What Broke Your WordPress Site?
Find Out in Seconds — Not Hours.

A top-level 0–100 score that grades your site across its most impactful performance and safety dimensions — refreshed on demand via AJAX.

• PHP version (8.1+ recommended)
• Pending WordPress core & plugin updates
• Autoloaded options size (warn at 500 KB, critical at 800 KB)
• Orphaned postmeta, HTTPS enforcement, WP_DEBUG status

The dashboard analyses your live error log, autoload size, cron status, and pending updates — then surfaces the fastest routes to your current problem, specific to what's actually happening on your site right now.

• Seven evaluated scenarios: post-update breakage, slow admin, checkout issues, outages, plugin conflicts, DB errors, performance regression
• Each path shows which modules to visit and in what order
• Specific errors from your log that triggered each recommendation
• Clickable module cards for fast navigation to the right place

Most developers never read their error log. WP Health Inspector reads it for you — groups every PHP error by severity and frequency, and gives you a structured "Error Map" for each one: plain-English explanation, the probable cause extracted from the actual function or class that failed, numbered fix steps, and ready-to-run WP-CLI commands.

• Severity-grouped view: critical, performance, and informational — with occurrence counts and first/last seen timestamps
• Error Map: five structured sections per error — What It Means, Probable Cause, Impact, numbered Fix Steps, and Prevention. A fatal WooCommerce error gets different advice than a redeclare conflict — because they're different problems.
• Live error log: captures errors in real time with its own error handler. Clear it, reproduce the issue, and see exactly which new errors appeared — without wading through weeks of historical noise.
• "What Changed?" button on every error card — checks whether a recent plugin update caused the error, without navigating away

"Something broke after an update" is the most common WordPress support request — and the hardest to answer without this. What Changed? tracks every plugin update, activation, and WordPress core update as a timestamped event, then correlates them with your PHP error spikes to show exactly what broke your site and when.

• Interactive SVG timeline displaying change events and error frequency side by side — so the pattern is obvious at a glance
• 0–99 confidence scores: file-path matching (error originates inside the updated plugin's folder) scores 80–99 — that's near-certain attribution
• "What Changed?" button on every error card opens the correlation panel inline — see which update caused the error without navigating away from it
• Plugin version history, error onset analysis, and chronological event log in one view

Read-only queries that surface potential database bottlenecks without modifying a single row.

• Table bloat — lists all tables exceeding 50 MB with exact sizes
• Autoloaded options with Top 10 / Show All toggle, color-coded by severity
• Orphaned postmeta, usermeta, and term relationships; revision bloat detection
• Options table audit — expired transients, oversized options, active transient count

Understand what WordPress background tasks are actually doing — and which ones aren't running at all.

• Standard WP-Cron jobs with next run timestamp and recurrence interval
• Overdue event detection — flags any event whose scheduled time has passed
• Action Scheduler jobs — pending, failed, and completed counts
• All jobs sorted chronologically by next scheduled run

Every autoloaded option loads into PHP memory on every single page request. This module names the culprits and gives you the exact WP-CLI commands to clean them up.

• Total autoload size with tiered thresholds — warning at 500 KB, critical at 800 KB
• Per-plugin attribution — groups options by prefix to identify which plugin is responsible
• Deep Diagnostics — orphaned options from removed plugins (80+ fingerprint database), autoloaded transients, duplicate cache clusters, migration remnants, stale WooCommerce sessions
• Each finding includes a ready-to-run WP-CLI remediation command

Proactive alerts for things that will break your site in the near future — surfaced before they become emergencies.

• SSL Certificate Expiry — live certificate check, red alert when ≤15 days remain
• PHP end-of-life flags, stale plugin count, and expired API key / license inventory
• Update Risk Analysis — detects major version jumps and flags high database migration risk

Maps every custom table, cron job, and REST route on your site — and attributes each one to the specific plugin that created it.

• Custom database tables with owning plugin name, version, and row count
• Non-core cron jobs attributed via callback Reflection and fingerprint matching
• REST API namespace (PRO) — every route attributed to its registering plugin
• Full Hook Inspector (PRO) — $wp_filter dump with dark-mode modal and pop-out view

Inspects every script and stylesheet WordPress has enqueued on the front end — with file-level size data.

