Georgica Compliance & Accessibility Check

Description

Georgica Compliance scans your WordPress site from the inside and gives you a score from 0 to 100, split into five groups: Privacy & Cookies, Accessibility, Security, Hacked site? and Forms & e-mail. Every check shows a clear status (pass, warning, fail), a plain-language explanation and a “How to fix” hint with a link to the right WordPress screen.

All features are free. There are no locked features, no trial periods, no ads in the dashboard and no tracking.

Privacy & Cookies

• Privacy policy page is selected, published and not just the empty template.
• Privacy policy is linked from the home page.
• Tracking scripts found in your home page source: Google Analytics / Google tag (gtag.js), Google Tag Manager, Meta (Facebook) Pixel, Hotjar, Microsoft Clarity, TikTok Pixel, LinkedIn Insight Tag.
• Cookie consent tools: CookieYes, Complianz, Cookiebot, Borlabs Cookie, CookieAdmin, Real Cookie Banner, GDPR Cookie Compliance, Cookie Notice, iubenda, Termly, WP Consent API (as active plugins), plus common consent platforms recognised in the page source.
• Google Consent Mode v2: default consent command with the v2 signals (ad_user_data, ad_personalization).
• Contact forms (Contact Form 7, WPForms, Gravity Forms, Fluent Forms): does each form contain a consent checkbox or privacy wording?
• WooCommerce shops: terms and conditions page, returns / right of withdrawal page, company details (hints).

Accessibility (European Accessibility Act / WCAG 2.1 AA basics)

• Page language declared (<html lang>).
• Zoom not blocked by the viewport meta tag.
• Media library images without alternative text (count, list and direct edit links).
• Home page images without an alt attribute.
• Home page links and buttons without an accessible name (e.g. icon-only links).
• Menu items without a label (classic menus and block navigation).
• Heading structure in recent posts and pages (skipped levels, multiple H1).

Security

• WordPress core, plugin and theme updates (based on the data WordPress itself already collected).
• HTTPS and SSL certificate validity / days until expiry.
• Security headers (HSTS, X-Content-Type-Options, X-Frame-Options or CSP frame-ancestors, Referrer-Policy).
• Publicly readable readme.html / license.txt, debug.log and wp-config.php backups.
• A user with the login “admin”.
• XML-RPC fully enabled.

Hacked site? (spam and malware signs)

Nothing is ever changed or deleted. Every finding is listed with an edit link, and you can ask for help with one click.

• Spam words and links injected into published content: posts, pages, WooCommerce products, block templates, menus, categories/tags, text/HTML/block widgets, site title and tagline. Examples: casino/betting, 1win/1xbet/mostbet, slot spam, viagra/cialis/levitra, online pharmacy, payday loans, adult content, crypto scams.
• Links to other domains hidden with inline styles (display:none, font-size:0, off-screen positioning), in content and on the rendered home page.
• Obfuscated JavaScript (eval, atob, fromCharCode) and scripts or iframes from unknown domains inside content.
• Autoloaded settings containing script tags or obfuscation functions.
• Administrator accounts created in the last 30 days or with names attackers often use (list only).
• Executable PHP files in wp-content/uploads.
• On click only: verify WordPress core files against the official WordPress.org checksums. Modified, missing and unknown PHP files in wp-admin, wp-includes and the root folder are listed.
• On click only: ask WordPress.org whether installed plugins were closed (for example for a security issue), and whether plugins or themes have not been updated for more than two years.

Required pages: draft generator (Romanian and English)

Creates draft pages that you review, complete and publish yourself. Fields to complete are marked [FILL IN …] / [COMPLETAȚI …]. The templates never claim that the site is compliant.

• Accessibility statement. Structure based on the European Accessibility Act (Directive (EU) 2019/882, Annex V) and WCAG 2.1 AA:
  • compliance status, to be chosen after an evaluation;
  • non-accessible content, pre-filled with the issues found by the scan;
  • evaluation method and dates;
  • feedback contact;
  • complaints procedure.
• Cookie policy, filled with the tracking scripts detected on your home page and their typical cookies.
• Privacy policy template (GDPR structure).
• Shop terms and conditions with a company details block. The Romanian version includes:
  • the 14-day right of withdrawal (OUG 34/2014);
  • the legal guarantee of conformity (OUG 140/2021);
  • the ANPC alternative dispute resolution (SAL) links;
  • a note that the EU ODR platform was discontinued on 20 July 2025.

The templates are not legal advice and must be checked before publishing.

Form watchdog (optional, off by default)

• Once a day, sends a test message marked “[Georgica Compliance test]” through the site’s own wp_mail() to the administration e-mail (or the recipient you set).
• After two failures in a row, shows a warning on the dashboard.
• Checks the configuration of Contact Form 7, WPForms, Gravity Forms and Fluent Forms: recipient set, form placed on a published page. It never submits real forms.

One-click fixes (all off by default, all reversible)

• Disable XML-RPC (via WordPress filters).
• Send basic security headers (via the send_headers action; headers your server already sends are not duplicated). HSTS is a separate switch with a clear warning.
• Hide readme.html and license.txt by renaming them (no server rewrite rules). They are renamed back when you switch the option off or deactivate the plugin.

