Title: SiteAuditHub Author: SiteAuditHub Published: October 29, 2026 Last modified: October 29, 2026 --- Search plugins ![](https://ps.w.org/siteaudithub/assets/banner-772x250.png?rev=3772027) ![](https://ps.w.org/siteaudithub/assets/icon-256x256.gif?rev=3772027) # SiteAuditHub By [SiteAuditHub](https://profiles.wordpress.org/siteaudithub/) [Download](https://downloads.wordpress.org/plugin/siteaudithub.1.0.0.zip) * [Details](https://wordpress.org/plugins/siteaudithub/#description) * [Reviews](https://wordpress.org/plugins/siteaudithub/#reviews) * [Installation](https://wordpress.org/plugins/siteaudithub/#installation) * [Development](https://wordpress.org/plugins/siteaudithub/#developers) [Support](https://wordpress.org/support/plugin/siteaudithub/) ## Description SiteAuditHub checks your whole WordPress site and lists what needs fixing, in plain words, on one dashboard. All checks run on your own server. #### What it checks * **Site audit**: finds your published pages, posts, WooCommerce products and other public content, reads your XML sitemap and robots.txt, and follows internal links. You choose how deep it goes and how many URLs it checks. * **SEO**: page titles, meta descriptions, canonical tags, noindex, robots.txt conflicts, H1 and heading order, image alt text, broken links, redirect chains and loops, HTTP errors, sitemap coverage, thin content, duplicate titles, descriptions and content, orphan pages, mixed content and invalid JSON-LD. * **Accessibility**: missing alt text, buttons and links without a name, page language and title, skipped heading levels, invalid ARIA, focusable elements hidden from screen readers, iframe titles, blocked zoom, inline colour contrast and more. Things that need a manual test are shown separately. * **Plugins**: installed and active plugins, available updates, PHP and “tested up to” compatibility, and (if you turn it on) whether a plugin is still listed on WordPress.org. * **Site health**: WordPress and PHP versions, pending updates, HTTPS, debug settings, a public debug.log, REST API, WP-Cron, autoloaded options, PHP extensions, memory and failed internal requests. * **Malware and file changes**: known web shell and backdoor code, suspicious code, unknown files and folders in the site root, new code files added since the last scan, files changed without a plugin, theme or WordPress update, PHP files in uploads, hidden or disguised PHP files (photo.jpg.php), harmful .htaccess rules, injected scripts and hidden iframes in posts, code stored in settings and new administrator accounts. With one click it also compares WordPress core and WordPress. org plugin files with the official releases. The result is either “All safe” or a short list of possible threats. * **Login activity**: logins, logouts and failed attempts with username, time and browser/device. IP addresses and locations are not recorded. Includes filters, CSV export, automatic clean-up and WordPress privacy export/erase support. * **Reports**: scan history, what is new, recurring or fixed since the previous scan, failed and skipped checks, details per URL, CSV export and a printable report. * **Schedules and email**: daily, weekly or monthly scans, with an email when something important is found. #### Optional tools (all off until you turn them on) * **Custom login address**: move the login page away from wp-login.php. wp-login. php and /wp-admin/ (for logged-out visitors) then show a 404 page or go to the home page. You get the new address by email, and a wp-config.php line restores the default login if you forget it. * **Login page design**: show your site logo or your own logo instead of the WordPress logo, and set a background colour or image. * **Security**: limit failed login attempts, turn off XML-RPC, turn off the theme and plugin file editors, add security headers (X-Content-Type-Options, X-Frame- Options, Referrer-Policy), stop visitors from finding usernames and hide the WordPress version. Nothing is written to wp-config.php or .htaccess. * **Spam filter**: one switch that stops form messages and comments containing links, email addresses, phone numbers, junk text, repeated characters or fewer than 3 words. Comments, Elementor Pro, Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Ninja Forms, Formidable Forms and WooCommerce order notes are checked on the server; the message box of any other form is checked in the browser. Name, email, phone and other single-line fields are not touched. * **Turn off comments**: close and hide comments on the whole site. Nothing is deleted. * **Speed and SEO**: remove the emoji and embed scripts, remove jQuery Migrate, load Dashicons only for logged-in users, defer JavaScript, add missing image alt text and add a meta description when no SEO plugin does it. #### How results are reported * Every number comes from a stored scan. A check that did not run is never shown as passed, and a failed request is never shown as healthy. * Each finding says what kind it is: a confirmed issue, a possible issue, something to check by hand, or a check that could not run. * Scores are SiteAuditHub estimates to help you track progress. They are not Google rankings, PageSpeed scores, WCAG conformance or a security certificate. * The malware scan only reads files. It never edits, moves, deletes or runs them, and it does not replace a dedicated security service. #### Works on shared hosting Scans run in small, time-limited batches, so they keep going on slow or limited hosting. They move forward while a SiteAuditHub screen is open and continue in the background through WP-Cron. No shell commands are used. ### Privacy and external services SiteAuditHub sends no usage data and never contacts siteaudithub.com. The features below contact other servers only after you turn them on (all are off by default): * **Official file check**: downloads the official file lists from `https://api. wordpress.org/core/checksums/1.0/` (sends your WordPress version and language) and `https://downloads.wordpress.org/plugin-checksums/{slug}/{version}.json` ( sends the plugin slug and version). Your files are never sent. Turn it off under Settings, Plugins & Integrity. * **WordPress.org plugin