Technical Site Auditor scans your WordPress site the way visitors and search engines see it and reports technical problems in SEO, performance, security, accessibility, database health, e-mail deliverability and WooCommerce store setup. Every issue explains what was found, why it matters and how to fix it step by step. The free version fixes everything except search visibility and WooCommerce: 67 one-click fixes, every one of them undoable.

A scan only reads. Nothing on your site changes until you apply a fix, and every fix records what it changed so you can undo it under Fixes Applied & history.

The free version runs 251 checks in 26 groups, plus up to 6 page-builder checks when Elementor or Divi is installed and 12 WooCommerce store-setup checks when WooCommerce is active. Premium adds the search-visibility and WooCommerce fixes, 41 WooCommerce catalogue and store-operations checks, automation (scheduled scans, regression monitoring, scheduled maintenance, plugin-status alerts), backups and the Redirect, Meta and Breadcrumbs tools.

Key Features

Scanning and reporting
* Scans your pages over HTTP in batches, up to 5,000 URLs per scan by default (filterable); site-wide facts such as robots.txt, sitemaps, headers and the database are checked once per scan
* Problems that come from your theme and repeat on most pages are reported once for the whole site, with sample pages
* Scan completeness: how many pages could not be read and why, so a clean result never hides pages that were never checked
* Issues by page or by check, with Open, “Fix active, still detected”, Ignored and Resolved tabs and filters for severity, category, fix type and text
* “Re-check this URL” verifies one page without a full scan; ignore a check everywhere or mark issues as resolved
* New-since-last-scan markers with the date each issue was first seen, a site health score on the Overview, and CSV export of the filtered list

Content and SEO
* Titles, meta descriptions, headings, thin content, duplicate titles and descriptions across the whole site
* Open Graph and Twitter Card tags, social image size, Schema.org structured data
* Canonical tags (including canonicals that point to a redirect or a noindexed page), noindex on important pages, X-Robots-Tag headers, robots meta conflicts, hreflang
* robots.txt rules and syntax, XML sitemap contents and size limits, published pages missing from the sitemap, plain permalinks
* Indexable internal search results, a duplicate author archive on single-author sites, classic themes without title-tag support
* Broken internal links, links through redirects, orphan pages, redirect chains and loops; external links checked with retries so a slow or bot-blocking site is “could not be verified”, not broken
* Sample content left published, links to development hosts, dead goo.gl links

Performance
* Images: dimensions, lazy loading, srcset, alt text, WebP/AVIF delivery, priority hints for the largest image
* Render-blocking CSS and JavaScript, file counts, cache busting, page size, DOM size, speculative loading
* Fonts (font-display, preconnect, Google Fonts), iframes (lazy loading, titles, dimensions)
* Server: PHP support status by date, compression, HTTP/2, TLS version, certificate validity and expiry, object cache, OPcache

Security
* HTTPS, HTTP-to-HTTPS and www redirects, HSTS strength, mixed content on HTTPS pages
* HTTP security headers verified with real requests
* Downloadable sensitive files (.env, .git, wp-config.php backups, database dumps, phpinfo, Adminer), confirmed by their content
* Missing or default authentication salts, PHP errors shown to visitors, XML-RPC, user enumeration, the file editor, debug.log exposure, directory listing, PHP execution in uploads, wp-config.php permissions, open registration with an elevated role

Accessibility, database and hygiene
* Form labels, alt text on linked images, empty buttons and links, skip links, zoom blocked by the viewport tag, iframe titles, the page language
* Autoloaded options, revisions, spam, trash, expired transients, orphaned metadata and cron events, table engine, fragmentation, utf8mb4, Action Scheduler bloat
* Plugins and the active theme (and its parent) closed or removed on WordPress.org, abandoned, untested or with pending updates, and a “changed since last time” panel

