PressVitals Site Auditor

Description

PressVitals Site Auditor is a headless-first diagnostic engine. It runs a
suite of read-only probes across performance, security, deliverability and
database health, assigns each a severity tier, rolls them up into a worst-of
verdict, and exposes the result where automation can actually consume it: a
token-gated REST report, a daily cron with email alerts, and a categorized admin
dashboard.

Battle-Tested in Production:
Verified and continuously tested across real-world hosting architectures, including
managed cloud platforms (IONOS Cloud WAAS) and traditional shared hosting (HostGator cPanel),
guaranteeing accurate diagnostics without false alarms across decoupled PHP runtimes (Web/FPM vs. CLI/Cron).

It is dependency-free — no WooCommerce, no page builder, no other plugin
required — and pluggable: every probe is registered through a filter, so the
60+ built-in probes are just the starting point. The architecture is designed
to scale; register your own via pvsa_registered_checks.

How is this different from the built-in Site Health?

WordPress core’s Tools → Site Health is excellent, but it is an on-demand,
admin-only tool: you open a screen, it runs its status tests, and the Debug tab
prints a static environment dump for support. PressVitals is built for a different
job — continuous, automated, machine-readable monitoring and auditing:

• Headless / API-first. Core Site Health has no public report API. PressVitals
  exposes a no-auth /ping liveness probe and a token-gated /report JSON
  endpoint (HTTP 503 on a failing verdict) so an external uptime monitor,
  status page, or CI pipeline can read site health without logging in.
• Scheduled + alerting. Core never runs on a schedule and never tells you
  when something breaks. PressVitals runs daily via WP-Cron and emails the admin
  when the verdict is fail.
• Severity tiers + worst-of verdict. Core labels results good/recommended/
  critical. PressVitals assigns each probe a 1–5 severity tier and computes a
  single rolled-up verdict suitable for a green/red status signal.
• Probes core does not have. TLS certificate-expiry countdown (core only
  checks that HTTPS works today), PHP micro-patch security advisory auditing
  (against active CVEs like PHP2Shell CVSS 9.2 RCE), PHP runtime hardening
  (expose_php, disable_functions, allow_url_include), .env/secret-file
  web exposure, a web-root stray-backup scanner, baseline security headers,
  forced-HTTPS redirect, XML-RPC exposure, default-admin-username detection,
  SPF + DMARC email-DNS records, homepage indexability, and database-bloat
  (expired transients / revisions / spam) checks.
• Pluggable + configurable. Core’s tests are fixed. PressVitals lets any plugin
  or theme register probes via a filter and tune every threshold via filters.

Think of it as the layer on top of Site Health: the same read-only philosophy,
re-pointed at automation, alerting, and security/ops auditing.

Built-in probes

PressVitals ships 60 built-in probes, grouped by functional category:

• Availability — database connectivity, homepage HTTPS reachability, maintenance mode not stuck.
• Security — PHP runtime hardening (expose_php, high-risk disable_functions, allow_url_include),
  .env not web-accessible (HTTP) and not exposed on disk, web-root stray/backup file scan,
  TLS certificate expiry, baseline security headers, forced HTTPS, XML-RPC exposure,
  no default admin user, wp-config.php permissions, user-enumeration exposure,
  debug.log public exposure, default table prefix detection, PHP execution blocked in uploads,
  password hashing algorithm modernization (bcrypt vs MD5).
• Errors — error-log size, recent PHP fatal errors.
• Database — core tables present, non-core/orphaned tables, autoloaded-options
  size, heavy autoloaded options (> 100 KB), core table index health (PRIMARY keys),
  postmeta orphans, table collation, DB client charset, database bloat (revisions, trashed posts).
• Files — free disk space, uploads-directory writability, recent backup recency.
• Email — SPF + DMARC DNS records for the sending domain.
• SEO — homepage is indexable (not noindex).
• Performance — PHP memory limit, persistent object cache, OPcache status and hit rate,
  WP-Cron HTTP loopback spawn, development mode off in production, modern image format support (WebP/AVIF).
• Environment — supported PHP version & micro-patch security advisories (against active critical CVEs),
  WordPress core update available, plugin updates pending, theme updates pending,
  inactive plugins/themes count, environment type is production.

