HOME / HOW IT WORKS
How FaultPilot works
Ten stages turn raw WordPress noise into verified, recovered stability. Each stage is a real subsystem — here is exactly what happens in each one.
Observe
Collectors on live hooks
Detect
Normalize & fingerprint
Correlate
Group into incidents
Diagnose
Weighted RCA
Assess Risk
Six explained factors
Prevent
Hourly trend sweeps
Alert
Deduped, throttled
Recover
Safe Mode & points
Verify
Re-measure health
Learn
Baselines & reports
Observe
Collectors hook into the parts of WordPress where failures actually surface: the PHP error handler and shutdown, database layer, REST dispatch, outbound HTTP API, cron state, mail transport and the admin console. They run on hooks that already execute — FaultPilot adds no front-end requests, no spyware beacons, no background polling of public pages.
Detect
Raw errors arrive messy — the same warning repeated forty times, a stack trace with 60 frames, a deprecation storm from one old plugin. The event pipeline normalizes each signal, assigns a stable fingerprint (FP-82A19C), buffers events per request and batch-writes them. Deprecations are sampled; repeated hits merge into occurrence counts. The result stays lightweight even during a flood.
Correlate
The incident manager groups events sharing a fingerprint into incidents. If an incident was recently resolved, a recurrence reopens it instead of opening a duplicate. Meanwhile the change tracker maintains a timeline of updates, activations and config changes — the raw material for causality.
Diagnose
The Root Cause Analyzer examines each incident against the change timeline within a 24-hour lookback: component matching by file path, temporal proximity, occurrence spikes and concurrent fingerprint activity. Weighted evidence yields a primary suspect and a confidence tier — Strong correlation, Likely cause, Possible cause, or Insufficient evidence. The factors are always shown; the verdict never claims certainty it lacks.
Assess Risk
The risk engine maintains six explainable components — reliability, updates, database, performance, compatibility, security — each computed from measured state with per-factor explanations. When the score moves, the UI shows exactly which factor moved it and why.
Prevent
Hourly sweeps compare current trends against baselines: rising error rates, growing cron backlog, autoloaded option bloat, memory trajectory, REST and mail failure streaks, SSL and disk windows, checkout reliability. Threshold crossings become preventive alerts, deduplicated and throttled — the incident you never see is the product working.
Alert
The alert manager fans out through a dashboard notification center and a branded HTML email channel. Deduplication, throttling, minimum severity and quiet hours are shared rules — you choose the channel mix. Every alert links to the incident with its evidence already assembled.
Recover
When treatment is needed, recovery works outside the admin: the Safe Mode drop-in quarantines failing components by filtering the active plugin list; single-use, HMAC-signed recovery links arm Safe Mode when wp-admin itself is down; recovery points capture the plugin set before every update for one-click rollback.
Verify
A treatment is not done when the button turns green. Post-treatment verification re-measures the health signals that fired: the error stream stays quiet, the loopback succeeds, the cron drains. If verification fails, the incident stays open and says so.
Learn
Baselines persist, the activity log keeps the audit trail, and structured reports export the whole story for post-mortems and client communication. Each incident makes the next one faster to understand — that is what an engine learns.
Watch the pipeline on a realistic incident
The demo replays a full detect → diagnose → recover → verify cycle.