Weekly scan and optional e-mail

The scan can run automatically once a week with WP-Cron. An e-mail summary is available but off by default; when enabled it is sent with your site’s own wp_mail() to the address you choose.

Honest limits

This tool helps identify common issues; it is not legal advice and does not guarantee compliance. Automated checks cannot judge whether alternative text is meaningful, whether a consent banner really blocks scripts before consent, or whether your legal texts are correct. Accessibility checks cover the home page and the WordPress content database, not every page of the site.

Request a fix (optional, only when you click)

Next to the overall score there is a “Request a fix” button, and every failed or warning check has a small “I want you to help me with this” link. They let you order a fix from INFINITY DIGITAL SOLUTIONS SRL, the authors of this plugin. Clicking first shows a confirmation that lists exactly which technical details the link contains. Only when you click “Continue” does the order page open in a new browser tab. You type your name and e-mail yourself on that page; nothing is sent automatically. See “External services” below.

Optional paid service

The plugin shows one small, dismissible box mentioning Georgica Compliance, a separate paid service by the same authors (continuous external monitoring, monthly PDF reports, a full accessibility crawl, alerts and a multi-site dashboard for agencies). It is a plain link to the authors’ website (https://georgica.ro/en/website-monitoring, or https://georgica.ro/monitorizare-site in Romanian); nothing is loaded from or sent to that website, and the plugin is fully functional without it.

External services and network requests

This plugin makes no automatic requests to external services. Nothing below runs from WP-Cron, on activation or on page load, and the plugin contains no API keys. The server never contacts our servers, WordPress.org, Google or any third party. The plugin loads no remote scripts, fonts or images and collects no usage data.

The only network connections it opens are loopback requests to your own site, all addressed to the host of your Site Address / WordPress Address:

• GET of your home page, to inspect the HTML and response headers as an anonymous visitor sees them.
• GET of a few fixed paths on your own site (readme.html, license.txt, wp-content/debug.log and common wp-config.php backup names) to see whether they are publicly readable.
• One POST of system.listMethods to your own xmlrpc.php, to see whether XML-RPC is enabled.
• A TLS connection to your own domain on its HTTPS port, only to read the expiry date of your SSL certificate.

If your domain is served through a CDN or reverse proxy, these requests travel through it exactly like a normal visitor’s request. Update information is read from data WordPress itself has already stored; the plugin never triggers an update check.

The optional weekly e-mail (off by default) is sent through your own site’s mail function to the recipient you configure.

WordPress.org (only when you click a button)

Two checks in the “Hacked site?” group contact WordPress.org (api.wordpress.org), the official, free WordPress service. They run only when an administrator clicks the button. The request is sent by your server with the user agent Georgica Compliance/<version>, without your site address.

• “Verify WordPress files” calls https://api.wordpress.org/core/checksums/1.0/.
  • Sent: your WordPress version and locale (e.g. 7.1.3, en_US).
  • Received: the official MD5 checksums of the core files, which are compared locally.
• “Check plugins on WordPress.org” calls https://api.wordpress.org/plugins/info/1.2/ and https://api.wordpress.org/themes/info/1.2/.
  • Sent: the slug (folder name) of each installed plugin and theme, one request each.
  • Received: whether each one is listed, closed (with date and reason) or when it was last updated.
• No personal data and no site address is sent.
• WordPress.org privacy policy: https://wordpress.org/about/privacy/

Not integrated: third-party vulnerability databases, Google Safe Browsing and VirusTotal. They require each site to register its own API key and accept the provider’s terms, and some feeds are too large for ordinary hosting.

Form watchdog e-mail

When you enable it (off by default), the plugin sends one test e-mail a day through your own site’s wp_mail() to your administration address. No form is submitted, and nothing is sent to us or to any other third party by the plugin.

“Request a fix” link (external service, only on explicit click)

The “Request a fix” button and the “I want you to help me with this” links open an external website: the order page of INFINITY DIGITAL SOLUTIONS SRL, the provider of the fix service. This happens only when you click, then confirm with “Continue”, and the page opens in a new tab of your browser. Your server does not send anything. Before you continue, the confirmation shows the full link.

• Destination: https://georgica.ro/contact (Romanian admin language) or https://georgica.ro/en/contact (other languages). Site owners can change it with the SITE_CONFORM_FIX_URL_RO / SITE_CONFORM_FIX_URL_EN constants or the site_conform_fix_request_url filter, and can hide the button and links completely with add_filter( 'site_conform_show_fix_requests', '__return_false' );.
• Data in the link (technical only):
  • the site address (home_url);
  • the overall score;
  • the identifiers of the failed and warning checks (for example trackers_consent,security_headers);
  • the plugin version;
  • your admin language.
• Data not in the link: no name, no e-mail address and no other personal data. You enter your contact details yourself on the order page.
• Terms and conditions: https://georgica.ro/termeni-si-conditii
• Privacy policy: https://georgica.ro/gdpr