WMS HealthScan

Description

WMS HealthScan gives WordPress site owners a single, plain-English answer to “is my website in good shape?” It runs a series of local, read-only checks and explains what it found, why it matters, and what to do about it — without requiring any external account, subscription, or third-party service.

This plugin is, and will remain, completely free. There is no premium version, no paid upgrade, no feature paywall, and no forced registration. Every feature described below is available to every user.

How the score works

Each category has a fixed weight. Checks that don’t apply to your site, or that could not be completed on your server, are excluded entirely — they never count against you. Critical issues weigh far more heavily than warnings. The dashboard always shows exactly which checks are affecting your score and by how much.

Privacy first

• No analytics, telemetry, or usage tracking of any kind.
• No data is ever sent to an external server for scanning or scoring — every check runs locally.
• The only outbound requests this plugin can make are the optional broken-link checks, which contact your own site or external sites already linked in your own content — never a third-party service.
• No personal or visitor data is collected or stored.

Safe by design

This plugin never automatically updates, deactivates, or deletes plugins/themes, never changes your PHP version, never modifies your database schema, and never disables security features. The only automatic “fix” available is clearing expired transients, which is safe and fully reversible. Every other recommendation links you to the correct native WordPress screen so you stay in control.

Features

• WordPress Core — whether an update is available and why that matters.
• Plugins — total/active/inactive counts, pending updates, and a conservative heuristic for active plugins that have not confirmed compatibility with recent WordPress versions.
• Themes — active theme, child-theme status, pending updates, and unused installed themes.
• PHP Environment — your PHP version against the currently supported range, with plain-English risk explanations.
• SSL/HTTPS — whether your site is fully configured for HTTPS, and a heuristic scan for obvious mixed content.
• Security Basics — debug-mode exposure, the file editor, a default “admin” username, uploads directory listing, and WordPress version disclosure. This is explicitly not a full security audit.
• Database — approximate size, transient count, revision count, and autoloaded options size.
• Media — oversized images and missing dimension metadata in a sample of your most recent uploads.
• Broken Links — an opt-in, rate-limited background scanner for links in your published content. Off by default.
• Performance Signals — page caching and persistent object cache detection. This is not a replacement for tools like Lighthouse or PageSpeed Insights.
• Backups — detects whether a known backup plugin is active. This cannot confirm that backups are actually completing successfully.
• Scheduled Tasks — whether WP-Cron is disabled and whether scheduled events are running on time.
• Website Health Score — one transparent, explainable score with a full breakdown of what raised or lowered it.
• CSV export — download your latest scan results at any time.