lookup**: sends your installed plugin slugs to `https:// api.wordpress.org/plugins/info/1.2/` to check whether each plugin is still listed. Turn it off under Settings, Plugins & Integrity. * **External link check**: sends a HEAD or GET request to each external URL your pages link to. Turn it off under Settings, Scanning. WordPress.org privacy policy: https://wordpress.org/about/privacy/ When “Limit failed login attempts” is on, the visitor’s IP address is combined with the username into a one-way, salted code that is kept only for the lockout time. The IP address itself is never saved and never shown in Login Activity. Site audits load your own public pages as a logged-out visitor. Requests to private, local and cloud metadata addresses are blocked (except your own site when you allow it), and every redirect, timeout and response size is checked. When the spam filter is on, one small script is added to the front end of your site. When “Add a meta description” or “Add missing image alt text” is on, the plugin changes the page HTML sent to visitors. Nothing else is added to the front end. ## Screenshots [⌊Dashboard with the overall estimate, module scores and suggested next steps.⌉⌊ Dashboard with the overall estimate, module scores and suggested next steps.⌉[ Dashboard with the overall estimate, module scores and suggested next steps. [⌊SEO audit with a breakdown per check and expandable findings.⌉⌊SEO audit with a breakdown per check and expandable findings.⌉[ SEO audit with a breakdown per check and expandable findings. [⌊Live scan progress with pause, resume and cancel.⌉⌊Live scan progress with pause, resume and cancel.⌉[ Live scan progress with pause, resume and cancel. [⌊Malware scan result.⌉⌊Malware scan result.⌉[ Malware scan result. [[ [[ [[ [[ [[ ## Installation 1. Go to Plugins, Add New Plugin, Upload Plugin, choose the ZIP file and activate it. 2. Open SiteAuditHub, Settings to check what is scanned and the limits. 3. Click “Run site audit” on the dashboard. ## FAQ ### Does it change my content or settings? No. Your posts, media and settings are never changed. Only the optional tools listed above change how your site behaves, and each one is off until you turn it on. Switching a tool off restores the default behaviour. It works alongside Yoast SEO, Rank Math and All in One SEO. ### Why are some URLs “inaccessible”? Your server could not load them (firewall, bot protection, login required or a timeout). Raise the delay or timeout in Settings and click “Retry failed”. ### Does WP-Cron need to work? Scans move forward whenever a SiteAuditHub screen is open. Scheduled scans that run while nobody is logged in need WP-Cron (or a server cron that calls wp-cron. php). ### What happens when I uninstall it? Deactivating keeps all data. Deleting the plugin removes its scheduled tasks. Tables and settings are removed only if “Delete all SiteAuditHub data when the plugin is deleted” is turned on. ### I forgot my custom login address. How do I get in? Look for the email sent when you saved it, add `define( 'SITEAUDITHUB_DISABLE_LOGIN_GUARD', true );` to wp-config.php, or rename the plugin folder by FTP. The normal wp-login. php works again straight away. ### I locked myself out with “Limit failed login attempts”. What now? Wait until the lockout time is over, try from another network, or add `define( ' SITEAUDITHUB_DISABLE_LOGIN_LIMIT', true );` to wp-config.php. ### Which forms does the spam filter protect? Comments and the message field of Elementor Pro, Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Ninja Forms, Formidable Forms and WooCommerce order notes are checked on the server. The message box of any other form is checked in the browser before it is sent. Add the class `siteaudithub-skip` to a form to leave it out. ### Why does the plugin’s code contain words like eval and base64_decode? They are part of the malware scanner’s list of patterns to look for in other files. The plugin never runs them. ### Will the Speed and SEO options give me a perfect PageSpeed score? They remove common causes of lower scores, but PageSpeed also depends on your hosting, theme, image sizes and other plugins, so no plugin can promise a perfect score. ### Does it work on multisite? Yes. Each site has its own scans and settings. The custom login address is not available on multisite in this version. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “SiteAuditHub” is open source software. The following people have contributed to this plugin. Contributors * [ SiteAuditHub ](https://profiles.wordpress.org/siteaudithub/) [Translate “SiteAuditHub” into your language.](https://translate.wordpress.org/projects/wp-plugins/siteaudithub) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/siteaudithub/), check out the [SVN repository](https://plugins.svn.wordpress.org/siteaudithub/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/siteaudithub/) by [RSS](https://plugins.trac.wordpress.org/log/siteaudithub/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * First release. * Site-wide SEO, accessibility and site health audits with history, comparison, CSV export and printable reports. * Plugin monitor and a read-only malware scan with a clear “All safe” or possible threats result. * Login activity log (no IP addresses) and an optional custom login address. * Optional login page design, security tools, spam filter, comment switch and speed and SEO options. ## Meta * Version **1.0.0** * Last updated **8 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [accessibility](https://wordpress.org/plugins/tags/accessibility/)[broken links](https://wordpress.org/plugins/tags/broken-links/) [malware scanner](https://wordpress.org/plugins/tags/malware-scanner/)[seo audit](https://wordpress.org/plugins/tags/seo-audit/) [site health](https://wordpress.org/plugins/tags/site-health/) * [Advanced View](https://wordpress.org/plugins/siteaudithub/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/siteaudithub/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/siteaudithub/reviews/) ## Contributors * [ SiteAuditHub ](https://profiles.wordpress.org/siteaudithub/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/siteaudithub/)