Title: Strata Site Audit
Author: Soren Ford
Published: October 25, 2026
Last modified: October 31, 2026
---
Search plugins
# Strata Site Audit
By [Soren Ford](https://profiles.wordpress.org/sorenford/)
[Download](https://downloads.wordpress.org/plugin/strata-site-audit.1.1.3.zip)
* [Details](https://wordpress.org/plugins/strata-site-audit/#description)
* [Reviews](https://wordpress.org/plugins/strata-site-audit/#reviews)
* [Development](https://wordpress.org/plugins/strata-site-audit/#developers)
[Support](https://wordpress.org/support/plugin/strata-site-audit/)
## Description
Strata tells you what is on a WordPress site, where it is used, what is broken and
what is fighting with what. It is built for people who look after sites they did
not build.
**What it reads**
* Elementor pages, templates, popups, Theme Builder conditions, global colors and
fonts, and HTML widgets
* Block editor content, block types and synced patterns
* Theme and child theme files
* Customizer Additional CSS and Elementor custom CSS
* WPCode, Code Snippets, Simple Custom CSS and JS, Elementor Custom Code and Astra
Custom Layouts
* Redirects from Redirection, Rank Math, Yoast SEO Premium and Safe Redirect Manager
* The media library: every image and file, and every page, setting and stylesheet
that uses it
**What it finds**
* Broken internal links and missing images, scripts and stylesheets, with the exact
page and widget that contains them. A server that is busy, slow, refuses the
request or asks for a login is never reported as a broken link: Strata says it
could not check, and Check again verifies any link on the spot
* Redirect chains, loops, redirects that end on a 404, and the same address redirected
by two plugins
* Templates, popups, globals and synced patterns nothing uses
* Templates that point at deleted templates, and header or footer templates that
target the same pages
* PHP syntax errors, deprecated WordPress functions, code that newer PHP versions
break, and code worth a second look
* A PHP version older than the latest critical security releases, or one that no
longer gets security fixes, with the version to ask your host for
* Shortcodes left in posts, templates and sidebar widgets after the plugin that
provided them was removed, such as `[vc_row]` or `[et_pb_section]`, which visitors
see as plain text
* The same function defined twice, two snippets fighting over one filter, a tracking
tag loaded twice, a library loaded twice, and CSS set differently in several
places
* Images far larger than any screen needs, images shown without alt text, files
nothing appears to use, and the same file uploaded more than once
* Page checks on every crawled page: search engines told to stay away from the
whole site, a home page or other pages set to noindex, a canonical tag naming
another site, missing and duplicate page titles, links and buttons with no text,
form fields with no label, and pages with no language on the html tag. Reported
only from what the page’s HTML shows, shown under Links, and no extra requests
**What it can fix**
Every finding says what is wrong and exactly what to do about it: which copy of
a duplicated function, snippet, tracking tag or CSS value to keep, which ones to
remove, and where each one lives. Every finding that counts places lists them in
the drawer, with links to edit each one. Code, CSS and conflict findings show exactly
which lines to delete (for example lines 27 to 98) with the code itself, and which
copy to keep. Every fix saves what it replaces first and can be undone from the
Activity screen: disable a snippet, delete a block of code stored in the database(
snippets, Customizer CSS, Elementor custom CSS and code, HTML widgets), move an
unused template, popup, synced pattern or media file to the trash, remove a widget
or block type from every page that uses it, remove an unused global, add a redirect,
collapse a redirect chain (Add redirect is not offered for an address that a query
string identifies, such as /?p=123, because a redirect matches the path and would
catch the whole page), replace a broken link wherever it is stored, remove a missing
file or broken link from every place that references it while keeping the rest of
the content, add alt text to an image and to the saved image tags that use it (the
text is kept as you type it, on one line), or remove a leftover shortcode. Anything
that removes something opens a question first that names it and every place it is
used. Remove shortcode takes the tags out of every place that stores them, keeps
the text between an opening and a closing tag, and asks first; posts keep a revision,
and Undo puts back every place that was not edited since. Strata never edits theme
files and never deletes anything permanently on its own: files go to the WordPress
trash, after Strata shows what it can and cannot check and asks you to confirm,
and come back with Undo. When you are sure, Assets > Trash empties the media trash
or deletes the files you pick, after a question that names them.
**Redirects in one place**
Links > Redirects lists every rule from Redirection, Rank Math, Yoast SEO Premium,
Safe Redirect Manager and Strata. Test all requests each rule’s address on your
site a few at a time, with the crawl pause in between, and says what a visitor gets:
works (with the final address), broken target, loop, chain, does not redirect, or
could not check when the server was busy. Export CSV saves every rule with its target,
code, plugin and whether it is on.
**Built to be read quickly**
The Overview shows one health score, a plain sentence about what needs attention
and the five things to do next. The Issues screen lists everything in one place,
filtered by area, severity or text. Assets shows the media library as a grid with
a preview of each file, where it is used, and views for unused files, duplicates,
oversized images and missing alt text, plus the media trash, which WordPress hides
by default. The Report button in the header offers CSV, PDF report and handover
report (the last two in Pro).
**Scan one area at a time**
The Overview lists every audit area (code, builder, shortcodes, media, links, CSS,
conflicts) with when it last ran and what is open. The Activity screen lists every
scan (started, paused, resumed, finished, cancelled, failed) next to the fixes,
with how long each finished scan took. Scan one area to re-check it in minutes,
tick several and scan them together, or run a full scan. Strata adds whatever an
area depends on, so a conflicts scan reads the code first. The running scan shows
how far each stage is.