• Separated JavaScript and CSS sections with individual file sizes
• Running totals per category so you can gauge payload at a glance
• Source attribution — identifies which plugin or theme registered each asset
• Graceful fallback when CDNs don't return Content-Length headers

A complete technical profile of your hosting environment — surfaced directly inside WordPress admin.

• All critical php.ini directives: memory limit, max execution time, OPcache status, error display, and more
• Every relevant wp-config.php constant with its live value and a plain-language flag for any problems
• Recommended extension check, full loaded extension inventory (searchable), and complete database details

Every installed plugin checked against WordPress.org in real time — flagging abandoned maintainers, stale tested-up-to versions, and plugins that have been closed or removed from the repository. Closed plugins never receive security patches. Ever.

• Closed / removed detection — the most critical flag: plugins pulled from WordPress.org often had unpatched security vulnerabilities when they were removed
• Last-updated staleness — warns at 12 months, flags as abandoned at 24 months
• Tested-up-to drift — flags plugins not tested against your running WordPress version
• Risk-sorted table: Critical (closed), High (abandoned), Medium (at risk), Low (maintained) — 12-hour cache, manual re-check button

Answers the single most common WordPress support question: "Why isn't my site sending email?" — with a complete read-only diagnosis of your mail transport, sender authentication DNS, and a live send test that shows the mailer's actual error when it fails.

• Transport detection — identifies 10 known SMTP plugins, detects pluggable wp_mail() overrides, and warns clearly when the site is using unauthenticated PHP mail() with no signing
• Live SPF, DKIM (10 common selectors probed), DMARC with policy analysis, and MX DNS checks — each with a plain-English explanation of what a failure means for deliverability
• One-click send test to the current admin's email — surfaces the real wp_mail_failed error message, not a generic "it didn't work"
• Results cached 1 hour; manual re-check button for after DNS changes propagate

"Is my host slow?" — answered with four timed probes, letter grades, and a history chart. Database throughput, PHP CPU speed, filesystem I/O, and full-stack loopback TTFB — measured on demand, never automatically. Keeps 12 runs so a host migration shows up as a chart trend, not a hunch.

• Database benchmark — measures simple indexed query round-trips per second; grades A (900+ q/s) through D (<250 q/s)
• PHP CPU benchmark — hashing throughput in kops/sec; identifies throttled or oversold shared hosting
• Filesystem benchmark — 256 KB write + read + delete cycle in uploads; latency under 15ms is grade A
• Loopback TTFB — HTTP request to your own homepage; persistent drops in the history chart cross-reference with What Changed? to pinpoint the cause

Generate a self-contained HTML diagnostic report from all available modules and hand it to a client, a colleague, or your hosting provider — without sharing credentials, recording your screen, or writing a single word yourself.

• One-click download — a single portable HTML file covering health score, error log summary, database metrics, cron status, and system snapshot
• Share findings with developers or hosting support without granting anyone admin access
• Use as a pre-maintenance baseline — run it before and after any major change to document what shifted
• Pro users get an expanded report covering every module; Lite includes the core diagnostic summary

Before you click "Update", score every pending plugin update by its hooks, tables, cron jobs, REST routes, asset weight, and error history.

• Blast Radius Score from 0–100 for each pending update
• Low, Moderate, High, or Critical risk rating with a plain-English summary
• Shared hooks, cron jobs, REST routes, database footprint, and error-history context
• Analysis cached for 30 minutes with an on-demand refresh

The answer to "why is this site broken?" — without spending an hour opening twelve different screens. Root Cause Analysis cross-correlates your error log, slow queries, cron backlog, autoload bloat, and external dependencies into named, actionable findings — then tells you which plugin is responsible.

• Correlates data from all modules into plain-English findings with severity and confidence ratings
• Plugin attribution — names the specific plugin responsible for each finding, with WP-CLI commands and a deactivation link so you can act immediately
• "Primary Suspect" callout when multiple findings point to the same plugin — no more guessing which one to disable first
• Change correlation — checks if recent plugin updates coincide with current errors

Shows exactly which plugins are fighting over hooks, loading duplicate assets, and providing overlapping functionality — with full plugin names, versions, and one-click deactivation links.

