Title: Georgica Compliance & Accessibility Check Author: rogeorgica Published: October 27, 2026 Last modified: October 27, 2026 --- Search plugins ![](https://ps.w.org/georgica-compliance-accessibility-check/assets/banner-772x250. png?rev=3767828) ![](https://ps.w.org/georgica-compliance-accessibility-check/assets/icon-256x256. png?rev=3767828) # Georgica Compliance & Accessibility Check By [rogeorgica](https://profiles.wordpress.org/rogeorgica/) [Download](https://downloads.wordpress.org/plugin/georgica-compliance-accessibility-check.0.3.2.zip) * [Details](https://wordpress.org/plugins/georgica-compliance-accessibility-check/#description) * [Reviews](https://wordpress.org/plugins/georgica-compliance-accessibility-check/#reviews) * [Installation](https://wordpress.org/plugins/georgica-compliance-accessibility-check/#installation) * [Development](https://wordpress.org/plugins/georgica-compliance-accessibility-check/#developers) [Support](https://wordpress.org/support/plugin/georgica-compliance-accessibility-check/) ## Description Georgica Compliance scans your WordPress site from the inside and gives you a score from 0 to 100, split into five groups: **Privacy & Cookies**, **Accessibility**,** Security**, **Hacked site?** and **Forms & e-mail**. Every check shows a clear status( pass, warning, fail), a plain-language explanation and a “How to fix” hint with a link to the right WordPress screen. All features are free. There are no locked features, no trial periods, no ads in the dashboard and no tracking. #### Privacy & Cookies * Privacy policy page is selected, published and not just the empty template. * Privacy policy is linked from the home page. * Tracking scripts found in your home page source: Google Analytics / Google tag( gtag.js), Google Tag Manager, Meta (Facebook) Pixel, Hotjar, Microsoft Clarity, TikTok Pixel, LinkedIn Insight Tag. * Cookie consent tools: CookieYes, Complianz, Cookiebot, Borlabs Cookie, CookieAdmin, Real Cookie Banner, GDPR Cookie Compliance, Cookie Notice, iubenda, Termly, WP Consent API (as active plugins), plus common consent platforms recognised in the page source. * Google Consent Mode v2: default consent command with the v2 signals (ad_user_data, ad_personalization). * Contact forms (Contact Form 7, WPForms, Gravity Forms, Fluent Forms): does each form contain a consent checkbox or privacy wording? * WooCommerce shops: terms and conditions page, returns / right of withdrawal page, company details (hints). #### Accessibility (European Accessibility Act / WCAG 2.1 AA basics) * Page language declared (``). * Zoom not blocked by the viewport meta tag. * Media library images without alternative text (count, list and direct edit links). * Home page images without an alt attribute. * Home page links and buttons without an accessible name (e.g. icon-only links). * Menu items without a label (classic menus and block navigation). * Heading structure in recent posts and pages (skipped levels, multiple H1). #### Security * WordPress core, plugin and theme updates (based on the data WordPress itself already collected). * HTTPS and SSL certificate validity / days until expiry. * Security headers (HSTS, X-Content-Type-Options, X-Frame-Options or CSP frame- ancestors, Referrer-Policy). * Publicly readable readme.html / license.txt, debug.log and wp-config.php backups. * A user with the login “admin”. * XML-RPC fully enabled. #### Hacked site? (spam and malware signs) Nothing is ever changed or deleted. Every finding is listed with an edit link, and you can ask for help with one click. * Spam words and links injected into published content: posts, pages, WooCommerce products, block templates, menus, categories/tags, text/HTML/block widgets, site title and tagline. Examples: casino/betting, 1win/1xbet/mostbet, slot spam, viagra/ cialis/levitra, online pharmacy, payday loans, adult content, crypto scams. * Links to other domains hidden with inline styles (display:none, font-size:0, off-screen positioning), in content and on the rendered home page. * Obfuscated JavaScript (eval, atob, fromCharCode) and scripts or iframes from unknown domains inside content. * Autoloaded settings containing script tags or obfuscation functions. * Administrator accounts created in the last 30 days or with names attackers often use (list only). * Executable PHP files in wp-content/uploads. * **On click only:** verify WordPress core files against the official WordPress. org checksums. Modified, missing and unknown PHP files in wp-admin, wp-includes and the root folder are listed. * **On click only:** ask WordPress.org whether installed plugins were closed (for example for a security issue), and whether plugins or themes have not been updated for more than two years. #### Required pages: draft generator (Romanian and English) Creates **draft** pages that you review, complete and publish yourself. Fields to complete are marked [FILL IN …] / [COMPLETAȚI …]. The templates never claim that the site is compliant. * Accessibility statement. Structure based on the European Accessibility Act (Directive( EU) 2019/882, Annex V) and WCAG 2.1 AA: - compliance status, to be chosen after an evaluation; - non-accessible content, pre-filled with the issues found by the scan; - evaluation method and dates; - feedback contact; - complaints procedure. * Cookie policy, filled with the tracking scripts detected on your home page and their typical cookies. * Privacy policy template (GDPR structure). * Shop terms and conditions with a company details block. The Romanian version includes: - the 14-day right of withdrawal (OUG 34/2014); - the legal guarantee of conformity (OUG 140/2021); - the ANPC alternative dispute resolution (SAL) links; - a note that the EU ODR platform was discontinued on 20 July 2025. The templates are not legal advice and must be checked before publishing. #### Form watchdog (optional, off by default) * Once a day, sends a test message marked “[Georgica Compliance test]” through the site’s own wp_mail() to the administration e-mail (or the recipient you set). * After two failures in a row, shows a warning on the dashboard. * Checks the configuration of Contact Form 7, WPForms, Gravity Forms and Fluent Forms: recipient set, form placed on a published page. It never submits real forms. #### One-click fixes (all off by default, all reversible) * Disable XML-RPC (via WordPress filters). * Send basic security headers (via the `send_headers` action; headers your server already sends are not duplicated). HSTS is a separate switch with a clear warning. * Hide readme.html and license.txt by renaming them (no server rewrite rules). They are renamed back when you switch the option off or deactivate the plugin. #### Weekly scan and optional e-mail The scan can run automatically once a week with WP-Cron. An e-mail summary is available but **off by default**; when enabled it is sent with your site’s own `wp_mail()` to the address you choose. #### Honest limits This tool helps identify common issues; it is not legal advice and does not guarantee compliance. Automated checks cannot judge whether alternative text is meaningful, whether a consent banner really blocks scripts before consent, or whether your legal texts are correct. Accessibility checks cover the home page and the WordPress content database, not every page of the site. #### Request a fix (optional, only when you click) Next to the overall score there is a “Request a fix” button, and every failed or warning check has a small “I want you to help me with this” link. They let you order a fix from INFINITY DIGITAL SOLUTIONS SRL, the authors of this plugin. Clicking first shows a confirmation that lists exactly which technical details the link contains. Only when you click “Continue” does the order page open in a new browser tab. You type your name and e-mail yourself on that page; nothing is sent automatically. See “External services” below. #### Optional paid service The plugin shows one small, dismissible box mentioning Georgica Compliance, a separate paid service by the same authors (continuous external monitoring, monthly PDF reports, a full accessibility crawl, alerts and a multi-site dashboard for agencies). It is a plain link to the authors’ website (https://georgica.ro/en/website-monitoring, or https://georgica.ro/monitorizare-site in Romanian); nothing is loaded from or sent to that website, and the plugin is fully functional without it. ### External services and network requests **This plugin makes no automatic requests to external services.** Nothing below runs from WP-Cron, on activation or on page load, and the plugin contains no API keys. The server never contacts our servers, WordPress.org, Google or any third party. The plugin loads no remote scripts, fonts or images and collects no usage data. The only network connections it opens are **loopback requests to your own site**, all addressed to the host of your Site Address / WordPress Address: * `GET` of your home page, to inspect the HTML and response headers as an anonymous visitor sees them. * `GET` of a few fixed paths on your own site (readme.html, license.txt, wp-content/ debug.log and common wp-config.php backup names) to see whether they are publicly readable. * One `POST` of `system.listMethods` to your own `xmlrpc.php`, to see whether XML- RPC is enabled. * A TLS connection to your own domain on its HTTPS port, only to read the expiry date of your SSL certificate. If your domain is served through a CDN or reverse proxy, these requests travel through it exactly like a normal