**Light on your server**
Scans run in the background in short steps, so they work on shared and managed hosting.
The link checker requests one page at a time with a pause in between; Pro checks
several pages at once and paces itself to your site. Nothing loads on the front
end of your site unless you create a redirect with Strata.
**WP-CLI**
```
wp strata scan --wait, `wp strata findings`, `wp strata fix `, `wp strata undo ` and `wp strata report`.
```
**Strata Pro**
The free plugin finds the problems. Pro keeps watching, reports to clients, and
works across many sites.
* Scheduled scans (daily, weekly or monthly, at the hour you choose in your site’s
time zone) with email and Slack alerts when new issues appear
* An email or Slack message when a scan you started finishes or stops, so you can
close the tab on a long scan
* Scan history and a “since the previous scan” view of new and resolved issues
* A log of the 404 pages real visitors hit, with suggested redirect targets
* External link checks, rate limited per host
* Likely unused CSS selectors, matched against up to 50 sampled pages
* Plugins with no use found: every active plugin that adds Elementor widgets, blocks,
shortcodes, sidebar widgets or post types, reported only when none of them is
used in content (including WordPress widgets placed in Elementor), sidebars,
theme files or snippets and Strata could read all of them. On a multisite network,
a plugin active for the whole network is not judged from one site. Cache, security,
SEO, redirect, mail, backup, analytics and consent, image, page builder, commerce
and multilingual plugins, Jetpack, and plugins with nothing to trace are never
judged. Inactive plugins still installed are listed too. Strata never deactivates
or deletes a plugin
* Merge duplicate media: every use of a duplicate file is pointed at one kept copy
and the extra copies go to the trash, all in one step with one undo
* Bulk fixes with one “Undo batch” button, including moving several unused files
to the trash and removing leftover shortcodes
* White-label PDF reports with your agency’s name and logo, and CSV exports named
for your agency
* Handover report: a white-label PDF that maps the site for a new agency: WordPress,
PHP and database versions, theme and child theme, active and inactive plugins
with updates, Elementor templates and where Theme Builder shows them, where custom
code lives, redirects per plugin and the media library, with a short health summary
* Import redirects from a CSV file into Strata’s own redirects: a preview checks
every row first (unsafe targets, loops, rules that already exist in any redirect
plugin), and the whole import is one Activity entry whose Undo removes exactly
those rules
* Compare with another site: export a snapshot from one site (Report, Export snapshot)
and open it on another, such as staging and live, to see the issues only one
of them has, plugins and versions that differ, and settings like search engine
visibility and debug mode. Both sites need the same version of Strata. Nothing
changes on either site
* Resize large images to 2560 px (or your own size), one at a time or many in a
background queue with progress: Strata saves a scaled copy the way WordPress
does for big uploads, keeps the original file, and Undo puts every image back.
Optional JPEG and WebP compression
* No limit on crawled pages unless you set one in Settings (the free plugin checks
up to 500), and a faster crawl that sends up to 5 page requests at once, checks
files alongside them and slows down on its own when your site struggles
Plans and pricing: [stratasiteaudit.com/pricing](https://stratasiteaudit.com/pricing/).
The free plugin’s Settings screen also links to the plans.
**Bundled libraries**
Strata ships with the Freemius SDK and Action Scheduler (both GPLv3 or later), nikic/
php-parser (BSD 3-Clause), sabberworm/php-css-parser (MIT), htm (Apache 2.0) and
the Geist and Geist Mono fonts (SIL Open Font License 1.1, loaded from the plugin
folder, never from another server). The Pro edition adds dompdf, php-font-lib and
php-svg-lib (LGPL) and masterminds/html5 (MIT). Each keeps its own license file.
### External services
Strata contacts outside servers only in the cases below.
**WordPress.org theme downloads.** When you run the parent theme comparison, Strata
downloads the release of your theme that matches its version from downloads.wordpress.
org, to compare it with the files on your server. Only the theme’s slug and version
are sent. See the [WordPress.org privacy policy](https://wordpress.org/about/privacy/).
**Freemius.** Licensing, checkout and the optional usage opt-in are handled by Freemius.
If you opt in, or activate a Pro license, details such as your site URL, WordPress
and PHP versions, the plugin version and the admin name and email are sent to Freemius.
Nothing is sent if you skip the opt-in. See the [Freemius terms](https://freemius.com/terms/)
and [privacy policy](https://freemius.com/privacy/).
**Slack (Pro).** If you add a Slack webhook for alerts, Strata sends the alert text(
site name, how long the scan took, how many issues are new or resolved, the titles
of the newest issues, the reason a scan stopped, and a link to the results screen)
to that webhook on Slack’s servers. See the [Slack terms](https://slack.com/terms-of-service)
and [privacy policy](https://slack.com/trust/privacy/privacy-policy).
**Sites you link to (Pro).** External link checks send a HEAD or GET request to
each external address linked from your content, to see whether it still works. Private
and local addresses are never requested.
## Screenshots
[⌊Overview: one health score, what needs attention and the five things to do next.⌉⌊
Overview: one health score, what needs attention and the five things to do next.⌉[
Overview: one health score, what needs attention and the five things to do next.
