WebDiagnosis Site Audit

Find what’s actually wrong with your WordPress site, and know exactly what to fix.

WebDiagnosis Site Audit is the WordPress audit that tells you what to fix, not just another score or generic list of recommendations.

Run 170+ automated checks across 14 critical areas including SEO, security, performance, accessibility, WordPress configuration, eco-design, and more.

Every finding tells you what was detected, why it matters, how urgent it is, and how to fix it.

Stop auditing. Start fixing.

Most audit tools give you a score and leave you to figure out what it means.

WebDiagnosis turns 170+ checks into a clear, prioritized action plan.

• 170+ checks across 14 themes
• Clear severity: Blocker, Major, Minor
• No false alarms: unverified checks are reported as “Not verifiable”
• Actionable findings: every issue includes its impact and recommended fix
• Practical guidance: know what needs to change, who can do it, and how difficult it is

Built to be trusted

A score can tell you that something is wrong. A diagnosis tells you what to do next.

WebDiagnosis never guesses when the required data cannot be verified, and never turns a minor recommendation into an emergency.

The result: less time interpreting reports, more time fixing what actually matters.

One plugin. A complete website diagnosis.

Audit the dimensions that matter to modern WordPress websites:

• SEO & technical SEO
• Security
• Performance & Core Web Vitals
• Accessibility
• WordPress configuration
• Eco-design & sustainability
• And more

Automatic monitoring after each update

Once you enable it, WebDiagnosis checks your site automatically after each update of WordPress, your theme or a plugin, whether you make it yourself, through automatic updates or with a maintenance tool. It can also check your site every week or every month, even when nothing changes on it.

• One check per series of updates, a few minutes after the last one
• Only when something really changed: a failed update that was rolled back triggers nothing
• A notice tells you what was found after each check, and what changed on the site
• Disabled by default, with its own consent, in Settings > Automatic monitoring

Know what matters. Fix what matters.

Other audit tools tell you how your website scores.
WebDiagnosis tells you what’s wrong and what to fix first.

External Services

This plugin connects to an external service to perform website diagnostics.

The plugin sends technical data about the site, never its posts, pages, comments or user
accounts. This data is sent only once you have accepted data sharing, and you can withdraw that
consent at any time from the plugin settings. Every request the plugin makes is listed below,
including the few it makes on its own.

Service name: WebDiagnosis
Service URL: https://webdiagnosis.io/en/

What the service is used for:
The service analyzes the WordPress website configuration and provides a diagnostic report with recommendations about performance, security and best practices.

What data is sent when a diagnostic runs:

• Site URL, WordPress version, language and main WordPress settings (debug mode, permalinks, file editing, automatic updates, XML-RPC)
• Server details: PHP and MySQL versions, PHP limits, disk space, database size, caching, cron and file permissions
• Installed plugins and themes, with their versions and update status
• Security settings: whether the security keys WordPress uses are valid and whether they come from the site’s code or from the database (never the keys themselves), whether an account named “admin” exists and its role (never its password or email address)
• The latest entries of the PHP error log: error type, message, line, and file path relative to the site root
• Names, sizes and paths of sensitive files found under the site root (backups, database dumps, private keys). Their content is never read nor sent
• Findings of a scan of the active theme’s code: file path, line and a short code excerpt for each finding
• Content statistics: number of images with or without alternative text, menu locations, presence of the default sample content
• Database statistics: total size of the options loaded on every page, with the names and sizes of the ten largest (never their values), and the number of revisions, automatic drafts, items in the trash and spam comments (never their content)
• Your answer, once given, to the question whether your site is aimed at visitors in the European Union, the European Economic Area or the United Kingdom (yes, no or “I don’t know”). The service uses it to decide whether the GDPR and ePrivacy consent checks apply to your site
• How the diagnostic was started: from the plugin interface, the WP-CLI command, the REST endpoints, the Abilities API or the automatic monitoring. The service uses it only for its usage statistics
• A random number generated for each diagnostic and kept on the site for one hour. During the diagnostic, the service calls the site back once, at /wp-json/webdiagnosis/v1/ownership, to check that the request really came from this site before running its security checks (login page, sensitive files). The site answers with a fingerprint of the service’s challenge, never with the number itself

When data is sent:

• When a diagnostic is explicitly requested: from the plugin interface, from the WP-CLI command, or through the plugin’s authenticated REST endpoints or the WordPress Abilities API.
• When automatic monitoring is enabled, and only then: it is disabled by default and needs its own consent, given in Settings > Automatic monitoring. In the cases you tick, a diagnostic runs and sends the same data as a diagnostic you request yourself: a few minutes after WordPress, the theme or a plugin is updated, a plugin is activated or the theme is changed, once for a whole series of updates and only if the installed versions really changed since the last diagnostic. And regularly, every week or every month, once that long has passed since the last diagnostic.
• When a fatal PHP error occurs on the site, and only if data sharing is accepted: the error type and message, its file path relative to the site root, its line, the page URL, the time, and the PHP and WordPress versions, so that the site owner can be alerted. Errors that could not be sent at once are retried every hour.
• Once a day, and only if you have linked the plugin to a WebDiagnosis account with its key: the site URL and that key, to keep the account status shown in the plugin up to date.
• When you request help from an expert or send feedback from the plugin: your name, your email address and your message, so that the WebDiagnosis team can answer you.
• When you accept data sharing, deactivate, reactivate or delete the plugin, and only if data sharing is accepted: the site URL, the plugin version and the event, so that the service knows whether the plugin is still in use.

Links to the service:
* Privacy policy: https://webdiagnosis.io/en/privacy-policy/
* Terms of service: https://webdiagnosis.io/en/terms-of-service/