Old posts quietly lose rankings. Stalemender audits everything you have published, gives each post a Freshness Score (0–100) and tells you why it scored that way, so refreshing content becomes a weekly habit instead of a yearly panic.

What it looks at

Age since the last update (or last editorial review)
Search traffic trend from Google Search Console: clicks in the last 28 days vs the 28 before
Outdated mentions: old years, “this year”, “recently”, prices in headings – each one quoted in context, with a per-post ignore list
Length compared with the typical post of the same type
Internal links pointing in (orphan detection via a full link index)
Structure: H2 headings, images, featured image
Meta description (Yoast, Rank Math, AIOSEO, SEOPress, or the excerpt)
Broken outbound links (light HEAD checks, cached, throttled per host)
Duplicate titles, H1s and near-duplicate slugs

Weights are yours to change. Signals without data (no Search Console, outbound blocked) are skipped and their weight redistributed, so a score is never punished for a missing integration.

Then it helps you act

Audit table: server-side pagination, sort and filter by type, category, author, band, status, assignee, traffic trend or modified date; save views per user; export the current view as CSV
Post drawer: full score breakdown, outdated phrases in context, who links here, notes, status (needs update, in progress, reviewed, merge, delete), assignee, “mark reviewed” which resets the age clock
Refresh next: a top-N list of non-fresh posts ranked by staleness × lost clicks (or × inbound links when Search Console is not connected), on the dashboard and in a widget
Weekly digest email with band counts, trend and the refresh list
AI refresh brief (optional, bring your own OpenAI / Anthropic / Gemini key): a Markdown brief saved as a note. Nothing is sent until you confirm the token estimate.

Built to be light

Custom tables; the only post meta written is your per-post list of ignored phrases, automatic pruning
Audits run in Action Scheduler batches that adapt to your server’s time limit and resume where they left off
Re-scores a post when you save it; drops it when unpublished
Search Console via a service-account JSON key (stored encrypted); nightly sync
WP-CLI: wp stalemender audit run|status|cancel, wp stalemender gsc sync|status, wp stalemender export --file=, wp stalemender score <id> --explain

Hooks for developers

stalemender_signals, `stalemender_signal_weights`, `stalemender_post_types`, `stalemender_exclude_post`, `stalemender_score_computed`, `stalemender_outdated_phrases`, `stalemender_gsc_row`, `stalemender_refresh_list_size`, `stalemender_after_audit`, `stalemender_post_html`, `stalemender_builder_html`, `stalemender_http_args`, `stalemender_rescore_on_save`, `stalemender_capability`.

External services

Stalemender scores your content on your own server and never sends anything to the plugin author. It contacts other servers only in the four cases below. Two are off until you configure them; the outbound link check is on by default and can be switched off.

Google Search Console (optional, off by default)

Used for the “search traffic trend” signal. Nothing is sent until you paste a Google service-account key, pick a property and turn on the sync.

Endpoints: https://oauth2.googleapis.com/token to obtain a short-lived access token, https://www.googleapis.com/webmasters/v3/sites to list the properties the service account can see when you open the property picker, and https://www.googleapis.com/webmasters/v3/sites/{property}/searchAnalytics/query to read performance data.
Sent: a signed authentication token created from your service-account key (the private key itself never leaves your server), the property identifier you chose, and two date ranges (the last 28 days and the 28 days before). No post content or page URLs are sent.
Received and stored: page URLs of your own site with their clicks, impressions and average position. Totals are stored per post in the plugin’s scores table for as long as the post is published; any error message returned by Google and a list of up to 50 unmatched URLs are stored in options. Everything is deleted on uninstall unless “keep data” is enabled.
When: whenever you click “Sync now”, run wp stalemender gsc sync, and, while the nightly sync is enabled, automatically once a day at 03:00 site time. The access token is cached for about 55 minutes.
Scope requested: Search Console read-only (webmasters.readonly). The key is stored encrypted in your database and can be removed at any time from Settings Search Console.
Google terms: https://developers.google.com/terms – Privacy: https://policies.google.com/privacy

AI refresh brief (optional, off by default, bring your own key)

Used only when you open a post, click “AI refresh brief”, read the token estimate and then click “Generate brief”. It never runs automatically.