[⌊Every finding says what is wrong, exactly what to do and where it lives. Safe
fixes run from the same panel, with undo.⌉⌊Every finding says what is wrong, exactly
what to do and where it lives. Safe fixes run from the same panel, with undo.⌉[
Every finding says what is wrong, exactly what to do and where it lives. Safe fixes
run from the same panel, with undo.
[⌊Assets: the media library as a grid with previews, where each file is used, and
views for unused files and duplicates.⌉⌊Assets: the media library as a grid with
previews, where each file is used, and views for unused files and duplicates.⌉[
Assets: the media library as a grid with previews, where each file is used, and
views for unused files and duplicates.
[⌊Every theme file, snippet and page builder code block, with what it hooks into
and loads.⌉⌊Every theme file, snippet and page builder code block, with what it
hooks into and loads.⌉[
Every theme file, snippet and page builder code block, with what it hooks into and
loads.
[⌊Strata Pro: scheduled scans with email and Slack alerts.⌉⌊Strata Pro: scheduled
scans with email and Slack alerts.⌉[
Strata Pro: scheduled scans with email and Slack alerts.
## FAQ
### Does any data leave my site?
Not unless you choose to. Scans run entirely on your server. Two things can contact
outside servers, and only when you choose them: the optional parent theme comparison
downloads the matching release from WordPress.org, and Strata Pro uses Freemius
for licensing if you opt in. See the External services section below.
### What is the handover report?
A PDF that describes a site you are taking over: what runs it, where the custom
code is, which template shows where and which plugin holds the redirects. It changes
nothing and needs no new scan. Parts that come from a scan (custom code, media details,
health) show “Not scanned yet” until that area has been scanned. It uses your report
branding. It is part of Strata Pro.
### Is Strata an SEO plugin?
No. It flags a few things that are broken, such as a site still hidden from search
engines after going live, or a canonical tag that names the staging site. It does
not check meta descriptions, headings or structured data.
### Does Strata check the PHP version itself?
Yes. Each Code scan compares the PHP version the site runs with the latest critical
PHP security releases and reports a Critical finding when the version number is
older. Your host installs PHP updates on managed hosting; on your own server you
update the PHP packages. Ubuntu, Debian and Red Hat can include the fixes under
an older number, so ask your host before you ignore it. Strata’s list of fixed releases
is updated with the plugin, and a new advisory is reported even if you ignored the
last one.
### Can Strata tell me if my site is ready for a newer PHP?
Yes. The Code scan reads every PHP snippet and theme file and lists lines that PHP
8.0 to 8.4 removed or warn about, with the line and what to write instead. It never
edits your code.
### Why does Strata say a shortcode shows as plain text?
Strata first checks whether a plugin registers the tag, or whether the plugin or
theme known to provide it (WPBakery, Divi, Avada and others in its list) is active.
For the rest it loads one published page that uses the tag, logged out and past
any page cache, and reports the tag when it shows there as raw text. Tags only on
drafts, private pages, templates or widgets, or on pages it could not load (at most
30 per scan), are reported as “may show as plain text”. Check one page before removing
them.
### Does Strata run the code it scans?
No. PHP is parsed into a syntax tree and read. Nothing is included or executed.
### The link check says it was skipped. Why?
Strata checks links by requesting your own pages from the server. Sites behind a
password (common on staging) or a firewall that blocks the server from calling itself
will skip this step. Everything else still runs.
### Can I undo a fix?
Yes. Every change appears on the Activity screen with an Undo button. If your host
stops a fix part way, Undo puts back exactly the places the fix had changed (it
asks you to wait a minute while the fix may still be running), and an Undo that
cannot put back every place stays available for the rest and names the places it
left.
### Strata said a link was broken but it loads for me
A link is reported broken only when your server answered with a real error such
as 404 or 410. Busy or rate-limited answers (429, 502, 503, 504), timeouts, refused
connections and login or firewall answers (401, 403) are listed as “Could not check”
instead, and Technical details show exactly what Strata saw, such as HEAD 405 then
GET 404. Open the finding and click Check again: if the address loads now, the finding
is marked fixed. Findings from a scan made with an older version stay until you
scan again.
### Can Strata delete code, widgets or templates for me?
Yes, with Undo. It deletes a block of code stored in the database (snippets, Customizer
CSS, Elementor custom CSS and code, HTML widgets), removes a widget or block type
from every page, moves templates, popups and synced patterns to the trash, and removes
globals. Each asks first and lists every place affected. It never edits theme or
plugin files: for those it shows the exact lines to delete, and it shows theme PHP
source only to users who may open the Theme File Editor (not when `DISALLOW_FILE_EDIT`
is set, and not to a site admin on a multisite network). It does not remove whole
sections or groups, because that would take everything inside them.
### Do I need Elementor?
No. Strata reads the block editor, themes, custom CSS, code snippet plugins and
redirect plugins on any site. Elementor support is built in for sites that use it.
### Will a scan slow down my site?
Scans run in the background in short steps, and the link checker waits between requests.
Visitors are not affected. On a large site a full scan can take a while; you can
pause, resume or cancel it at any time.
