=== Site Health Report ===
Contributors: wpsitekept
Tags: site health, security, vulnerabilities, maintenance, performance
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A plain-English health report for your site: outdated software, known vulnerabilities, unsupported PHP, abandoned plugins and missing backups.

== Description ==

WordPress has a built-in Site Health screen, but it speaks to developers. This plugin answers the question a business owner actually has: **is my site alright, and if not, what do I do about it?**

Activate it and it scans immediately. No account, no signup, no API key, no upsell wall. You get a score out of 100 and a list of findings, worst first, each one written in plain English with instructions for fixing it yourself and a rough idea of how long that takes.

**Nothing is modified.** This plugin only reads. It never changes your files, your database or your settings.

= What it checks =

* **Known vulnerabilities** — whether any installed plugin has a publicly disclosed security flaw, and which version fixes it, using the Wordfence Intelligence database. Core WordPress does not check this.
* **Abandoned and removed plugins** — anything not updated in 18 months, or pulled from the WordPress.org directory, which will never get another security fix.
* **Updates** — WordPress core, plugins and themes, with the risk explained rather than just counted.
* **PHP version and support status** — whether your PHP still receives security fixes, and the date support ended.
* **Backups** — whether any backup system is actually running.
* **Security** — HTTPS, predictable admin usernames, debug output visible to visitors, the built-in file editor, world-writable folders, missing security headers.
* **Performance** — autoloaded option size, expired cache rows, object caching, post revisions.

= Also included =

* **Weekly re-scan** with score history, so you can see the site drifting before something breaks.
* **Printable report** you can save as a PDF or send to a client.
* **Optional weekly email summary** — type an address, no account required. Sent by your own site.

= Who makes this =

Site Health Report is built by [WP Site Kept](https://www.wpsitekept.com), a WordPress maintenance service. The plugin is free, complete, and useful on its own — you never need to buy anything. If you would rather not do the work yourself, there is a link to our service inside. That is the whole business model, stated plainly.

== External services ==

**Vulnerability lookup (optional, on by default)**

To check whether your plugins have known security vulnerabilities, this plugin sends a list of **plugin slugs and version numbers**, your WordPress version and your PHP version to `https://www.wpsitekept.com/api/plugin/vulnerabilities`. That endpoint checks them against the Wordfence Intelligence vulnerability database (https://www.wordfence.com/threat-intel/) and returns any matches.

No site address, no content, no user data, no personal data is sent, and nothing is stored. You can switch this off in **Health Report → Settings**, in which case nothing is sent and the vulnerability check is skipped.

Terms: https://www.wpsitekept.com/terms — Privacy: https://www.wpsitekept.com/privacy

**WordPress.org plugin API**

To detect abandoned or removed plugins, the plugin queries `https://api.wordpress.org/plugins/info/1.2/` with plugin slugs. This is the same public API WordPress itself uses to check for updates.

== Installation ==

1. Install and activate. The scan runs by itself and you land on the report.
2. Read the findings. Fix what you want to fix.
3. Optionally add an email address in Settings for a weekly summary.

== Frequently Asked Questions ==

= Does this change anything on my site? =

No. Every check is read-only. Nothing is written to your files or database except the report itself and your settings.

= Do I need an account? =

No. There is no signup, no API key and no login. Install it and it works.

= How is this different from the Site Health screen in WordPress? =

Core Site Health is written for developers and does not check for known vulnerabilities, abandoned plugins, missing backups or PHP end-of-life dates. This plugin does, and explains each finding in language a site owner can act on.

= Will it slow my site down? =

No. Nothing runs on your public pages. Scans happen in the admin when you ask, or once a week in the background.

= Is it really free? =

Yes, entirely, with no locked features. We also sell a maintenance service and there are links to it in the plugin. You are under no obligation to use it.

== Screenshots ==

(Place screenshot-1.png … screenshot-4.png in the /assets directory of the SVN repo, not in the plugin folder.)

1. The report: a score out of 100 with findings ordered worst first.
2. Every finding explains what it means and how to fix it yourself.
3. Score history from the weekly background scan.
4. A printable report you can save as a PDF or send to a client.

== Changelog ==

= 1.0.0 =
* First release.
