Title: CordonAI Site Health Doctor Author: CordonAI Published: July 22, 2026 Last modified: July 22, 2026 --- Search plugins ![](https://ps.w.org/cordonai-site-diagnostics/assets/banner-772x250.png?rev=3618944) ![](https://ps.w.org/cordonai-site-diagnostics/assets/icon.svg?rev=3618944) # CordonAI Site Health Doctor By [CordonAI](https://profiles.wordpress.org/cordonai/) [Download](https://downloads.wordpress.org/plugin/cordonai-site-diagnostics.1.1.2.zip) * [Details](https://wordpress.org/plugins/cordonai-site-diagnostics/#description) * [Reviews](https://wordpress.org/plugins/cordonai-site-diagnostics/#reviews) * [Installation](https://wordpress.org/plugins/cordonai-site-diagnostics/#installation) * [Development](https://wordpress.org/plugins/cordonai-site-diagnostics/#developers) [Support](https://wordpress.org/support/plugin/cordonai-site-diagnostics/) ## Description **CordonAI Site Health Doctor** finds what is wrong with your site, explains it in plain language, and hands you the fix. It is a _diagnostic_ tool: it never edits, deletes or blocks anything. It measures, explains and recommends — the decision always stays with you. Everything described below works in this version. Three things usually scattered across different tools, now in one dashboard: 1. **Performance & health diagnostics** — which plugins and hooks are slow, which SQL queries are heavy or repeated, what is happening to your database and disk, and which PHP errors keep occurring. 2. **Access-log analysis** — traffic, bots and signs of attack, read straight from your server’s own access logs inside wp-admin. Nothing is sent to any external service. 3. **Recommendations & warnings** — every finding is explained on two levels: a plain“ what it means and what to do” for everyone, and the technical detail (stack traces, SQL, commands) for developers. #### What it does, out of the box * **Health dashboard** — an overall Health Score built from four sub-scores (errors, performance, database, security), each with a transparent breakdown of every penalty, plus a live environment summary: WordPress, PHP, database, web server, HTTPS, memory and more. * **Errors & warnings** — an early error handler that starts catching PHP errors the moment WordPress loads — even while other plugins are still loading — de- duplicates them into groups, and attributes each one to the plugin, theme or core file that really caused it. Optional `debug.log` parsing. * **Performance** — always-on light sampling of page-generation time, memory and query counts, plus on-demand deep-profiling sessions that measure each active plugin, your most expensive hooks, and your slowest SQL queries (with EXPLAIN). * **Database** — per-table data and index sizes, autoload weight, overhead and bloat counters, growth tracking over time, and safe, copy-ready clean-up recipes. * **Disk & files** — a resumable scanner for large files, junk, leftover plugin and theme folders, and web-exposed backups, plus a core-file integrity check against the official WordPress.org checksums. * **Logs & traffic** — incremental parsing of Apache, Nginx and LiteSpeed access logs (including rotated and `.gz` files) into compact hourly aggregates: traffic, top URLs, bots versus humans, and status codes. * **Security** — heuristics over those same logs that surface brute-force, scanning and injection attempts as ranked events, each with the evidence behind it and safe, copy-ready hardening advice. * **Recommendations** — one prioritised to-do list distilled from every module. It also watches for change-over-time problems: an error rate or a page that suddenly runs far above your site’s own normal range, and the slowest front-end pages. * **Notifications** — opt-in alerts the moment a new fatal error happens, plus a weekly digest that shows what changed since last time. Delivered by e-mail and, if you want, to Slack, Telegram or Discord. * **Updates & vulnerabilities** — flags out-of-date core, plugins and themes, and( optionally, with your own free WPScan token) checks the installed versions against the WPScan vulnerability database so you hear about a published CVE quickly. * **Uptime & SSL** — an optional hourly check of your home page (catching front- end errors and slow responses) and a warning before your TLS certificate expires. * **Client reports** — an optional, white-label monthly HTML report (health, performance, errors, security and recommendations) e-mailed to you or your client. Download it any time. * **For developers** — WP-CLI commands (`wp site-doctor health|recommendations| scan|report`) and an optional token-gated metrics endpoint for Prometheus / Grafana. #### Built for real hosting * **Shared hosting is the baseline.