Title: EffortLess Website Health Check Author: domclic Published: October 10, 2026 Last modified: October 12, 2026 --- Search plugins ![](https://ps.w.org/effortless-website-health-check/assets/banner-772x250.jpg?rev =3738142) ![](https://ps.w.org/effortless-website-health-check/assets/icon-256x256.jpg?rev =3738142) # EffortLess Website Health Check By [domclic](https://profiles.wordpress.org/domclic/) [Download](https://downloads.wordpress.org/plugin/effortless-website-health-check.1.0.38.zip) * [Details](https://wordpress.org/plugins/effortless-website-health-check/#description) * [Reviews](https://wordpress.org/plugins/effortless-website-health-check/#reviews) * [Installation](https://wordpress.org/plugins/effortless-website-health-check/#installation) * [Development](https://wordpress.org/plugins/effortless-website-health-check/#developers) [Support](https://wordpress.org/support/plugin/effortless-website-health-check/) ## Description EffortLess Website Health Check adds a shortcode, `[elwhc_health_check]`, that displays a form. A visitor enters a website URL and an email address, confirms they own the site or are authorized to request the audit, and submits. The plugin then fetches the public home page of that site with the WordPress HTTP API and returns: * An overall score out of 100. * Six category scores: HTTPS, security headers, WordPress hygiene, performance, technical SEO, and contact/conversion. * A list of findings, each with a severity (Important / To improve / For info) and a recommendation. * An indicative price range, chosen from the price ranges you configure according to the score. * Buttons to contact you on LINE (if a LINE URL is set), request a quote, and print or save the report as a PDF via the browser’s print dialog. Every submission is stored in the admin under **Website Health Check Audits**, with a dashboard, filters (score, lead status, search), a detail page, lead statuses, internal notes, copyable follow-up messages and a CSV export. #### What the audit checks The audit only reads publicly available responses. Per audit it sends a small number of requests to the submitted site: the home page (HTTPS, falling back to HTTP), the `http://` variant to check for an HTTPS redirect, `robots.txt`, `sitemap.xml`/` wp-sitemap.xml`, and one TLS connection to read the certificate’s expiry date. Everything else is derived from the response headers and the HTML of the home page: security headers, compression, caching headers, page size, number of scripts and stylesheets, mixed content, title and meta description length, H1, Open Graph, Schema.org, analytics, favicon, WordPress detection and an exposed WordPress version. It does not log in, submit forms, test for vulnerabilities, or crawl other pages. #### Settings All settings are under **Website Health Check Settings**. Public form * **Enable public form** (on by default) — when off, the shortcode shows “temporarily unavailable” and the REST endpoint rejects submissions. * **Audits per IP / day** (default 10, 0 = no limit) — maximum audits one visitor IP address can run per day. * **Audits per domain / day** (default 5, 0 = no limit) — maximum audits for the same domain per day. * Independently of these settings, one IP address can run at most 5 audits per minute. * **HTTP timeout (seconds)** (3-30, default 12) — timeout for each request sent to the audited site. Pricing * **Currency** — EUR (default), USD, GBP, CHF, CAD, AUD, BRL, MXN, JPY, KRW, CNY or TWD. The symbol is shown before each amount; the price ranges below are plain numbers you set yourself, so enter them in the chosen currency. * **Price ranges** (min/max for Standard optimization, Complete repair, Monthly maintenance). The estimate shown to the visitor is picked by score: 80-100 uses Monthly maintenance, 60-79 uses Standard optimization, 0-59 uses Complete repair. Contact * **LINE contact URL** — when set, a “Contact me on LINE” button appears on the result. Leave empty to hide it. * **Contact email** (default: the site admin email) — receives quote requests submitted from the result popup. * **CTA text** — label of the “Request a full quote” button. Leave empty to use the translated default. Legal / GDPR * **Terms of Use URL** and **Privacy Policy URL** — linked from the optional “receive my quote by email” consent checkbox. Leave empty to show the label as plain text. Data & advanced * **Data retention (days)** (default 0 = keep forever) — audits older than this are deleted by a daily scheduled task. * **PageSpeed Insights** (off by default) and **API key** — when both are set, Google PageSpeed Insights mobile and desktop scores are added to the result and drive the performance score. See External services. * **Debug mode** (off by default) — writes extra diagnostic entries to **Website Health Check Tools & Logs**. * **On uninstall** (off by default) — when checked, deleting the plugin removes its tables, settings and secrets. #### Multisite Each site keeps its own audits and settings. A network administrator can turn on global mode under **Network Admin Settings Website Health Check** to apply one shared set of settings to every site. In global mode, a site can still use its own currency and prices from its own Settings page. #### Notes and limitations * The