### What is the difference between Free and Pro?
Free runs every scanner by hand, checks up to 500 internal pages, applies single
fixes with undo (including moving one unused file to the trash), empties the media
trash and exports CSV. Pro adds scheduled scans with alerts, scan history, the 404
log, external link checks, unused CSS and plugins with no use found, merging duplicate
media and trashing the extra copies, bulk fixes (including bulk Remove shortcode),
white-label PDF reports, the handover report and an unlimited, faster crawl.
### Can I delete a plugin Strata says has no use?
Deactivate it on a staging copy first and check the site. Strata only looks for
what it can trace (Elementor widgets, blocks, shortcodes, sidebar widgets, post
types and calls from your theme files and snippets). It cannot see features that
only change settings, run on a schedule or work in the admin, or other plugins that
use its code. When Strata cannot read everything it needs, it skips the check instead
of guessing. The filter `strata_infrastructure_plugins` (plugin basename to a category)
marks more plugins that should never be judged.
### What does the Pro 404 log store?
The path that returned a 404, the referring address, how many times it was hit,
and when. It does not store IP addresses, user agents or anything else about the
visitor. It is off until you turn it on, and it is the only Strata code that runs
on the front end of your site. Repeated hits are capped per visitor address; behind
Cloudflare or another proxy every visitor shares one address, so add `add_filter('
strata_404_client_id', function () { return $_SERVER['HTTP_CF_CONNECTING_IP'] ??'';});`
to a small plugin to count visitors separately.
### Will Strata delete my images?
Not unless you ask it to. Strata’s fixes never delete files permanently. It reports
images that are too large, missing alt text, likely unused or uploaded twice. Adding
alt text is a one-click fix with undo. On an image used on very many pages it works
for a few seconds at a time, and Finish adding alt text does the rest with the text
you saved. An unused file can be moved to the WordPress trash after you confirm,
and Undo in Activity brings it back until WordPress empties the trash (30 days by
default). WordPress keeps Media Library trash hidden unless MEDIA_TRASH is turned
on, so on most sites Strata’s Undo is the way to get a file back. Strata refuses
when any use it can find remains (it checks again just before moving the file),
and offers no trash at all on sites where the trash is turned off; the same applies
to templates. Strata Pro can merge duplicates: every use is pointed at one copy
and the extra copies go to the trash, with one Undo for the whole step.
### Can I empty the media trash?
Yes. WordPress hides the Media Library trash by default, so files moved there wait
until WordPress deletes them (30 days by default). Assets > Trash lists them: tick
the files to delete or use Empty trash. Strata asks first and names the files, then
checks each file again and keeps any that a page, a setting, builder data or a theme
stylesheet still uses, and any it cannot be sure about. A permanent delete removes
the file and every size of it from the server and cannot be undone; Activity records
it.
### Why does Strata say a file is only “likely” unused?
Strata checks post and page content (including drafts), featured images, WooCommerce
galleries, Elementor data, the site icon and logo, custom CSS (including CSS far
down a long stylesheet and minified theme stylesheets) and the Site Editor’s styles.
When it cannot read all of the CSS or a page, it lists no unused file at all, refuses
to move media to the trash, and says so in a notice. A file can still be used from
places it cannot see, such as theme options of some themes, hard-coded paths in
PHP, emails or other websites. Just before it moves a file to the trash, Strata
checks again: content, featured images, galleries, Elementor data and page settings,
ACF fields, widgets, menus, the site icon, logo, header and background image, the
Additional CSS and the theme’s stylesheets as they are at that moment. When it cannot
read every theme stylesheet, it keeps a file the last media scan did not cover and
asks you to scan Media first. It still cannot see files used from theme or plugin
PHP code, in emails or on other websites, so look over a file before you remove
it.
### Does Strata work on multisite?
Yes. Each site keeps its own scans and findings. Network-wide Code Snippets are
listed in every site’s scan, but only a network admin can read their code or change
them, and a site’s own snippets follow Code Snippets’ own permission setting.
### What happens to my data if I delete the plugin?
Deleting Strata from the Plugins screen removes its database tables, settings and
scheduled jobs on every site. Changes you made with Strata’s fixes stay as they
are.
### Can undo overwrite something I changed later?
No. Undo first checks whether the post or kit changed since the fix. If nothing
changed, the exact original comes back. If you edited it in between, Strata reverses
only its own change inside your current content (for example it swaps the link back)
and keeps your edits. Items moved to the trash can be restored until WordPress empties
the trash, 30 days by default.
### Can I move redirects from one site to another?
Yes. Links > Redirects > Export CSV saves every rule from every supported redirect
plugin. With Pro, Import CSV on the other site shows each row with what is wrong
with it before anything is written, then adds the valid rows to Strata’s own redirects
in one step. Undo in Activity removes exactly the imported rules. Rules in your
redirect plugins are never changed.
### Can Strata compare my staging site with the live site?
Yes, with Pro. On one site choose Report, Export snapshot. On the other choose Report,
Compare with another site and pick that file. Strata lists the issues each site
has that the other does not, plugins that are missing or on another version, and
differences in WordPress, PHP, theme and settings that are safe to share (no passwords,
keys or email addresses are in the file). A checksum catches damaged or accidentally
edited files, and Strata refuses them. Both sites need the same version of Strata:
a snapshot exported by an older version is refused, so export it again after updating.
Nothing changes on either site.
