back to "Any" and clear **grep** and **since**. |
| The **Source**, **Level** or **since** filter appears to be ignored on cPanel. | It is. cPanel serves the account's Apache error log and only **grep** is applied to it. |
| The **since** filter appears to be ignored on Enhance. | It must be a full ISO 8601 timestamp. A plain date or a phrase such as "yesterday" will not parse. |
| The log stops before the event you are chasing. | Only the most recent 10,000 lines are returned. Narrow the search with **grep** or **since** rather than scrolling. |
| "Could not load security threats at this time. Please try refreshing." | The scan request failed. This is also what you see if the site's primary domain no longer matches what the control panel holds — check the site's [Domains](/docs/sites-domains-and-dns/) page — so reload the dashboard, and open a ticket if it keeps failing. |
| The Security Scan Report area is blank, with neither findings nor the green banner. | The scanner returned nothing for this domain. See the warning above. |
| No security panel appears at all. | The scanner is not enabled for your server. Ask your provider whether it is available on your plan. |
| A finding stays listed after you updated the component. | Results are cached for five minutes. Wait, then reload. |