visitor’s request. Update information is read from data WordPress itself has already stored; the plugin never triggers an update check. The optional weekly e-mail (off by default) is sent through your own site’s mail function to the recipient you configure. #### WordPress.org (only when you click a button) Two checks in the “Hacked site?” group contact **WordPress.org** (api.wordpress. org), the official, free WordPress service. They run only when an administrator clicks the button. The request is sent by your server with the user agent `Georgica Compliance/`, without your site address. * **“Verify WordPress files”** calls `https://api.wordpress.org/core/checksums/ 1.0/`. - Sent: your WordPress version and locale (e.g. `7.1.3`, `en_US`). - Received: the official MD5 checksums of the core files, which are compared locally. * **“Check plugins on WordPress.org”** calls `https://api.wordpress.org/plugins/ info/1.2/` and `https://api.wordpress.org/themes/info/1.2/`. - Sent: the slug (folder name) of each installed plugin and theme, one request each. - Received: whether each one is listed, closed (with date and reason) or when it was last updated. * No personal data and no site address is sent. * WordPress.org privacy policy: https://wordpress.org/about/privacy/ Not integrated: third-party vulnerability databases, Google Safe Browsing and VirusTotal. They require each site to register its own API key and accept the provider’s terms, and some feeds are too large for ordinary hosting. #### Form watchdog e-mail When you enable it (off by default), the plugin sends one test e-mail a day through your own site’s `wp_mail()` to your administration address. No form is submitted, and nothing is sent to us or to any other third party by the plugin. #### “Request a fix” link (external service, only on explicit click) The “Request a fix” button and the “I want you to help me with this” links open an external website: the order page of **INFINITY DIGITAL SOLUTIONS SRL**, the provider of the fix service. This happens only when you click, then confirm with “Continue”, and the page opens in a new tab of _your browser_. Your server does not send anything. Before you continue, the confirmation shows the full link. * Destination: `https://georgica.ro/contact` (Romanian admin language) or `https:// georgica.ro/en/contact` (other languages). Site owners can change it with the` SITE_CONFORM_FIX_URL_RO` / `SITE_CONFORM_FIX_URL_EN` constants or the `site_conform_fix_request_url` filter, and can hide the button and links completely with `add_filter( 'site_conform_show_fix_requests',' __return_false' );`. * Data in the link (technical only): - the site address (`home_url`); - the overall score; - the identifiers of the failed and warning checks (for example `trackers_consent, security_headers`); - the plugin version; - your admin language. * Data not in the link: no name, no e-mail address and no other personal data. You enter your contact details yourself on the order page. * Terms and conditions: https://georgica.ro/termeni-si-conditii * Privacy policy: https://georgica.ro/gdpr ## Installation 1. Upload the `site-conform` folder to `/wp-content/plugins/`, or install the ZIP via Plugins Add New Upload Plugin. 2. Activate the plugin. 3. Go to **Tools Georgica Compliance** and click **Run the first scan**. ## FAQ ### Does this plugin make my site GDPR / EAA compliant? No tool can do that on its own. Georgica Compliance finds common technical issues and explains how to fix them. It is not legal advice and does not guarantee compliance. ### Does it delete or change anything when it finds a problem? No. Hacked-site findings are only listed, with edit links. Only the one-click fixes you switch on yourself change anything, and they are reversible. ### Does it send any data to you or anyone else? Not automatically. The server only makes loopback requests to your own site, plus WordPress.org requests when you click one of the two “Hacked site?” buttons. The other exception is the “Request a fix” button: after you click it and confirm, your browser opens our order page with the technical details listed in the confirmation( site address, score, issue identifiers, plugin version, language). No personal data is included. See “External services and network requests” above. ### The scan says my home page could not be loaded. Some hosts block requests from the server to itself (“loopback requests”), and maintenance/ coming-soon modes also return an error. Checks that need the page source are then marked as “Info” and left out of the score. Tools Site Health Info shows whether loopback requests work. ### Will the one-click fixes break anything? They are off by default and easy to switch off again. Disabling XML-RPC breaks Jetpack, the