** No root, no `exec()`, no special PHP extensions required. Anything that genuinely needs a VPS is clearly labelled. * **Do no harm.** A diagnostics tool must not slow your site down or bloat your database. Light always-on sampling plus deep, time-boxed profiling on demand; compact aggregates instead of raw data; automatic clean-up after a retention window you control. * **Privacy first.** There is no telemetry and no tracking, ever. By default nothing leaves your site. A few clearly-labelled features are opt-in and only contact a service after you switch them on — vulnerability lookups, chat notifications and GeoIP — each listed in the Privacy section below. An optional IP-anonymisation setting helps with GDPR. ### Privacy CordonAI Site Health Doctor stores all of its data in your own WordPress database and your own uploads directory. It does not phone home and contains no analytics or tracking. Every external connection is optional, off by default, and clearly documented: * **WordPress.org checksums** (`api.wordpress.org`) — used by the Disk module’s core-integrity check to compare your core files against the official checksums for your version. This is the same mechanism WordPress itself uses. * **MaxMind GeoLite2** (`download.maxmind.com`) — only if you enter your own free MaxMind licence key to enable offline GeoIP. The country database is downloaded to your server and lookups then happen locally, with nothing sent out. * **WPScan** (`wpscan.com`) — only if you enter your own free WPScan API token. The plugin sends the slugs and versions of your installed plugins, themes and core to look up published vulnerabilities. Without a token, no vulnerability lookup happens. * **Chat notifications** (Slack, Telegram or Discord) — only if you paste a webhook URL or bot token. The alert text you would otherwise receive by e-mail is then also posted to that service. * **Uptime check** — requests your own site’s home page on a schedule. This is your own server, not a third party. The optional **metrics endpoint** is inbound only (a monitoring system pulls from it) and is disabled until you set a token; it exposes aggregate gauges with no personal data. The Logs module can optionally **anonymise IP addresses** (zeroing the last octet of IPv4 / the last 80 bits of IPv6) before storing aggregates, to help with GDPR. This option is explained in the settings. ## Screenshots [⌊Dashboard — the overall Health Score, four sub-scores and a live environment summary( WordPress, PHP, database, web server, HTTPS, memory).⌉⌊Dashboard — the overall Health Score, four sub-scores and a live environment summary (WordPress, PHP, database, web server, HTTPS, memory).⌉[ Dashboard — the overall Health Score, four sub-scores and a live environment summary( WordPress, PHP, database, web server, HTTPS, memory). [⌊Recommendations — one prioritised to-do list across every module; each finding has a plain-language fix and a developer detail view with copy-ready commands.⌉⌊ Recommendations — one prioritised to-do list across every module; each finding has a plain-language fix and a developer detail view with copy-ready commands.⌉[ Recommendations — one prioritised to-do list across every module; each finding has a plain-language fix and a developer detail view with copy-ready commands. [⌊Errors & warnings — PHP errors grouped and de-duplicated, attributed to the plugin, theme or core that caused them, with a 30-day trend.⌉⌊Errors & warnings — PHP errors grouped and de-duplicated, attributed to the plugin, theme or core that caused them, with a 30-day trend.⌉[ Errors & warnings — PHP errors grouped and de-duplicated, attributed to the plugin, theme or core that caused them, with a 30-day trend. [⌊Performance — always-on light sampling of page-generation time, memory, queries and outbound HTTP, with a 30-day trend and the WP-Cron queue.⌉⌊Performance — always- on light sampling of page-generation time, memory, queries and outbound HTTP, with a 30-day trend and the WP-Cron queue.⌉[ Performance — always-on light sampling of page-generation time, memory, queries and outbound HTTP, with a 30-day trend and the WP-Cron queue. [⌊Deep profiling — an on-demand, time-boxed session ranking your slowest SQL queries( with a plain-language EXPLAIN), most expensive hooks, outbound HTTP calls and per- plugin cost.