### Does resizing an image change the original file?
No. Pro’s Resize to 2560 px saves a smaller copy next to the original, named like
the copy WordPress makes for big uploads (photo-scaled.jpg), and points the image
at it. The original stays in the uploads folder and is kept as the original image
in WordPress. Featured images, galleries and page builder widgets show the copy;
an image address typed into a post keeps loading the original. Undo puts the image
back and deletes only the files the resize made, and keeps any of them that a page,
a theme stylesheet, a setting, a user profile or a category still names. Animated
GIFs and file types other than JPEG, PNG and WebP are left alone.
### Do I keep the free plugin when I buy Pro?
Pro replaces it. After checkout you download the Pro version from your Freemius
account (or from the link in the plugin) and install it over the free one; your
settings, scans and history stay. If a license lapses, the plugin keeps working
as the free edition.
### How many sites can I use a Pro license on?
It depends on the plan: one site, five sites, 25 sites or unlimited sites. Licenses
are annual; there is no monthly or lifetime option. You can move a license between
sites from your account. A multisite network counts each site that activates Strata.
### What happens when my license expires?
Scheduled scans, alerts, the 404 log, external link checks, bulk fixes and PDF and
handover reports stop. Everything the free edition does keeps working, and your
scan history and settings are kept so they return when you renew.
### Which page builders does Strata understand?
Elementor (Free and Pro) and the block editor are read in detail: templates, global
colors and fonts, widgets and their links and images. Other builders are not parsed,
but the code inventory, CSS analysis, link checks, conflicts and media audit work
on any site.
### Can I use Strata Pro on client sites, and can I remove the Strata name from reports?
Yes. Pro is licensed per site, so each client site you manage counts toward your
plan. PDF reports can carry your agency’s name, logo and accent color instead of
Strata’s, and CSV exports carry your agency’s name in the file name.
### Is there a trial or a refund?
Pro has a 7-day free trial with no card required. If it is not for you, there is
a 7-day refund policy; contact support first so we can try to help.
### Do I have to run a full scan every time?
No. The Overview has a Scan button on every audit area and a “Scan selected” button
for several at once. A partial scan refreshes only the areas it covers: every screen,
export and PDF report shows the newest result for each area, and each Overview row
says when its area was last scanned. Old scans are cleaned up automatically, but
Strata always keeps the scans the current results come from. Scheduled scans are
always full scans.
### Does Strata work on very large sites?
Yes. Strata is tested on a generated site with over 10,000 media files, thousands
of Elementor pages and thousands of findings. Every screen loads in pages, every
fix searches the database a fixed number of times however big the site is, and a
scan runs in short background steps (about 20 seconds each by default) that pick
up where the last one stopped, so host time limits such as WP Engine’s 60 seconds
are never reached. A full scan of a large site can take an hour or more; you can
close the tab and Pro emails you when it is done.
### Why is a scan slow, and how do I speed it up?
The crawl requests your own site, and every page it checks is built by WordPress(
a page cache rarely helps, since the crawl visits each page once). Images, PDFs,
scripts and other files are checked with a quick HEAD request instead of being downloaded.
On Pro the crawl starts with two pages at a time, adds more while your site keeps
up (up to Most requests at once in Settings) and backs off when the site slows down
or answers “busy”, so you rarely need to tune it. On managed hosting (WP Engine,
Kinsta, Cloudways and the like) you can also set Pause between requests to 0 and
Time per background step to 40. A scan started from the Strata screen also moves
a little faster while that screen stays open.
### Where does Replace link change the link?
Everywhere WordPress stores it: post and page content, block editor attributes (
navigation links, embeds, buttons), Elementor data and templates, shortcode attributes
of builders such as Divi, WPBakery and Avada, reusable blocks, menus, custom fields(
ACF included) on posts, users and terms, user profiles (website and biography),
classic widgets, theme and Customizer settings, plugin settings, and WPML string
translations. Plugin settings are saved through WordPress, so the plugin’s own checks
run on them. Before anything changes, the panel lists the places it will change.
Only the link itself is replaced: a longer address that starts the same, or text
that merely mentions the address, is left alone. Every change can be undone from
Activity, and Undo leaves alone any place someone edited after the fix and tells
you which. Strata never touches core settings such as the site address, never edits
theme or plugin files, and cannot change a link written into theme or plugin code;
it says so when that is the case.
### Do fixes show up on cached sites?
Yes. After a fix or an undo, Strata asks the page caches it knows to clear, once
per request: WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, WP Fastest
Cache, NitroPack, Breeze, Hummingbird, Autoptimize, and the host caches of WP Engine,
SiteGround and Kinsta. Other caches can listen to the `strata_purge_caches` action.
To turn this off, return false from the `strata_purge_caches_after_fix` filter.
A CDN with its own cache (Cloudflare, for example) may still serve the old page
until it expires or you purge it there.
### A firewall or security plugin blocks the link check
The link check requests your own pages the way a visitor would, with the user agent`
Strata-Audit/`. Security plugins, Cloudflare bot rules and some hosts can block
or slow those requests, which shows up as skipped or failed links. Allow that user
agent (or your server’s own IP address) in the firewall, then scan the Links area
again. When a host answers “too many requests” or “busy” (429, 502, 503 or 504),
Strata tries that page again later in the same scan, up to four more times with
growing pauses, and never reports your page as a broken link. A page that is still
busy after the last try gets a “Could not check” warning, so a gap in the scan is
never silent; raise Pause between requests in Settings and scan again.