WordPress mobile app and remote publishing tools – the plugin tells you if Jetpack is active. Security headers prevent other domains from embedding your site in frames. HSTS should only be enabled when HTTPS works on the whole domain, because browsers remember it for a year. ### Why is a check marked “Info”? “Info” means not applicable or not measurable on your server (for example, no Google tags present, no form plugin, or WordPress has not checked for updates yet). Info rows do not count towards the score. ### How is the score calculated? Each check has a weight from 1 to 3. Pass counts fully, Warning counts half, Fail counts zero; Info checks are ignored. The overall and per-group scores are the weighted percentage. ### Does it work with page builders? Checks based on the home page HTML work with any builder. The heading-structure check reads post content, so content that a builder stores elsewhere is not checked. ### Which languages are included? English. The plugin is translation-ready (text domain `georgica-compliance-accessibility- check`); translations come from translate.wordpress.org. ### What happens when I uninstall the plugin? All its options, the scheduled event and user preferences are deleted, and readme. html / license.txt are restored if they were renamed. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Georgica Compliance & Accessibility Check” is open source software. The following people have contributed to this plugin. Contributors * [ rogeorgica ](https://profiles.wordpress.org/rogeorgica/) [Translate “Georgica Compliance & Accessibility Check” into your language.](https://translate.wordpress.org/projects/wp-plugins/georgica-compliance-accessibility-check) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/georgica-compliance-accessibility-check/), check out the [SVN repository](https://plugins.svn.wordpress.org/georgica-compliance-accessibility-check/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/georgica-compliance-accessibility-check/) by [RSS](https://plugins.trac.wordpress.org/log/georgica-compliance-accessibility-check/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.3.2 * Renamed to Georgica Compliance & Accessibility Check (slug georgica-compliance- accessibility-check). * Removed bundled translation files; translations come from translate.wordpress. org. #### 0.3.1 * Plugin, author and service links now point to georgica.ro (the authors’ website). #### 0.3.0 * New: “Hacked site?” group with these checks: - injected spam; - hidden external links; - obfuscated scripts and iframes; - suspicious autoloaded settings; - recently created or suspicious administrator accounts; - PHP files in uploads; - click-only WordPress.org core checksums; - click-only check for closed or abandoned plugins. Nothing is changed or deleted automatically. * New: draft generator for required pages, in Romanian and English: accessibility statement (EAA / WCAG 2.1 AA structure), cookie policy filled with the detected scripts, privacy policy template, shop terms with company details and ANPC SAL links. * New: optional form watchdog with a daily wp_mail() test and a form configuration check (recipient set, form placed on a page). * Documented the click-only WordPress.org requests under “External services”. #### 0.2.0 * New: “Request a fix” button next to the score and “I want you to help me with this” links on failed and warning checks. A confirmation lists the technical data in the link (site, score, issue identifiers, plugin version, language); the order page opens only after “Continue”. No personal data, no automatic requests. * New: constants and filters to change or hide the fix-request destination. #### 0.1.0 * First release: up to 26 checks in three groups, weighted score, one-click fixes( XML-RPC, security headers, HSTS, hiding readme.html / license.txt), weekly WP- Cron scan, optional e-mail summary, dashboard widget, English and Romanian. ## Meta * Version **0.3.2** * Last updated **2 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.3 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [accessibility](https://wordpress.org/plugins/tags/accessibility/)[EAA](https://wordpress.org/plugins/tags/eaa/) [GDPR](https://wordpress.org/plugins/tags/gdpr/)[malware](https://wordpress.org/plugins/tags/malware/) [security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/georgica-compliance-accessibility-check/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/georgica-compliance-accessibility-check/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/georgica-compliance-accessibility-check/reviews/) ## Contributors * [ rogeorgica ](https://profiles.wordpress.org/rogeorgica/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/georgica-compliance-accessibility-check/)