⌉⌊Deep profiling — an on-demand, time-boxed session ranking your slowest SQL queries (with a plain-language EXPLAIN), most expensive hooks, outbound HTTP calls and per-plugin cost.⌉[ Deep profiling — an on-demand, time-boxed session ranking your slowest SQL queries( with a plain-language EXPLAIN), most expensive hooks, outbound HTTP calls and per- plugin cost. [⌊Database — per-table data and index sizes, autoload weight and overhead, with safe copy-ready clean-up recipes.⌉⌊Database — per-table data and index sizes, autoload weight and overhead, with safe copy-ready clean-up recipes.⌉[ Database — per-table data and index sizes, autoload weight and overhead, with safe copy-ready clean-up recipes. [⌊Disk & files — a resumable large-file and junk scan, web-exposed-backup detection, and a core-file integrity check against the official WordPress.org checksums.⌉⌊Disk& files — a resumable large-file and junk scan, web-exposed-backup detection, and a core-file integrity check against the official WordPress.org checksums.⌉[ Disk & files — a resumable large-file and junk scan, web-exposed-backup detection, and a core-file integrity check against the official WordPress.org checksums. [⌊Logs & traffic — access logs parsed locally inside wp-admin: hourly volume, top URLs and IPs, bots versus humans and status codes.⌉⌊Logs & traffic — access logs parsed locally inside wp-admin: hourly volume, top URLs and IPs, bots versus humans and status codes.⌉[ Logs & traffic — access logs parsed locally inside wp-admin: hourly volume, top URLs and IPs, bots versus humans and status codes. [⌊Security — brute-force, scanning and injection attempts surfaced from those same logs as ranked events with the evidence behind each one.⌉⌊Security — brute-force, scanning and injection attempts surfaced from those same logs as ranked events with the evidence behind each one.⌉[ Security — brute-force, scanning and injection attempts surfaced from those same logs as ranked events with the evidence behind each one. [⌊Client report — an optional white-label monthly HTML report (health, performance, errors, security and recommendations) to e-mail or download.⌉⌊Client report — an optional white-label monthly HTML report (health, performance, errors, security and recommendations) to e-mail or download.⌉[ Client report — an optional white-label monthly HTML report (health, performance, errors, security and recommendations) to e-mail or download. [⌊Settings — per-module toggles, detail level, the debug.log option and data-retention/ uninstall behaviour.⌉⌊Settings — per-module toggles, detail level, the debug.log option and data-retention / uninstall behaviour.⌉[ Settings — per-module toggles, detail level, the debug.log option and data-retention/ uninstall behaviour. ## Installation 1. Upload the `cordonai-site-diagnostics` folder to `/wp-content/plugins/`, or install the plugin through **Plugins Add New**. 2. Activate it through the **Plugins** screen in WordPress. 3. Open **Site Doctor** in the admin menu. You land on the dashboard with your Health Score and environment summary, and the Recommendations page already lists the issues found on your site. 4. Visit **Site Doctor Settings** to choose which modules run, point the Logs module at your access-log file, and set how long data is kept. Minimum requirements: WordPress 6.0+, PHP 7.4+, MySQL 5.7+ / MariaDB 10.3+. ## FAQ ### Does this plugin change anything on my site? No. It is read-only by design. It will never clean your database, block an IP, or deactivate a plugin. Every finding comes with a recommendation that you choose to act on (or not). ### Will it slow my site down? The background monitor samples only a fraction of requests and is designed to stay under roughly 2% overhead. Deep profiling runs only when you start a time-boxed session, and stops automatically. ### Does it work on cheap shared hosting? Yes — that is the primary target. Everything works without root access or special PHP extensions. Anything that truly requires a VPS is labelled and provided as instructions. ### Where does the security analysis get its data? From your server’s own access logs (Apache, Nginx or LiteSpeed), parsed locally inside wp-admin. You point the plugin at your log file in the settings. Nothing is ever sent to a third party. ### Is any data sent to a third party? No telemetry, ever, and nothing by default. Every outbound connection is opt-in and stays off until you switch it on: the WordPress.org checksum API (core-integrity check, the same one WordPress itself uses), MaxMind (GeoIP database download), the WPScan API (vulnerability lookups, only with your token), and the chat services you configure for notifications (Slack, Telegram, Discord). The uptime check requests your own home page, not a third party. They are all listed in the Privacy section below. ### Do I need a MaxMind account? Only if you want country-level GeoIP in the Logs module. It is optional and free; without it, log and security analysis still work. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “CordonAI Site Health Doctor” is open source software. The following people have contributed to this plugin. Contributors * [ CordonAI ](https://profiles.wordpress.org/cordonai/) [Translate “CordonAI Site Health Doctor” into your language.](https://translate.wordpress.org/projects/wp-plugins/cordonai-site-diagnostics) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/cordonai-site-diagnostics/), check out the [SVN repository](https://plugins.svn.wordpress.org/cordonai-site-diagnostics/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/cordonai-site-diagnostics/) by [RSS](https://plugins.trac.wordpress.org/log/cordonai-site-diagnostics/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.2 * Plugin name and text domain aligned with the plugin’s directory slug. * Refreshed translations (English, German, Italian, Spanish) and minor interface polish. * Includes the full diagnostic suite introduced in 1.1.0 (see below). #### 1.1.0 * Notifications: instant alerts when a new fatal error occurs, plus optional delivery to Slack, Telegram and Discord alongside e-mail. * Weekly digest now shows what changed since the previous one (health, recommendations, errors, database, page time). * Anomaly detection: flags an error rate or a page-build time that jumps far above the site’s own recent baseline. * Updates & vulnerabilities: flags out-of-date core, plugins and themes; optional WPScan lookups (with your own token) for published CVEs in installed versions. * Uptime & SSL: optional hourly home-page health check with alerts, and a warning before the TLS certificate expires. * Client reports: optional white-label monthly HTML report e-mailed to you or your client, plus on-demand download. * Slowest-page ranking surfaces the front-end paths that take longest to build. * Developer tooling: WP-CLI commands (wp site-doctor health|recommendations|scan |report) and a token-gated Prometheus / Grafana metrics endpoint. * All new external connections are opt-in and documented in the Privacy section. #### 1.0.0 * First public release. * Health dashboard with an overall score, four sub-scores and a live environment summary. * Errors module: early error handler with de-duplication and accurate source attribution; optional debug.log parsing. * Performance module: always-on sampling plus on-demand deep profiling of plugins, hooks and SQL queries (with EXPLAIN). * Database module: table, index and autoload sizes, overhead and growth tracking, safe clean-up recipes. * Disk module: resumable file scanner, junk and web-exposed-backup detection, and core-file integrity check. * Logs & Traffic module: incremental Apache / Nginx / LiteSpeed access-log parsing into compact aggregates; optional offline GeoIP. * Security module: log-based brute-force, scanning and injection detection with evidence and copy-ready hardening advice. * Recommendations: one prioritised list across all modules, with opt-in e-mail alerts and a weekly digest. * CSV and diagnostic-snapshot export. * Read-only by design; full data clean-up on uninstall, with an optional “keep my data” choice. * Accessible, mobile-friendly interface. Translations: English, German, Italian, Spanish. ## Meta * Version **1.1.2** * Last updated **2 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.0.2** * PHP version ** 7.4 or higher ** * Tags * [database](https://wordpress.org/plugins/tags/database/)[debugging](https://wordpress.org/plugins/tags/debugging/) [performance](https://wordpress.org/plugins/tags/performance/)[security](https://wordpress.org/plugins/tags/security/) [site health](https://wordpress.org/plugins/tags/site-health/) * [Advanced View](https://wordpress.org/plugins/cordonai-site-diagnostics/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/cordonai-site-diagnostics/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/cordonai-site-diagnostics/reviews/) ## Contributors * [ CordonAI ](https://profiles.wordpress.org/cordonai/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/cordonai-site-diagnostics/)