EffortLess Website Health Check

Changelog

1.0.36

• Fix: the bundled French, German, Spanish, Brazilian Portuguese, Korean, Japanese and Traditional Chinese translations are loaded again (the text domain was no longer loaded since 1.0.33) and ship in the plugin package. The Domain Path header is restored.

1.0.35

• Changed: translation source files were kept out of the plugin package (reverted in 1.0.36).

1.0.34

• Changed: variables in the admin view templates now carry the plugin prefix.

1.0.33

• Security: the quote request endpoint now requires an access token that is issued only in the response to the audit it belongs to. Previously any valid REST nonce plus a numeric audit ID could add a note to, or change the lead status of, any stored audit.
• Changed: the readme short description is shortened to 150 characters or fewer.
• Changed: translation files are no longer bundled and the plugin no longer calls load_plugin_textdomain(); translations are delivered through translate.wordpress.org language packs. The Domain Path header is removed.

1.0.32

• New: GBP, CHF, CAD, AUD, BRL, MXN, JPY, KRW and CNY added to the Currency setting (EUR, USD and TWD are unchanged). Existing audits keep the currency they were created with.

1.0.31

• Changed: shortened the plugin description and reworded one FAQ answer to describe the audit requests factually.
• New: Spanish (es_ES), German (de_DE), Brazilian Portuguese (pt_BR), Korean (ko_KR) and Japanese (ja) translations.
• i18n: regenerated the .pot template and the French and Traditional Chinese translations; strings for findings removed in 1.0.28 and the old offer names are no longer included.

1.0.30

• Changed: the offer shown with the visitor’s estimate now uses the same names as the price ranges in Settings → Pricing (“Monthly maintenance” instead of “Preventive maintenance”, “Standard optimization” instead of “Light optimization”).

1.0.29

• Removed: the “Small fix” price range from Settings → Pricing. It was saved but never used by the estimate.
• Changed: scores below 40 now show the “Complete repair” offer, matching the price range they were already quoted with (previously labelled “Priority manual audit” while using the Complete repair prices).

1.0.28

• Changed: the audit no longer requests /xmlrpc.php, /wp-json/wp/v2/users, /.git/HEAD or /readme.html on the submitted site. It now only reads the home page, robots.txt, sitemaps and the TLS certificate. The corresponding four findings were removed.
• Removed: the unused public REST route GET /elwhc/v1/audit/{id}, which returned any stored audit’s result by its numeric ID.
• Fix: the bundled French and Traditional Chinese translations are loaded again (they were not loaded since 1.0.22).
• Fix: the donate notice now appears on the Settings screens in every admin language, not only English.
• Changed: the quote confirmation page now uses the standard WordPress message page instead of its own inline stylesheet, and the printable report window is built without inline script or style tags.
• Changed: database queries now pass table and column names through prepared-statement identifier placeholders. Requires WordPress 6.2 or later.
• Removed: the filter that forced the plugin’s name to stay in English in the Plugins list.
• Readme: documented every setting, the requests the audit sends, and known limitations.

1.0.27

• Fix: the audit form and result boxes had no explicit text color of their own, so they silently inherited the active theme’s body text color — on a theme with light/white body text, they could render nearly invisible against their fixed light backgrounds. The plugin’s whole front-end output now sets its own explicit text color instead of relying on the theme.

1.0.26

• Security: the “receive my quote by email” checkbox no longer emails the audit report straight to whatever address is typed in. It now sends a confirmation link first, and only sends the actual quote once that link is clicked — closing a gap where the public form could otherwise be used to email an arbitrary third party’s inbox.
• Fix: closed a race condition in the per-IP/per-domain daily audit limits where several concurrent requests could all slip past the count check before any of them was recorded; added a short atomic burst guard.
• Fix: the score review’s clearer “highlights” layout (introduced in 1.0.25) is now also used on the printable PDF report and the admin audit detail page, instead of only the interactive on-page result — both previously still showed the old “Score: X/100 — Label —” flat sentence.
• Fix: uninstalling with “delete all plugin data” enabled now also removes two secret options that were left behind (elwhc_ip_hash_secret, elwhc_quote_token_secret).
• i18n: regenerated the .pot and updated the French and Traditional Chinese translations to cover strings added in 1.0.24/1.0.25 (consent checkbox, Settings → Legal/GDPR, quote emails).