Sent to the provider you selected: the post title, its URL, last-modified date, freshness score and band, word count, number of internal inbound links, up to 20 headings, the outdated phrases found, the current meta description, the Search Console click counts if you connected it, and the first 6,000 characters of the post text. Your API key is sent in the request header. Your site URL is not sent apart from the post’s own permalink.
Received: a Markdown brief, saved as a note on the post in your database. The number of tokens used is logged locally; the text of the request is not.
Your API key is stored encrypted in your database; only its last four characters are ever shown again.
Providers and endpoints:
OpenAI – https://api.openai.com/v1/chat/completions – Terms: https://openai.com/policies/terms-of-use – Privacy: https://openai.com/policies/privacy-policy
Anthropic – https://api.anthropic.com/v1/messages – Terms: https://www.anthropic.com/legal/commercial-terms – Privacy: https://www.anthropic.com/legal/privacy
Google Gemini – https://generativelanguage.googleapis.com/v1beta/ – Terms: https://ai.google.dev/gemini-api/terms – Privacy: https://policies.google.com/privacy
OpenAI-compatible endpoint – any base URL you enter, including a server on your own network. The plugin does not restrict this address; the terms and privacy policy of that service apply.

Outbound link check (optional, off by default)

The “broken outbound links” signal checks whether the external links in your own posts still work. To do that, your server contacts the third-party websites you link to. It is off until you switch it on, and there is no fixed provider: the addresses contacted are the ones already published in your own content, so their terms and privacy policies are those of the sites you chose to link to.

What is sent: an HTTP HEAD request to the linked URL, or a GET request limited to 20 KB if the site refuses HEAD. The request identifies your site with the user-agent Mozilla/5.0 (compatible; Stalemender/<version>; +https://your-site/), the normal courtesy for automated requests. No content, cookies or visitor data are sent. Links pointing at private or local network addresses are never requested.
When: only while an audit you started is running, or when you click “Rescan” on a post. Never on page views, on post save, or on a schedule. At most 20 links per post and 100 requests per batch; results are cached for 7 days; requests to the same host are spaced out; checks stop automatically after repeated connection failures. robots.txt is not consulted.
How to turn it on: Settings Signals “Check outbound links”. The setting is off when the plugin is installed, so no third-party site is contacted until you enable it. Developers can adjust request arguments with the stalemender_http_args filter.

Weekly digest email (optional, off by default)

When enabled, every Monday at 08:00 site time the plugin sends one email through your site’s normal wp_mail(), with no third-party mail service, to the addresses you enter or to the site admin email. It contains the average score, band counts and the top-10 refresh list with post titles and edit links.

What is stored locally

Scores and signals per post, an internal link map, scan summaries, notes with the WordPress user ID of the editor who wrote them or generated an AI brief, an optional assignee user ID per post, and per-user saved views. The plugin adds no front-end scripts, cookies or visitor tracking, and registers a suggested paragraph under Settings Privacy Policy Guide.

Privacy

Stalemender stores, in its own database tables, a freshness score and the signals behind it for every published post and page: publish and modified dates, word count, internal links, outbound links it checked, the headings it flagged, and, only when you connect Google Search Console, the clicks, impressions and position Google reports for that URL. It does not collect anything about your visitors and sets no cookies.

Data leaves your site only for the optional services listed under External services, each off by default: Google Search Console sync, the AI refresh brief with your own key, and the outbound link check that requests the URLs found in your content. The digest email goes to the addresses you enter and contains post titles and scores.

Uninstalling removes the tables, options, scheduled events and encrypted keys unless you enable “Keep data on uninstall”. The plugin suggests a paragraph for your privacy policy under Settings Privacy Policy Guide.

Stalemender – Content Audit, Stale Post Finder & Content Decay Report