### Can Strata tell me when a long scan is done?
Yes, on Pro. Add your email addresses or a Slack webhook in Settings, then start
a scan and close the tab. When the scan finishes you get one message with how long
it took, what is new since the previous scan and a link to the results. If the scan
stops part way, the message says why. Scheduled scans follow the “Alert me when”
setting instead. Scans run from WP-CLI send nothing, since the terminal already
shows the result. If no email arrives, use Send test in Settings: many hosts only
deliver mail through an SMTP plugin.
### I re-uploaded the plugin and Pro features are gone
Open Strata, then Account, and click Activate or Reactivate License. Your key is
still valid; the re-upload only interrupted the activation.
### Do scheduled scans need a real cron job?
They run through WordPress’s background job system, so they work with WP-Cron on
a normal site. Hosts that turn WP-Cron off (WP Engine, for example) run a real cron
that calls wp-cron.php, which is even better. Each step of a scan starts the next
one itself, and a watchdog re-queues a scan that has gone quiet whenever anyone
requests the site, so a scan keeps going with the Strata screen closed. If the host
kills a step part way, the watchdog clears it and starts a fresh one within about
five minutes; Resume does the same at once.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Strata Site Audit” is open source software. The following people have contributed
to this plugin.
Contributors
* [ Soren Ford ](https://profiles.wordpress.org/sorenford/)
[Translate “Strata Site Audit” into your language.](https://translate.wordpress.org/projects/wp-plugins/strata-site-audit)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/strata-site-audit/),
check out the [SVN repository](https://plugins.svn.wordpress.org/strata-site-audit/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/strata-site-audit/)
by [RSS](https://plugins.trac.wordpress.org/log/strata-site-audit/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.1.3
* New: the Code scan reports, as Critical, a PHP version with known security holes:
one older than the October 21, 2026 security releases (8.2.35, 8.3.36, 8.4.27
and 8.5.12, which fix CVE-2026-109618 and CVE-2026-109619) or one that no longer
gets security fixes (8.1 and older). It says which version to ask the host for.
#### 1.1.2
* Changed: every file of the bundled PHP and CSS parsers now refuses direct requests,
as Plugin Check asks. No change in behaviour.
#### 1.1.1
* Changed: the PHP and CSS parsers Strata ships now live in lib/ beside Action
Scheduler, so vendor/ holds only the Freemius SDK and the autoloader. No change
in behaviour.
#### 1.1.0
* Fixed: a stylesheet or script referenced with http:// keeps one finding across
cache clears, instead of a new one every time its version stamp changes.
* New: leftover shortcodes. Strata finds shortcode tags left in posts, templates
and widgets after their plugin was removed, and Remove shortcode takes them out
with undo (Pro removes them in bulk).
* New: PHP 8 readiness. The Code scan lists code that PHP 8.0 to 8.4 removed or
warn about, with what to write instead.
* Changed: PHP code is now checked as the PHP version the site runs.
* New (Pro): handover report, a white-label PDF that describes a site you are taking
over, from the Report menu and `wp strata report --format=handover`.
* New (Pro): plugins with no use found. Every active plugin that adds widgets,
blocks, shortcodes, sidebar widgets or post types is checked, not only Elementor
add-ons, and inactive plugins left installed are listed. Report only.
* New: every finding lists exactly where it is, and code, CSS and conflict findings
show the exact lines to delete with the code.
* New: fix from the plugin with Undo: remove a missing file or broken link from
every page that references it, remove a widget or block type everywhere, delete
a block of database-stored code, and resolve any row on the Assets screens; each
asks first and names every place.
* New: Check again re-verifies a link finding on the spot.
* Changed: a busy, slow, refusing or login-protected server is never reported as
a broken link, and images found in builder settings are reported as missing files.
* Changed: the media scan and the trash check agree on what counts as a use; a
refused trash says where the file is used.
* Changed: a new admin design.
* New: page checks on every crawled page: a site still hidden from search engines,
noindex on the home page or other pages, a canonical tag naming another site,
missing and duplicate titles, links and buttons with no text, form fields with
no label and pages with no language, shown under Links.
* Fixed: many false reports found in a review of the whole plugin (see the handoff,
section 4).
* Fixed: redirects that differ only in case or accents no longer send visitors
in a loop on MySQL; a redirect now matches the exact address.
* Fixed: Redirection, Rank Math, Yoast SEO Premium and Safe Redirect Manager count
as in use only while the plugin is active, so no redirect is added to a plugin
that is switched off. A redirect with a 410 or another error code is no longer
shown as a problem.
* Fixed: 404 redirect suggestions on a site in a subdirectory no longer repeat
the folder name.
* Fixed (Pro): the redirect CSV import refuses addresses over 255 characters, imports
exactly the rows the preview showed and says so plainly when nothing could be
saved.
* Fixed: PHP files that start with HTML or a byte order mark are no longer reported
as syntax errors.
* Fixed: after a missing brace in CSS, Strata no longer offers to delete the next
valid rule.
* Fixed: Merge and trash and Delete permanently keep files used in ACF fields,
Elementor page settings, Additional CSS or the Customizer background image.
* Fixed: Undo after a fix that stopped half way puts back exactly what was changed,
or says plainly that it cannot. Undo of Ignore also reopens the issue in the
latest scan, and fixes no longer publish a scheduled post whose time had passed.
