NPC Maintenance Inspector

NPC Maintenance Inspector performs 9-point health diagnostics on your WordPress site directly from the admin dashboard:

1. WordPress core updates — Detect missing core updates.
2. Plugin updates — List plugins with available updates.
3. Site Health issues — Extract critical issues from WP standard Site Health API.
4. PHP version — Warn on end-of-life PHP versions.
5. Error log analysis — Summarize debug.log entries and save a one-click backup to uploads/ for safe review.
6. File integrity — Detect suspicious code patterns in core files (eval / base64_decode / etc.) by comparing checksums against the WordPress.org Checksum API.
7. Suspicious files — Find unexpected PHP files in wp-content/uploads/, with built-in whitelist for known legitimate plugin files (Ajax Load More templates, WP STAGING index.php, AIOS firewall rules, etc.).
8. SSL certificate — Check days until expiration (warn under 30 days, critical at 0).
9. File permissions — Check critical files like wp-config.php, .htaccess, wp-content/.

Operational features:

• History — Keep the last 10 diagnoses as a custom post type.
• Scheduled auto-check — Run daily, weekly, or monthly via WP Cron.
• Email notifications — Send alerts only on critical issues.
• One-click debug.log backup — Save a copy of debug.log without modifying the original.
• Optional AI report — Generate maintenance suggestions via Anthropic Claude API. Disabled by default; opt-in via a wp-config.php constant.

The plugin is locked to the user who activated it and to the original site URL, so it stays inert after backup restores to a different domain.

External services

This plugin contacts two external services.

1. WordPress.org Checksums API (https://api.wordpress.org/core/checksums/1.0/) — every diagnosis (manual or scheduled). The File Integrity check downloads the official checksums for the installed WordPress version to compare them with the core files on your site. Sent: the WordPress version and the site locale as URL parameters (if no checksums exist for the locale, the request is repeated with en_US). No file contents or diagnosis results are sent. As with all requests WordPress makes, the standard user agent includes the WordPress version and the site URL. WordPress.org privacy policy: https://wordpress.org/about/privacy/
2. Anthropic Claude API (https://api.anthropic.com/v1/messages) — optional, to generate AI-powered maintenance reports. Details below.

The update checks for WordPress core and plugins use WordPress core’s own functions (wp_version_check() / wp_update_plugins()), which contact WordPress.org in the same way WordPress does on its own.

The rest of this section describes the Anthropic Claude API.

When is data sent?

• When you manually click the “Generate AI Report” button in the admin.
• When an automatic scheduled diagnosis detects a critical issue and notifications are enabled. In that case the AI report is generated once per critical run and attached to the notification email.

What data is sent?

• The diagnosis result text only:
  • Site URL, site name, WordPress version, theme name
  • Names and versions of plugins with available updates, Site Health issue titles (including notices from other plugins)
  • PHP version, web server name, memory limit, max upload size
  • The size of debug.log and up to 10 error lines from it, as written in the log. Error lines can contain file paths and any data that code wrote into the log, so review debug.log before generating a report if that is a concern
  • File Integrity counts, the paths of core files that differ or could not be checked, and suspicious code patterns found in those core files (function names like eval, base64_decode)
  • Paths of suspicious PHP files found in the uploads folder, and paths there that could not be read
  • Counts (plugins, Site Health results), the latest WordPress version, and the notes each check writes
  • SSL expiration date and days remaining
  • File-permission status of critical files
• Apart from what may appear in the error lines above, the plugin does not collect login data, passwords or post content.

Is the data sent unconditionally?

No. The AI feature is completely disabled unless you define NPCMI_API_KEY in wp-config.php. Without that constant, no external connection to Anthropic is ever made.

Anthropic’s terms and privacy policy:

• Consumer Terms of Service: https://www.anthropic.com/legal/consumer-terms
• Privacy Policy: https://www.anthropic.com/legal/privacy
• Commercial Terms of Service (if you use a paid API plan): https://www.anthropic.com/legal/commercial-terms

By enabling the AI report feature (i.e. by defining NPCMI_API_KEY), you agree to Anthropic’s applicable terms.