1.0.25

• Improved: the on-page audit result now shows a clearer, more visual “score review” — a plain-language condition sentence, the top priority findings as severity-colored chips, and the indicative estimate in a prominent highlight box, instead of one long summary sentence.
• New: the “Contact on LINE” / “Request a quote” / “Download PDF report” buttons now also appear right after the score review, in addition to the end of the results, so visitors do not have to scroll to act on their result.

1.0.24

• New: an optional “receive my quote by email and accept the Terms of Use / Privacy Policy (GDPR)” consent checkbox on the public form. When checked, the submit button label changes to “Analyze my site and receive the quote”, the consent is stored with the lead, and the visitor is emailed their score, priority findings and price estimate immediately after the audit.
• New: Settings → Legal / GDPR section to configure the Terms of Use and Privacy Policy URLs linked from that checkbox.

1.0.23

• Fix: trimmed the readme’s Tags line from 6 to 5 (removed “leads”), per WordPress.org’s tag limit.
• Update: Tested up to WordPress 7.1.

1.0.22

• Fix: removed the Author URI header (pointed at a promotional domain, not permitted for submission), and added the required Donate link plus a dismissible donate notice on the Settings and Network Settings screens.
• Fix: removed the discouraged load_plugin_textdomain() call — WordPress.org auto-loads translations for hosted plugins.
• Fix: the plugin’s name in the Plugins list is now forced to stay in English, so a GlotPress community translation of the “Plugin Name” header can no longer rename the brand on non-English sites.
• Security: the visitor IP hash no longer derives its HMAC key from wp_salt() — it now uses a standalone, plugin-generated secret stored per site, independent of WordPress’s own auth material.
• Bumped “Tested up to” to 7.0.

1.0.21

• Fix: “HTTPS not detected” could be wrongly reported for a site that is fully HTTPS but was audited via an http:// URL that correctly redirects to HTTPS (e.g. via .htaccess). The audit now probes https:// directly in that case instead of assuming HTTPS is broken just because the request started on http, and the TLS-certificate check now runs whenever HTTPS is confirmed working rather than only when the original request used https.
• New: when HTTPS genuinely fails (invalid/incomplete certificate chain, a firewall blocking the request, etc.) with Debug mode enabled, the real underlying error is now recorded under Tools and Logs instead of only the generic finding text.

1.0.20

• New: “Download PDF report” on the public result and the admin audit detail page. Opens a branded, print-ready report (via the browser’s native print-to-PDF, no external library or dependency) with the full score, category breakdown, PageSpeed and every finding — not just the on-screen top 8. The admin version also hides the WP admin chrome and interactive-only sections when printing.
• Fix: the “Core Web Vitals” table label was hardcoded in English; it is now translated (fr_FR/zh_TW added).

1.0.19

• Security: the TLS-certificate-expiry check (introduced in 1.0.16) opened a raw socket directly to the audited domain without the SSRF protection used everywhere else in the plugin. It now resolves and validates the domain to a public IP first and connects to that literal IP (with SNI still set to the hostname), closing a DNS-rebinding gap.
• Fix: six new WordPress-hygiene findings (exposed .git, user enumeration, XML-RPC, readme.html, etc.) were tagged with the category ‘WordPress’ instead of the lowercase ‘wordpress’ id used everywhere else, which would have silently split them out of any future per-category filtering or reporting.

1.0.18

• Multisite: when global (network-wide) mode is on, each site can now optionally keep its own currency and prices while all other settings stay global — useful for a network of sites targeting different countries. Set it under a site’s Website Health Check → Settings.

1.0.17

• PageSpeed Insights now reports both mobile and desktop, shown side by side (result, admin detail and quote email). The mobile score continues to drive the performance rating (Google is mobile-first).

1.0.16

• New: Google PageSpeed Insights integration (opt-in, needs an API key). Real mobile Lighthouse scores (performance, SEO, accessibility, best practices) and Core Web Vitals are shown in the result, admin detail and quote email, and drive the performance score.
• New checks: TLS certificate expiry, mixed content, exposed .git/readme.html, XML-RPC enabled, REST user enumeration, page-title length, missing H1, and Open Graph/Schema.org/analytics detection.