* Fixed (Pro): Stop in the image resize queue holds, and an image that crashes
the server is skipped.
* Fixed: page checks on very long addresses (non-Latin page names), and scans on
sites that already use a lot of memory, which now make progress. A scan step
that stops the scan three times in a row is skipped with a finding instead of
being retried forever, and that area keeps the results of the scan before. A
scan that is recovering from such a stop no longer says it stopped making progress,
and one busy answer from the home page no longer skips the link check.
* Fixed: Replace link and Remove reference find links with non-Latin letters, also
in Elementor data, Undo restores WPBakery button links after an edit, and links
such as /time/10:30/ are checked.
* Changed: on a multisite network, network-wide Code Snippets can be read and changed
only by a network admin.
* Fixed (Pro): Check again on an external link uses the same private-address protection
as the scan, and a host that only has an IPv6 address is no longer reported as
broken. An address Strata does not request is answered as not checked.
* Fixed (Pro): a plugin another used plugin depends on is no longer called unused;
a page too large to read in full is judged by the part that was read when Strata
looks for unused CSS; the crawl speeds up again after one slow moment; the 404
log is trimmed on hosts that skip database ids; the network overview no longer
links to a site where Strata is switched off.
* Changed (Pro): Compare snapshots work across admin languages and can always be
read by the site that made them. A snapshot exported by an older version must
be exported again.
* Fixed: Simple Custom CSS and JS codes that Strata switches off stop printing,
as they do when switched off in the plugin.
* Fixed: Settings shows an error with Try again when it cannot load, success messages
are announced to screen readers, and `wp strata report --format=handover` works
before the first scan.
* Fixed: a fix on a post whose page template the theme no longer has (Replace link,
Remove reference, Remove shortcode, Remove widget and block, Add alt text) now
saves and keeps its Undo. If the host stops a fix half way, Undo puts back exactly
the places it had changed, or asks you to wait a minute while the fix may still
be running.
* Fixed: an Undo that cannot put back every place stays available for the rest
and names the places it left. Check again and its Undo no longer clear page caches.
* Changed: Replace link works for at most 20 seconds per click and keeps a bounded
Undo copy; when places are left it says so and the next click carries on. Remove
widget and Remove block skip a page that is too large to copy for Undo, name
it, and carry on.
* Fixed: Add alt text keeps the text as typed (`$1` and prices such as $10 no longer
change it), finds an empty alt anywhere in the image tag, leaves image tags inside
comments, scripts and attribute values alone, and its Undo restores the whole
page unless it was edited since. On an image used on very many pages it stops
writing after a few seconds, says how many pages are left, and the next run with
the same text does the rest.
* Changed: Add redirect is not offered for an address told apart by its query string(
such as /?p=123) or when the page without the query works, and the 404 log will
not redirect the site root.
* Fixed: the Links scan no longer fails on a site with many redirect rules, does
not lose the links of a page when the host stops a step, tries a busy sitemap
again, and does not read a sitemap that redirects to another site.
* Fixed: a media file used only by CSS far down a long stylesheet (past 256 KB),
by a relative `url()` in a theme stylesheet, by a minified theme stylesheet (`*.
min.css`) or by the Site Editor’s styles is no longer reported as unused. When
Strata cannot read all the CSS (or a post) it lists no unused file, refuses to
trash media, and says so in one notice.
* Fixed: Delete permanently and Empty trash keep a file in the trash that the last
media scan found in a theme stylesheet, and keep every file when that scan could
not read everything.
* Fixed: CSS nesting is no longer a syntax error, a CSS file over 256 KB gets no
false syntax error, an earlier `!important` rule in the same file is respected,
and CSS for one page is no longer compared with site-wide CSS when Strata advises
which rule to delete.
* Fixed (Pro): a plugin whose WordPress widget is used in Elementor is no longer
reported with no use found, and a plugin active for the whole network is not
judged from one site.
* Changed: when an Elementor page cannot be read, Strata lists no unused template,
popup or global and refuses to trash them until it can.
* Fixed: an area where some items could not be read keeps its earlier results instead
of reporting files as unused or findings as resolved from partial data, and one
bad address no longer takes down the rest of its batch.
* Fixed: Activity and batch Undo no longer load every saved copy; a long batch
Undo stops after 20 seconds and offers Undo the rest, and starting a scan no
longer reads the whole Activity log.
* Fixed: Replace link and Remove reference find a link to the site root with a
query (/?p=123), a link followed by text that is not a fragment is no longer
taken for the whole value, and empty objects in block settings stay empty objects.
* Fixed: the conflicts scan counts a library enqueued twice under one handle once,
skips snippets that never run on the same kind of request (admin or front end)
and parent theme templates a child theme replaces, and for a guarded duplicate
function no longer advises keeping the copy that is not running: when it cannot
tell, it says so.
* Changed: PHP source of theme files is shown only to users who may open the Theme
File Editor, and a site’s own Code Snippets follow that plugin’s own capability
on a multisite network. For such code the Code list and drawer also leave out
what Strata read from it (tracking tags, libraries, hooks), the path on the server
and the link to an editor the user cannot open.
* Fixed (Pro): scheduled scans run at the chosen hour every time and weekly and
monthly scans keep their day, also across an update or a time zone change; the
unused CSS check samples up to five pages per template; the handover report says
the number of unused files is not determined when the media scan could not read
everything, instead of 0; Undo of an image resize keeps a copy that a widget
still names; uninstall removes the crawl pace and image queue options; each site
in the network overview reads its own settings.
