EffortLess Website Health Check adds a shortcode, [elwhc_health_check], that displays a form. A visitor enters a website URL and an email address, confirms they own the site or are authorized to request the audit, and submits. The plugin then fetches the public home page of that site with the WordPress HTTP API and returns:
- An overall score out of 100.
- Six category scores: HTTPS, security headers, WordPress hygiene, performance, technical SEO, and contact/conversion.
- A list of findings, each with a severity (Important / To improve / For info) and a recommendation.
- An indicative price range, chosen from the price ranges you configure according to the score.
- Buttons to contact you on LINE (if a LINE URL is set), request a quote, and print or save the report as a PDF via the browser’s print dialog.
Every submission is stored in the admin under Website Health Check Audits, with a dashboard, filters (score, lead status, search), a detail page, lead statuses, internal notes, copyable follow-up messages and a CSV export.
What the audit checks
The audit only reads publicly available responses. Per audit it sends a small number of requests to the submitted site: the home page (HTTPS, falling back to HTTP), the http:// variant to check for an HTTPS redirect, robots.txt, sitemap.xml / wp-sitemap.xml, and one TLS connection to read the certificate’s expiry date. Everything else is derived from the response headers and the HTML of the home page: security headers, compression, caching headers, page size, number of scripts and stylesheets, mixed content, title and meta description length, H1, Open Graph, Schema.org, analytics, favicon, WordPress detection and an exposed WordPress version. It does not log in, submit forms, test for vulnerabilities, or crawl other pages.
Settings
All settings are under Website Health Check Settings.
Public form
- Enable public form (on by default) — when off, the shortcode shows “temporarily unavailable” and the REST endpoint rejects submissions.
- Audits per IP / day (default 10, 0 = no limit) — maximum audits one visitor IP address can run per day.
- Audits per domain / day (default 5, 0 = no limit) — maximum audits for the same domain per day.
- Independently of these settings, one IP address can run at most 5 audits per minute.
- HTTP timeout (seconds) (3-30, default 12) — timeout for each request sent to the audited site.
Pricing
- Currency — EUR (default), USD, GBP, CHF, CAD, AUD, BRL, MXN, JPY, KRW, CNY or TWD. The symbol is shown before each amount; the price ranges below are plain numbers you set yourself, so enter them in the chosen currency.
- Price ranges (min/max for Standard optimization, Complete repair, Monthly maintenance). The estimate shown to the visitor is picked by score: 80-100 uses Monthly maintenance, 60-79 uses Standard optimization, 0-59 uses Complete repair.
Contact
- LINE contact URL — when set, a “Contact me on LINE” button appears on the result. Leave empty to hide it.
- Contact email (default: the site admin email) — receives quote requests submitted from the result popup.
- CTA text — label of the “Request a full quote” button. Leave empty to use the translated default.
Legal / GDPR
- Terms of Use URL and Privacy Policy URL — linked from the optional “receive my quote by email” consent checkbox. Leave empty to show the label as plain text.
Data & advanced
- Data retention (days) (default 0 = keep forever) — audits older than this are deleted by a daily scheduled task.
- PageSpeed Insights (off by default) and API key — when both are set, Google PageSpeed Insights mobile and desktop scores are added to the result and drive the performance score. See External services.
- Debug mode (off by default) — writes extra diagnostic entries to Website Health Check Tools & Logs.
- On uninstall (off by default) — when checked, deleting the plugin removes its tables, settings and secrets.
Multisite
Each site keeps its own audits and settings. A network administrator can turn on global mode under Network Admin Settings Website Health Check to apply one shared set of settings to every site. In global mode, a site can still use its own currency and prices from its own Settings page.
Notes and limitations
- The score is a quick, automated reading of a site’s public home page, not a full audit. Sites that return a block or challenge page (bot filters, CDNs) get their content-based checks marked “Not assessed”.
- Private, local and reserved IP addresses (IPv4 and IPv6) are refused, including after redirects, and URLs containing credentials are rejected.
- Visitor IP addresses are never stored as-is; only a keyed hash is kept for rate limiting.
- When a visitor ticks “receive my quote by email”, the plugin first sends a confirmation link to that address and only emails the quote after the link is clicked. Email delivery uses
wp_mail(), so it depends on your site’s mail setup. - The form uses the REST API (
/wp-json/elwhc/v1/audit, with a?rest_route=fallback). If a security plugin blocks the REST API for anonymous visitors, submissions fail. - Page caching: the form includes a REST nonce. If a cached page is served for longer than the nonce lifetime (24 hours by default), submissions fail with “Security check failed” until the cache is cleared. Exclude the page containing the shortcode from your page cache if this happens.
Languages
Includes French (fr_FR), German (de_DE), Spanish (es_ES), Brazilian Portuguese (pt_BR), Korean (ko_KR), Japanese (ja) and Traditional Chinese (zh_TW) translations in the languages folder, plus a .pot template. A translation approved on translate.wordpress.org takes priority over the bundled file for that language.
External services
This plugin can optionally connect to one third-party service:
- Google PageSpeed Insights API — Only used when you enable it and provide an API key in the settings (off by default). When enabled, the URL submitted by the visitor is sent to Google’s PageSpeed Insights API to retrieve performance data for each audit. No visitor personal data (email, IP address) is sent. Terms: https://developers.google.com/terms — Privacy policy: https://policies.google.com/privacy
In addition, the plugin sends HTTP requests to the website URL a visitor submits (the site being audited) to read its public responses, as described under “What the audit checks”.