Extend it with your own checks

Probes are not hardcoded — the engine collects them from a filter, so any plugin
or theme can register its own:

add_filter( 'pvsa_registered_checks', function ( array $checks ) {
    $checks['my_queue_backlog'] = array(
        'label'    => 'Job queue backlog',
        'group'    => 'Performance',
        'tier'     => 2,
        'callback' => function () {
            $pending = my_count_pending_jobs();
            return $pending > 1000
                ? array( 'status' => 'warn', 'detail' => "$pending jobs pending" )
                : array( 'status' => 'pass', 'detail' => "$pending jobs pending" );
        },
    );
    return $checks;
} );

A callback returns array( 'status' => 'pass'|'warn'|'fail', 'detail' => '…' ).

Developer filters

• pvsa_registered_checks — register/override probes.
• pvsa_setting_{key} — override a stored threshold at read time.
• pvsa_alert_email — change the failure-alert recipient.
• pvsa_http_timeout, pvsa_disk_free_min_bytes, pvsa_memory_min_bytes,
  pvsa_fatal_lookback_hours, pvsa_fatal_scan_max_bytes — tune environment probes.
• pvsa_ssl_warn_days, pvsa_ssl_fail_days — TLS expiry thresholds.
• pvsa_backup_warn_days, pvsa_backup_fail_days — backup-recency thresholds.
• pvsa_last_backup_timestamp — report your last successful backup time (UNIX) so
  the backup probe works with any backup plugin, host, or off-site service.
• pvsa_backup_plugins — list of backup-plugin basenames recognised by presence.
• pvsa_max_expired_transients, pvsa_max_revisions, pvsa_max_spam_comments —
  database-bloat thresholds.
• pvsa_known_tables — full table names to treat as expected (silences the
  non-core/orphaned-tables probe for legitimate plugin tables).
• pvsa_orphan_tables_warn — non-core table count above which the probe warns.
• pvsa_sending_domain — domain used for the SPF/DMARC lookup.

Compatibility

PressVitals has no plugin dependencies and runs on virtually any WordPress
install — single-site or multisite, with or without WooCommerce, page builders,
or a backup plugin. It calls only core WordPress APIs and guards every optional PHP
function (disk_free_space, stream_socket_client/OpenSSL, dns_get_record,
WP_Filesystem), degrading a probe to a neutral pass/skip when something isn’t
available rather than erroring. The backup probe is backup-agnostic: it reads
UpdraftPlus directly, recognises other common backup plugins, and lets any other
backup solution (including host-level backups) report in via
pvsa_last_backup_timestamp.

Development

Two local workflows are scaffolded (both Docker-based; neither ships in the
package):

Automated tests — wp-env (recommended): requires Docker + Node.js.
npm -g install @wordpress/env, then wp-env start and
wp-env run tests-cli –env-cwd=wp-content/plugins/pressvitals-site-auditor vendor/bin/phpunit.
Switch versions by editing core / phpVersion in .wp-env.json and running
wp-env start –update. Without Docker, run the suite the classic way:
composer install, bin/install-wp-tests.sh wordpress_test root '' localhost,
composer test. A GitHub Actions workflow runs PHPUnit across PHP
7.4 / 8.0 / 8.2 / 8.3.

Manual multi-version testing — docker-compose: docker compose up -d boots
three browsable installs at fixed WordPress x PHP combos (WP 6.7/PHP 8.3,
WP 6.4/PHP 8.1, WP 6.3/PHP 7.4) on ports 8083 / 8081 / 8074, each with the plugin
mounted. See docker-compose.yml for details.