AI visibility and e-mail deliverability
* Which AI crawlers your robots.txt allows, blocks or does not mention, and whether an llms.txt file exists
* SPF and DMARC records present and valid, a mail server (MX) for the sending domain, a DKIM key at common selectors, and “WordPress could not send email” when the last e-mail failed
* Send test e-mail (Settings Advanced): whether wp_mail() succeeded, the error, the From address and whether PHP mail() or SMTP was used

WooCommerce
* Free, when WooCommerce is active: cart, checkout and account pages set up, not cached and not indexable; terms and privacy pages; payment method; tax; REST and Store API exposure; the legacy API; webhooks over plain HTTP; checkout over HTTPS
* Premium: products, variations, shipping, stock, reviews, cart fragments, sessions, Action Scheduler failures, a payment method in test mode on the live site, pending database updates, outdated template overrides, order e-mails switched off, HPOS compatibility mode, missing tax rates, large logs and product images without alt text

One-click fixes in the free version

The free version fixes everything except search visibility and WooCommerce. Its 67 fixes each record what they change and can be undone under Fixes Applied & history:

Security hardening and headers: security headers, HSTS, upgrade-insecure-requests, deprecated headers, PHP execution in uploads, sensitive files, install.php, directory listing and debug.log. .htaccess changes are backed up, the site is tested after the change and the change is rolled back if it breaks the site; on nginx the fix says why it cannot be applied
More security: XML-RPC, the file editor, version disclosure, user enumeration, PHP errors, a safe default role, rel=”noopener”, readme.html, minor core auto-updates, Application Passwords, pingbacks, a REST API login requirement, a redirect to HTTPS and the main host, wp-config.php permissions
Database cleanups with 30-day restore: revisions, spam, trash, expired transients, orphaned metadata and cron events, auto-drafts and Action Scheduler history are saved before deletion and can be restored for 30 days. Plus autoloaded options, MyISAM to InnoDB, utf8mb4, table optimisation and a revision limit
Performance: emoji scripts, oEmbed discovery, head clutter, jQuery Migrate, deferred JavaScript, font-display and preconnect, lazy-loaded iframes, comment-reply.js only where needed, speculative loading, WebP for new uploads, GZIP, browser caching, Elementor and Divi optimisations
Cleanup, content and accessibility: comments, dashboard widgets, the admin bar, unused widgets, the welcome panel, update notices; http:// URLs rewritten to https:// in the database (serialization-safe), staging URLs, mailto: links, sample content, self-pingbacks, the HTML lang attribute and a skip link

Free vs Premium

Every check is free except the WooCommerce catalogue checks, and every fix is free except the SEO/search-visibility and WooCommerce fixes. Premium adds those, plus automation, backups and the Redirect, Meta and Breadcrumbs tools.

Free Version
* 251 checks in 26 groups (plus page-builder checks), including WooCommerce store setup and e-mail deliverability, and a test e-mail
* Fix guidance for every issue and 67 one-click fixes with undo
* Up to 5,000 URLs per scan, scan completeness, re-check, ignore and resolve, health score, new-since-last-scan markers, CSV export

Premium Version
* Everything in the free version, plus SEO and search-visibility fixes: search engine indexing, post-name permalinks, attachment pages, canonical tags on archives, noindex for empty archives and internal search results, the core sitemap, the sitemap line in robots.txt, an llms.txt generator, an AI crawler block list, redirect chains and rules, content links through redirects, the author archive redirect and title-tag support
* 41 more WooCommerce checks and 12 WooCommerce fixes
* Presets (Minimal, Balanced, Performance) that apply a curated set of fixes in one go
* Regression monitoring: new, resolved and returned issues since the previous scan, issue history and a health score trend
* Scheduled scans with an HTML e-mail report, optionally only when new problems appear
* Scheduled maintenance: the database cleanups you choose run on a schedule, each run undoable for 30 days
* E-mail alerts when an installed plugin is closed, removed or abandoned on WordPress.org
* Backups of the database, themes and plugins with a safe, atomic restore (uploads and wp-config.php are not included)
* Tools: Redirect Manager, Meta Title/Description Manager, Breadcrumbs
* Undo never requires an active licence

Integrations

Technical Site Auditor recognises popular plugins and adjusts its checks to them: Yoast SEO, Rank Math, All in One SEO, SEOPress, The SEO Framework, WooCommerce, Elementor, Divi, WPBakery, and caching, image optimisation, security, backup, forms, analytics, multilingual and redirect plugins (Help Integrations lists them all and shows which are active on your site).