score is a quick, automated reading of a site’s public home page, not a full audit. Sites that return a block or challenge page (bot filters, CDNs) get their content-based checks marked “Not assessed”. * Private, local and reserved IP addresses (IPv4 and IPv6) are refused, including after redirects, and URLs containing credentials are rejected. * Visitor IP addresses are never stored as-is; only a keyed hash is kept for rate limiting. * When a visitor ticks “receive my quote by email”, the plugin first sends a confirmation link to that address and only emails the quote after the link is clicked. Email delivery uses `wp_mail()`, so it depends on your site’s mail setup. * The form uses the REST API (`/wp-json/elwhc/v1/audit`, with a `?rest_route=` fallback). If a security plugin blocks the REST API for anonymous visitors, submissions fail. * Page caching: the form includes a REST nonce. If a cached page is served for longer than the nonce lifetime (24 hours by default), submissions fail with “ Security check failed” until the cache is cleared. Exclude the page containing the shortcode from your page cache if this happens. #### Languages Includes French (fr_FR), German (de_DE), Spanish (es_ES), Brazilian Portuguese ( pt_BR), Korean (ko_KR), Japanese (ja) and Traditional Chinese (zh_TW) translations in the `languages` folder, plus a `.pot` template. A translation approved on translate. wordpress.org takes priority over the bundled file for that language. ### External services This plugin can optionally connect to one third-party service: * **Google PageSpeed Insights API** — Only used when you enable it and provide an API key in the settings (off by default). When enabled, the URL submitted by the visitor is sent to Google’s PageSpeed Insights API to retrieve performance data for each audit. No visitor personal data (email, IP address) is sent. Terms: https://developers.google.com/terms — Privacy policy: https://policies.google. com/privacy In addition, the plugin sends HTTP requests to the website URL a visitor submits( the site being audited) to read its public responses, as described under “What the audit checks”. ## Installation 1. In the admin, go to **Plugins Add New Plugin**, search for “EffortLess Website Health Check”, click **Install Now**, then **Activate**. (Or upload the zip under** Plugins Add New Plugin Upload Plugin**.) The plugin’s database tables are created on activation; on multisite, network activation creates them for every site, including sites added later. 2. Go to **Website Health Check Settings**. Set the **Currency** and **Price ranges**, check the **Contact email**, and optionally add a **LINE contact URL**, **Terms of Use URL** and **Privacy Policy URL**. Click **Save Changes**. 3. Create or edit a page, add the shortcode `[elwhc_health_check]` (Shortcode block in the block editor), and publish it. 4. Visit the page, enter a URL and an email, tick the authorization checkbox and click the submit button. The result appears on the page, and the submission is listed under **Website Health Check Audits**. ## FAQ ### I added the shortcode but nothing happens when I submit the form Check the following: * **Enable public form** is checked under Website Health Check Settings. * The visitor has not hit the **Audits per IP / day** or **Audits per domain / day** limit (the form shows a message when a limit is reached). * The REST API is reachable by logged-out visitors — some security plugins disable it. * The page is not served from a cache older than 24 hours (see Notes and limitations). * The submitted URL points to a public website; local or private addresses are refused. With **Debug mode** on, errors are written to Website Health Check Tools & Logs. ### Does the audit put load on the analyzed site? Each audit sends a handful of requests (listed under “What the audit checks”), and per-IP and per-domain daily limits apply. ### Do I need a PageSpeed API key? No. The audit works without any external API. A Google PageSpeed Insights API key is only needed if you enable the optional PageSpeed integration. ### Where are the leads stored? In two custom database tables (`{prefix}elwhc_audits` and `{prefix}elwhc_logs`) on each site. They can be exported to CSV under Website Health Check Tools & Logs. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “EffortLess Website Health Check” is open source software. The following people have contributed to this plugin. Contributors * [ domclic ](https://profiles.wordpress.org/domclic/) [Translate “EffortLess Website Health Check” into your language.](https://translate.wordpress.org/projects/wp-plugins/effortless-website-health-check) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/effortless-website-health-check/), check out the [SVN repository](https://plugins.svn.wordpress.org/effortless-website-health-check/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/effortless-website-health-check/) by [RSS](https://plugins.trac.wordpress.org/log/effortless-website-health-check/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.38 * Removed the manual load_plugin_textdomain() call; translations are loaded by WordPress. #### 1.0.37 * Completed the bundled translation files: a template (.pot) and translations for Spanish, Traditional