• Hook conflict detection — plugin name pills show exactly which plugins share the same hook at the same priority
• Competing plugin analysis — flags two caching plugins, two SEO plugins, or two security scanners active simultaneously, with risk level and deactivation links
• Duplicate asset detection — shows each conflicting handle alongside the plugin name and version that registered it
• Priority extremes — shows which plugin runs first and which runs last on the same hook

Lint plugin and theme code for issues. Quickly debug issues occurring on your site due to improper syntax, without running the code.

• Check all plugin files and themes for code issues
• Identify the exact file and line of code

Validated diagnostic snapshots and controlled export for teams overseeing a portfolio of WordPress sites.

• Consistent fleet snapshots
• Snapshot validation
• Controlled multi-site operations

A focused technical health review of each installed plugin, extending beyond repository age into compatibility and operational risk signals.

• Per-plugin technical inspection
• Compatibility and implementation risk signals
• Evidence-based maintenance priorities

Captures per-request execution time, peak memory, database query counts, and hook timelines — the data you need to pinpoint exactly where slowdowns originate.

• Live snapshot: execution time, memory delta, query count, and total query time
• Slow query detection with per-query timing when SAVEQUERIES is enabled
• Hook Timeline Visualisation — bar chart of relative time spent per action and filter callback

Tracks every outbound HTTP request your WordPress site makes — because a slow or failing third-party API can silently cripple your page load times.

• Per-host summary with request count, average latency, max latency, and error rate
• Slow request threshold (500ms+) and failing request identification with status codes
• Blocking vs. non-blocking classification — understand which calls are holding up page rendering

Rolling snapshots of execution time, memory usage, and query counts over time — so you catch regressions the moment they start, not after clients report slowdowns.

• Automatic trend analysis: improving, stable, or regressing — tracked across every snapshot
• Historical snapshot table with execution time, peak memory, query count, PHP version, and active plugin count
• No personal data stored — only anonymous system-level performance metrics

Server-side proxy estimates for LCP, CLS, and INP — correlated with detected performance issues so you know what to fix first.

• LCP, CLS, and INP estimates from server-side metrics and asset weight analysis
• Per-metric signals tied to your actual TTFB, external dependencies, and asset payload
• Color-coded Good / Needs Work / Poor ratings so you can prioritize improvements

Three read-only security inspections that surface privilege creep, tampered plugin files, and exposed REST endpoints — before an attacker finds them.

• User & Role Audit — every account grouped by role, with flags for non-admins holding dangerous capabilities
• Plugin Checksum Verifier — compares installed files against WordPress.org checksums to detect unauthorized modifications
• REST API Route Inspector — registered routes with permission callbacks, so you know what's publicly accessible

Pre-flight compatibility checks for WordPress core upgrades — surface breaking changes before they break production.

• Deprecated Functions Inventory — every deprecated function with the version it was deprecated in and its replacement
• Breaking Hooks Detector — scans the live $wp_filter for hooks renamed or removed in recent WordPress releases
• Plugin Compatibility Matrix — calls the WordPress.org API to flag plugins not tested against your running WP version

Inspects your media library and permalink layer for orphaned files, broken references, and stale rewrite rules that quietly degrade user experience.

• Media Library Health — detects missing physical files, unattached media, and attachments with broken metadata
• Rewrite Rules Inspector — active rules, stale state detection, and plugin-added rules that may conflict
• Broken Reference Detection — scans post content for attachment IDs that no longer exist

A concise cross-module summary of the health changes, risks, and regressions that deserve attention.

• Cross-module operational summary
• Change and regression awareness
• Agency-friendly recurring review

Apply an agency-ready identity to exported diagnostic reports for polished client delivery.

• Agency identity
• Consistent client presentation
• Export Report integration

A dedicated protection boundary for redacting, validating, and securing authorized outbound diagnostic data.

• Egress guard
• Sensitive-value redaction
• Protected diagnostic payloads