External Services

This plugin connects to the following external services. Requests happen only while a scan or a re-check runs (including scheduled scans in the premium version), and when you apply certain fixes. Every outgoing request is made by your own server through the WordPress HTTP API, which identifies itself with WordPress’s standard user agent (your WordPress version and site address) unless stated otherwise.

WordPress.org API

The System Health checks use the official WordPress.org API.

What it does:
* Tests whether your server can reach api.wordpress.org, which WordPress needs for updates (core/version-check)
* Verifies that core WordPress files have not been modified (core/checksums)
* Looks up your active theme and, for a child theme, its parent theme in the theme directory (themes/info) to see whether it has been closed or not updated for years

Data sent:
* Your WordPress version number and site locale (language setting), for the core file checksums
* The directory slug of the active theme and its parent theme, for the theme lookup. Only themes that WordPress.org already serves updates for on your site are looked up

When data is sent:
* Only during a scan, when the System Health check is enabled. Theme lookups are cached for up to 24 hours, and at most 2 are made per scan.

Service provider: WordPress.org
* Terms of Service
* Privacy Policy

WordPress.org Plugin Directory API

When the Plugin Hygiene check is enabled, the plugin queries the official WordPress.org plugin information API (api.wordpress.org/plugins/info/1.2/) for installed plugins.

What it does:
* Checks whether installed plugins are still listed in the WordPress.org directory or have been closed
* Checks when each plugin was last updated and which WordPress version it was tested with
* Checks each plugin’s declared minimum PHP and WordPress requirements

Data sent:
* The directory slug (folder name) of each plugin. No license information is transmitted.

When data is sent:
* Only during a scan when the Plugin Hygiene check is enabled. Only plugins that WordPress.org already serves updates for on your site are looked up; plugins that declare their own update source (Update URI header) and premium or custom plugins are never sent. Responses are cached for up to 24 hours, and at most 30 lookups are made per scan.

Service provider: WordPress.org
* Terms of Service
* Privacy Policy

Public DNS lookups

When the System Health check is enabled, the plugin performs DNS lookups for your own site’s domain and the domain WordPress sends e-mail from: TXT records for SPF and DMARC (the _dmarc subdomain), MX records (with an A/AAAA fallback) to see whether the domain can receive bounces and replies, and DKIM TXT records at about 30 common selectors (selector._domainkey.domain). These are standard DNS queries made by your server’s resolver; nothing is transmitted beyond the domain names being looked up. Results are cached for up to 12 hours, and the checks are skipped for local and development domains.

Test e-mail

“Send test e-mail” (Settings Advanced) sends one message through your site’s own mail setup (wp_mail(), and whatever SMTP or e-mail service plugin you use) to the address you type in, only when you click the button (at most one every 30 seconds). The plugin stores the time, whether it was sent, the mailer and the From address, but not the recipient or the subject.

Requests to your own site and to linked pages

During a scan, the plugin makes HTTP requests to your own site: its pages, robots.txt, sitemaps, a few probe URLs (for example /favicon.ico or files that should not be public) and one or two images and CSS/JavaScript files your pages load, which may be served by your CDN. When the External Links check is enabled, it also requests external URLs linked from your content to verify they still work (at most 10 links per page, results cached for up to 24 hours); these requests use the user agent “Mozilla/5.0 (compatible; WTSA Link Checker/1.0)”. Some fixes make a test request to your own site after a change (for example, to confirm a .htaccess rule did not break the site). No personal user data is transmitted.

Premium version only: pihlfelt.se

The premium version contacts pihlfelt.se to activate and check your licence and to deliver plugin updates. The free version from WordPress.org never contacts pihlfelt.se.