Chinese, Korean, French, Japanese, German, Italian and Brazilian Portuguese. #### 1.0.36 * Fix: the bundled French, German, Spanish, Brazilian Portuguese, Korean, Japanese and Traditional Chinese translations are loaded again (the text domain was no longer loaded since 1.0.33) and ship in the plugin package. The `Domain Path` header is restored. #### 1.0.35 * Changed: translation source files were kept out of the plugin package (reverted in 1.0.36). #### 1.0.34 * Changed: variables in the admin view templates now carry the plugin prefix. #### 1.0.33 * Security: the quote request endpoint now requires an access token that is issued only in the response to the audit it belongs to. Previously any valid REST nonce plus a numeric audit ID could add a note to, or change the lead status of, any stored audit. * Changed: the readme short description is shortened to 150 characters or fewer. * Changed: translation files are no longer bundled and the plugin no longer calls` load_plugin_textdomain()`; translations are delivered through translate.wordpress. org language packs. The `Domain Path` header is removed. #### 1.0.32 * New: GBP, CHF, CAD, AUD, BRL, MXN, JPY, KRW and CNY added to the Currency setting( EUR, USD and TWD are unchanged). Existing audits keep the currency they were created with. #### 1.0.31 * Changed: shortened the plugin description and reworded one FAQ answer to describe the audit requests factually. * New: Spanish (es_ES), German (de_DE), Brazilian Portuguese (pt_BR), Korean (ko_KR) and Japanese (ja) translations. * i18n: regenerated the `.pot` template and the French and Traditional Chinese translations; strings for findings removed in 1.0.28 and the old offer names are no longer included. #### 1.0.30 * Changed: the offer shown with the visitor’s estimate now uses the same names as the price ranges in Settings Pricing (“Monthly maintenance” instead of “Preventive maintenance”, “Standard optimization” instead of “Light optimization”). #### 1.0.29 * Removed: the “Small fix” price range from Settings Pricing. It was saved but never used by the estimate. * Changed: scores below 40 now show the “Complete repair” offer, matching the price range they were already quoted with (previously labelled “Priority manual audit” while using the Complete repair prices). #### 1.0.28 * Changed: the audit no longer requests /xmlrpc.php, /wp-json/wp/v2/users, /.git/ HEAD or /readme.html on the submitted site. It now only reads the home page, robots.txt, sitemaps and the TLS certificate. The corresponding four findings were removed. * Removed: the unused public REST route GET /elwhc/v1/audit/{id}, which returned any stored audit’s result by its numeric ID. * Fix: the bundled French and Traditional Chinese translations are loaded again( they were not loaded since 1.0.22). * Fix: the donate notice now appears on the Settings screens in every admin language, not only English. * Changed: the quote confirmation page now uses the standard WordPress message page instead of its own inline stylesheet, and the printable report window is built without inline script or style tags. * Changed: database queries now pass table and column names through prepared-statement identifier placeholders. Requires WordPress 6.2 or later. * Removed: the filter that forced the plugin’s name to stay in English in the Plugins list. * Readme: documented every setting, the requests the audit sends, and known limitations. #### 1.0.27 * Fix: the audit form and result boxes had no explicit text color of their own, so they silently inherited the active theme’s body text color — on a theme with light/white body text, they could render nearly invisible against their fixed light backgrounds. The plugin’s whole front-end output now sets its own explicit text color instead of relying on the theme. #### 1.0.26 * Security: the “receive my quote by email” checkbox no longer emails the audit report straight to whatever address is typed in. It now sends a confirmation link first, and only sends the actual quote once that link is clicked — closing a gap where the public form could otherwise be used to email an arbitrary third party’s inbox. * Fix: closed a race condition in the per-IP/per-domain daily audit limits where several concurrent requests could all slip past the count check before any of them was recorded; added a short atomic burst guard. * Fix: the score review’s clearer “highlights” layout (introduced in 1.0.25) is now also used on the printable PDF report and the admin audit detail page, instead of only the interactive on-page result — both previously still showed the old“ Score: X/100 — Label —” flat sentence. * Fix: uninstalling with “delete all plugin data” enabled now also removes two secret options that were left behind (elwhc_ip_hash_secret, elwhc_quote_token_secret). * i18n: regenerated the .pot and updated the French and Traditional Chinese translations to cover strings added in 1.0.24/1.0.25 (consent checkbox, Settings Legal/GDPR, quote emails). #### 1.0.25 * Improved: the on-page audit result now shows a clearer, more visual “score review”— a plain-language condition sentence, the top priority findings as severity-colored chips, and the indicative estimate in a prominent highlight box, instead of one long summary sentence. * New: the “Contact on LINE” / “Request a quote” / “Download PDF report” buttons now also appear right after the score review, in addition to the end of the results, so visitors do not have to scroll to act on their result. #### 1.0.24 * New: an optional “receive my quote by email and accept the Terms of Use / Privacy Policy (GDPR)” consent checkbox on the public form. When checked, the submit button label changes to “Analyze my site and receive the quote”, the consent is stored with the lead, and the visitor is emailed their score, priority findings and price estimate immediately after the audit. * New: Settings Legal / GDPR section to configure the Terms of Use and Privacy Policy URLs linked from that checkbox. #### 1.0.23 * Fix: trimmed the readme’s Tags line from 6 to 5 (removed “leads”), per WordPress. org’s tag limit. * Update: Tested up to WordPress 7.1. #### 1.0.22 * Fix: removed the Author URI header (pointed at a promotional domain, not permitted for submission), and added the required Donate link plus a dismissible donate notice on the Settings and Network Settings screens. * Fix: removed the discouraged load_plugin_textdomain() call — WordPress.org auto- loads translations for hosted plugins. * Fix: the plugin’s name in the Plugins list is now forced to stay in English, so a GlotPress community translation of the “Plugin Name” header can no longer rename the brand on non-English sites. * Security: the visitor IP hash no longer derives its HMAC key from wp_salt() — it now uses a standalone, plugin-generated secret stored per site, independent of WordPress’s own auth material. * Bumped “Tested up to” to 7.0. #### 1.0.21 * Fix: “HTTPS not detected” could be wrongly reported for a site that is fully HTTPS but was audited via an http:// URL that correctly redirects to HTTPS (e. g. via .htaccess). The audit now probes https:// directly in that case instead of assuming HTTPS is broken just because the request started on http, and the TLS-certificate check now runs whenever HTTPS is confirmed working rather than only when the original request used https. * New: when HTTPS genuinely fails (invalid/incomplete certificate chain, a firewall blocking the request, etc.) with Debug mode enabled, the real underlying error is now recorded under Tools and Logs instead of only the generic finding text. #### 1.0.20 * New: “Download PDF report” on the public result and the admin audit detail page. Opens a branded, print-ready report (via the browser’s native print-to-PDF, no external library or dependency) with the full score, category breakdown, PageSpeed and every finding — not just the on-screen top 8. The admin version also hides the WP admin chrome and interactive-only sections when printing. * Fix: the “Core Web Vitals” table label was hardcoded in English; it is now translated( fr_FR/zh_TW added). #### 1.0.19 * Security: the TLS-certificate-expiry check (introduced in 1.0.16) opened a raw socket directly to the audited domain without the SSRF protection used everywhere else in the plugin. It now resolves and validates the domain to a public IP first and connects to that literal IP (with SNI still set to the hostname), closing a DNS-rebinding gap. * Fix: six new WordPress-hygiene findings (exposed .git, user enumeration, XML- RPC, readme.html, etc.) were tagged with the category ‘WordPress’ instead of the lowercase ‘wordpress’ id used everywhere else, which would have silently split them out of any future per-category filtering or reporting. #### 1.0.18 * Multisite: when global (network-wide) mode is on, each site can now optionally keep its own currency and prices while all other settings stay global — useful for a network of sites targeting different countries. Set it under a site’s Website Health Check Settings. #### 1.0.17 * PageSpeed Insights now reports both mobile and desktop, shown side by side (result, admin detail and quote email). The mobile score continues to drive the performance rating (Google is mobile-first). #### 1.0.16 * New: Google PageSpeed Insights integration (opt-in, needs an API key). Real mobile Lighthouse scores (performance, SEO, accessibility, best practices) and Core Web Vitals are shown in the result, admin detail and quote email, and drive the performance score. * New checks: TLS certificate expiry, mixed content, exposed .git/readme.html, XML-RPC enabled, REST user enumeration, page-title length, missing H1, and Open Graph/Schema.org/analytics detection. #### 1.0.15 * Fix: rate-limit, retention and “this week” windows now use the site timezone ( they previously used UTC while rows are stored in local time), so the per-IP/ per-domain daily limits and data retention are accurate on non-UTC sites. * Fix/security: the URL validator now resolves IPv6 (AAAA) records and blocks private/ reserved IPv6 ranges (including unique-local fc00::/7). IPv6-only sites can now be audited, and an AAAA record pointing at an internal address can no longer bypass the SSRF check. #### 1.0.14 * The quote-request notification email now contains the full report (overall score, summary, every category score, all findings with recommendations and the estimate) in addition to the visitor’s message, instead of only the score. #### 1.0.13 * Security: added a honeypot field to the audit form and quote popup