* Fixed: counts of 1,000 or more read correctly (1,234 notices), a one-click fix
or an Undo cannot be sent twice by a second click, an older count no longer replaces
a newer one, Test all runs one loop at a time, and the redirect import panel
can take a second file.
* New: an area whose last scan could not finish says so on its row, above its findings
and on the Overview, with the date it first failed, until a scan completes it.
The older results stay, and scans that fail or are cancelled no longer push the
last good scan out of “Scans to keep”.
* Changed: Add alt text that stopped part way is offered as Finish adding alt text.
It needs no typing, uses the saved text, is also on the Media screen, and a new
scan keeps the finding until every page has the text.
* Fixed: before a media file is moved to the trash, merged or deleted for good,
Strata also reads the theme’s stylesheets as they are now, so a file a stylesheet
started to use after the last scan is kept. When it cannot read them all, it
keeps a file the media scan never saw and asks for a Media scan first.
* Fixed (Pro): History and alerts no longer report earlier findings as new on the
first complete scan after an incomplete one, and History says when nothing is
listed as resolved for an area, and why.
* Fixed: a sitemap that could not be read is noted in the Links results, and findings
on pages only that sitemap listed are not reported as resolved.
* Changed: Add redirect is not offered for the site root or for an address too
long for a redirect rule (over 255 characters), and (Pro) the 404 list says why
a row takes no redirect.
* Fixed: a restricted CSS snippet keeps its row in the CSS summary with a line
that says why its numbers are not shown, and a finding no longer shows values
copied from a snippet or theme file (returned text, CSS values, versions, error
messages, the path on the server) to a user who may not open that code.
* Fixed: a page whose Elementor data is broken is named in a finding with an edit
link, instead of holding several areas back without a word.
* Fixed: a theme folder that is a link, or sits outside wp-content/themes, is read,
and stylesheets in its vendor, node_modules and tests folders count as uses of
a media file. What Strata cannot read there is said in the unread notice.
* Fixed: Undo of a fix that was undone while it was still running puts the last
place back and says so, Activity no longer shows such a row as In progress, and
Remove shortcode leaves and names a widget it cannot tell apart from another
with the same text.
* Fixed (Pro): Undo of image resizing keeps a copy that a theme stylesheet, a setting,
a user profile or a category still names, and puts a long queue back in several
steps instead of one long request. Stop in the resize queue is never lost.
* Fixed (Pro): scheduled scans keep their day after a manual early run, and two
page loads at the same moment no longer queue two scans.
* Fixed (Pro): Check again shows a refused address in the admin language, and a
check that fails inside the plan answers “Not checked” and is never run without
its protection.
* Fixed: the conflicts scan reports two versions of a library loaded by one source,
no longer reports a parent theme’s comments, attachment and page templates that
the child theme replaces, and keeps an ignore when a finding’s list of copies
changes for that reason.
* Fixed: the PHP check no longer flags a call to an imported function or one guarded
in an elseif, and is faster on large PHP files. A leftover shortcode used only
on a post without a title is checked on the live page.
* Fixed (Pro): the handover report counts redirect rules without loading them,
prints no Update column for must-use plugins and drop-ins, and answers “Run a
scan first.” for a scan that is not there. The snapshot export of a very large
site uses little memory.
* Fixed: the menu counts stay when a refresh fails, the same message announced
twice is read twice by a screen reader, and Undo the rest cannot be sent twice
for one batch.
* Changed: Pro crawls without a page limit unless you set one.
#### 1.0.4
* WP-CLI: `wp strata report --output` writes inside the uploads folder only (a
bare name goes to uploads/strata-site-audit/), as WordPress.org requires of plugins.
* The bundled parser libraries ship without their build tools and old tests.
#### 1.0.3
* Upgrade page: the feature panel is as wide as the row of plans, its text is left-
aligned, and the page loads its current styles after an update instead of a cached
copy.
* Account page: now in Strata’s design too.
#### 1.0.2
* Upgrade page: the plan’s features are listed once, below the four sizes, instead
of under every card, and nothing is cut off at the card edge.
#### 1.0.1
* The Upgrade page inside the plugin now follows Strata’s design and shows yearly
prices, as the website does.
* Media scan: an image a page uses is always counted as used, whichever order the
scan reads files and pages in. Before, a long scan could list a used image as“
likely unused” or drop its missing alt text finding, a different set of images
on each scan, so scan history showed the same findings as new and then resolved
again and again.
#### 1.0.0
* First release.
## Meta
* Version **1.1.3**
* Last updated **1 day ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.5 or higher **
* Tested up to **7.1.4**
* PHP version ** 7.4 or higher **
* Tags
* [broken links](https://wordpress.org/plugins/tags/broken-links/)[elementor](https://wordpress.org/plugins/tags/elementor/)
[redirects](https://wordpress.org/plugins/tags/redirects/)[site audit](https://wordpress.org/plugins/tags/site-audit/)
[unused media](https://wordpress.org/plugins/tags/unused-media/)
* [Advanced View](https://wordpress.org/plugins/strata-site-audit/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/strata-site-audit/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/strata-site-audit/reviews/)
## Contributors
* [ Soren Ford ](https://profiles.wordpress.org/sorenford/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/strata-site-audit/)