1.0.15

• Fix: rate-limit, retention and “this week” windows now use the site timezone (they previously used UTC while rows are stored in local time), so the per-IP/per-domain daily limits and data retention are accurate on non-UTC sites.
• Fix/security: the URL validator now resolves IPv6 (AAAA) records and blocks private/reserved IPv6 ranges (including unique-local fc00::/7). IPv6-only sites can now be audited, and an AAAA record pointing at an internal address can no longer bypass the SSRF check.

1.0.14

• The quote-request notification email now contains the full report (overall score, summary, every category score, all findings with recommendations and the estimate) in addition to the visitor’s message, instead of only the score.

1.0.13

• Security: added a honeypot field to the audit form and quote popup to silently reject automated bot submissions (no third-party service, no CAPTCHA for real visitors).

1.0.12

• Security hardening: block SSRF via redirects and DNS rebinding by re-validating every request and redirect hop (reject_unsafe_urls) and capping the download size at the transport level; reject URLs containing embedded credentials; rate-limit quote requests and cap the message length; and neutralize spreadsheet formula injection in the CSV export.

1.0.11

• Fix: the “Request a full quote” button now follows the site language. Its label is a stored setting whose English default did not translate; it now falls back to the translated default when left at the default or empty. You can still enter a custom label per site.

1.0.10

• New: translations. The plugin now ships with French (fr_FR) and Traditional Chinese / Taiwan (zh_TW) alongside English, covering both the admin and the public form/result/quote popup. A .pot template is included.

1.0.9

• Fix: HTTPS is no longer reported as missing when a site returns a non-200 status (e.g. a 403/503 from a security filter or CDN) — any response over HTTPS now counts as HTTPS working.
• Fix: when a site returns a block/challenge page instead of its real content, the content-based checks (WordPress, SEO, contact) are marked “Not assessed” and excluded from the score instead of reporting false errors, with one clear note explaining why.
• Clearer results: findings now show a severity label (Important / To improve / For info) with the issue and recommendation, category rows show “Not assessed” where applicable, and a positive message appears when nothing needs attention.

1.0.8

• New: “Request a quote” now opens a popup form pre-filled with the visitor’s email, website URL and an editable message (built from their audit result). Submitting it records the request on the lead (status “Quote requested”) and emails the site’s contact address. Added a REST endpoint /elwhc/v1/quote for this.

1.0.7

• Fix: the public form now receives its configuration (REST endpoint, nonce, translations) via a data attribute on the form instead of wp_localize_script, which some themes/caches/multisite setups did not print — this was the underlying cause of submissions reloading the page with no result.
• New: full multisite support. Tables are created for every site on network activation and for any new site; uninstall cleans up each site.
• New: optional global (network-wide) settings. A network admin can enable global mode under Network Admin → Settings → Website Health Check to apply one shared configuration to all sites.

1.0.6

• Fix: on block themes (e.g. Twenty Twenty-Five / Full Site Editing) the form script was not being enqueued because the shortcode was not detected on the main post, so submissions only reloaded the page. The script and its data now load on all singular views and no-op when no form is present.

1.0.5

• Fix: the public form script now loads in the page header and initializes on DOMContentLoaded, so it works even on themes/page builders that do not output wp_footer() where expected. This resolves cases where submitting the form simply reloaded the page instead of running the audit.

1.0.4

• Email is now required on the public form; the name and LINE ID fields have been removed for now.
• Fix: added a language-agnostic REST fallback endpoint so submissions work on multilingual sites (e.g. WPML/Polylang) where the default REST URL can 404. The form now retries the fallback automatically and logs diagnostics to the browser console.

1.0.3

• Fix: the public form script now loads reliably by detecting the shortcode in the page content up front, so submissions are handled by JavaScript instead of falling back to a full-page reload. Hardened the form to POST to itself so visitor details are never exposed in the URL if scripts are unavailable.

1.0.2

• Set plugin author to domclic.

1.0.1

• Audit now falls back to plain HTTP when HTTPS does not respond, so HTTP-only or misconfigured sites can still be analyzed (they score 0 on the HTTPS category rather than failing outright).

1.0.0

• Initial release: public audit shortcode, REST API, non-intrusive scoring across six categories, indicative quote estimate, lead capture, admin dashboard/list/detail, settings, logs, CSV export, rate limiting, SSRF protection, retention cleanup and clean uninstall.