to silently reject automated bot submissions (no third-party service, no CAPTCHA for real visitors). #### 1.0.12 * Security hardening: block SSRF via redirects and DNS rebinding by re-validating every request and redirect hop (reject_unsafe_urls) and capping the download size at the transport level; reject URLs containing embedded credentials; rate- limit quote requests and cap the message length; and neutralize spreadsheet formula injection in the CSV export. #### 1.0.11 * Fix: the “Request a full quote” button now follows the site language. Its label is a stored setting whose English default did not translate; it now falls back to the translated default when left at the default or empty. You can still enter a custom label per site. #### 1.0.10 * New: translations. The plugin now ships with French (fr_FR) and Traditional Chinese/ Taiwan (zh_TW) alongside English, covering both the admin and the public form/ result/quote popup. A .pot template is included. #### 1.0.9 * Fix: HTTPS is no longer reported as missing when a site returns a non-200 status( e.g. a 403/503 from a security filter or CDN) — any response over HTTPS now counts as HTTPS working. * Fix: when a site returns a block/challenge page instead of its real content, the content-based checks (WordPress, SEO, contact) are marked “Not assessed” and excluded from the score instead of reporting false errors, with one clear note explaining why. * Clearer results: findings now show a severity label (Important / To improve / For info) with the issue and recommendation, category rows show “Not assessed” where applicable, and a positive message appears when nothing needs attention. #### 1.0.8 * New: “Request a quote” now opens a popup form pre-filled with the visitor’s email, website URL and an editable message (built from their audit result). Submitting it records the request on the lead (status “Quote requested”) and emails the site’s contact address. Added a REST endpoint /elwhc/v1/quote for this. #### 1.0.7 * Fix: the public form now receives its configuration (REST endpoint, nonce, translations) via a data attribute on the form instead of wp_localize_script, which some themes/ caches/multisite setups did not print — this was the underlying cause of submissions reloading the page with no result. * New: full multisite support. Tables are created for every site on network activation and for any new site; uninstall cleans up each site. * New: optional global (network-wide) settings. A network admin can enable global mode under Network Admin Settings Website Health Check to apply one shared configuration to all sites. #### 1.0.6 * Fix: on block themes (e.g. Twenty Twenty-Five / Full Site Editing) the form script was not being enqueued because the shortcode was not detected on the main post, so submissions only reloaded the page. The script and its data now load on all singular views and no-op when no form is present. #### 1.0.5 * Fix: the public form script now loads in the page header and initializes on DOMContentLoaded, so it works even on themes/page builders that do not output wp_footer() where expected. This resolves cases where submitting the form simply reloaded the page instead of running the audit. #### 1.0.4 * Email is now required on the public form; the name and LINE ID fields have been removed for now. * Fix: added a language-agnostic REST fallback endpoint so submissions work on multilingual sites (e.g. WPML/Polylang) where the default REST URL can 404. The form now retries the fallback automatically and logs diagnostics to the browser console. #### 1.0.3 * Fix: the public form script now loads reliably by detecting the shortcode in the page content up front, so submissions are handled by JavaScript instead of falling back to a full-page reload. Hardened the form to POST to itself so visitor details are never exposed in the URL if scripts are unavailable. #### 1.0.2 * Set plugin author to domclic. #### 1.0.1 * Audit now falls back to plain HTTP when HTTPS does not respond, so HTTP-only or misconfigured sites can still be analyzed (they score 0 on the HTTPS category rather than failing outright). #### 1.0.0 * Initial release: public audit shortcode, REST API, non-intrusive scoring across six categories, indicative quote estimate, lead capture, admin dashboard/list/ detail, settings, logs, CSV export, rate limiting, SSRF protection, retention cleanup and clean uninstall. ## Meta * Version **1.0.38** * Last updated **2 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Tags * [audit](https://wordpress.org/plugins/tags/audit/)[health check](https://wordpress.org/plugins/tags/health-check/) [performance](https://wordpress.org/plugins/tags/performance/)[security](https://wordpress.org/plugins/tags/security/) [seo](https://wordpress.org/plugins/tags/seo/) * [Advanced View](https://wordpress.org/plugins/effortless-website-health-check/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/effortless-website-health-check/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/effortless-website-health-check/reviews/) ## Contributors * [ domclic ](https://profiles.wordpress.org/domclic/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/effortless-website-health-check/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://id7.dev/donate/)