Strata tells you what is on a WordPress site, where it is used, what is broken and what is fighting with what. It is built for people who look after sites they did not build.<\/p>\n\n
What it reads<\/strong><\/p>\n\n What it finds<\/strong><\/p>\n\n What it can fix<\/strong><\/p>\n\n Every finding says what is wrong and exactly what to do about it: which copy of a duplicated function, snippet, tracking tag or CSS value to keep, which ones to remove, and where each one lives. Every finding that counts places lists them in the drawer, with links to edit each one. Code, CSS and conflict findings show exactly which lines to delete (for example lines 27 to 98) with the code itself, and which copy to keep. Every fix saves what it replaces first and can be undone from the Activity screen: disable a snippet, delete a block of code stored in the database (snippets, Customizer CSS, Elementor custom CSS and code, HTML widgets), move an unused template, popup, synced pattern or media file to the trash, remove a widget or block type from every page that uses it, remove an unused global, add a redirect, collapse a redirect chain (Add redirect is not offered for an address that a query string identifies, such as \/?p=123, because a redirect matches the path and would catch the whole page), replace a broken link wherever it is stored, remove a missing file or broken link from every place that references it while keeping the rest of the content, add alt text to an image and to the saved image tags that use it (the text is kept as you type it, on one line), or remove a leftover shortcode. Anything that removes something opens a question first that names it and every place it is used. Remove shortcode takes the tags out of every place that stores them, keeps the text between an opening and a closing tag, and asks first; posts keep a revision, and Undo puts back every place that was not edited since. Strata never edits theme files and never deletes anything permanently on its own: files go to the WordPress trash, after Strata shows what it can and cannot check and asks you to confirm, and come back with Undo. When you are sure, Assets > Trash empties the media trash or deletes the files you pick, after a question that names them.<\/p>\n\n Redirects in one place<\/strong><\/p>\n\n Links > Redirects lists every rule from Redirection, Rank Math, Yoast SEO Premium, Safe Redirect Manager and Strata. Test all requests each rule's address on your site a few at a time, with the crawl pause in between, and says what a visitor gets: works (with the final address), broken target, loop, chain, does not redirect, or could not check when the server was busy. Export CSV saves every rule with its target, code, plugin and whether it is on.<\/p>\n\n Built to be read quickly<\/strong><\/p>\n\n The Overview shows one health score, a plain sentence about what needs attention and the five things to do next. The Issues screen lists everything in one place, filtered by area, severity or text. Assets shows the media library as a grid with a preview of each file, where it is used, and views for unused files, duplicates, oversized images and missing alt text, plus the media trash, which WordPress hides by default. The Report button in the header offers CSV, PDF report and handover report (the last two in Pro).<\/p>\n\n Scan one area at a time<\/strong><\/p>\n\n The Overview lists every audit area (code, builder, shortcodes, media, links, CSS, conflicts) with when it last ran and what is open. The Activity screen lists every scan (started, paused, resumed, finished, cancelled, failed) next to the fixes, with how long each finished scan took. Scan one area to re-check it in minutes, tick several and scan them together, or run a full scan. Strata adds whatever an area depends on, so a conflicts scan reads the code first. The running scan shows how far each stage is.<\/p>\n\n Light on your server<\/strong><\/p>\n\n Scans run in the background in short steps, so they work on shared and managed hosting. The link checker requests one page at a time with a pause in between; Pro checks several pages at once and paces itself to your site. Nothing loads on the front end of your site unless you create a redirect with Strata.<\/p>\n\n WP-CLI<\/strong><\/p>\n\n Strata Pro<\/strong><\/p>\n\n The free plugin finds the problems. Pro keeps watching, reports to clients, and works across many sites.<\/p>\n\n Plans and pricing: stratasiteaudit.com\/pricing<\/a>. The free plugin's Settings screen also links to the plans.<\/p>\n\n Bundled libraries<\/strong><\/p>\n\n Strata ships with the Freemius SDK and Action Scheduler (both GPLv3 or later), nikic\/php-parser (BSD 3-Clause), sabberworm\/php-css-parser (MIT), htm (Apache 2.0) and the Geist and Geist Mono fonts (SIL Open Font License 1.1, loaded from the plugin folder, never from another server). The Pro edition adds dompdf, php-font-lib and php-svg-lib (LGPL) and masterminds\/html5 (MIT). Each keeps its own license file.<\/p>\n\n Strata contacts outside servers only in the cases below.<\/p>\n\n WordPress.org theme downloads.<\/strong> When you run the parent theme comparison, Strata downloads the release of your theme that matches its version from downloads.wordpress.org, to compare it with the files on your server. Only the theme's slug and version are sent. See the WordPress.org privacy policy<\/a>.<\/p>\n\n Freemius.<\/strong> Licensing, checkout and the optional usage opt-in are handled by Freemius. If you opt in, or activate a Pro license, details such as your site URL, WordPress and PHP versions, the plugin version and the admin name and email are sent to Freemius. Nothing is sent if you skip the opt-in. See the Freemius terms<\/a> and privacy policy<\/a>.<\/p>\n\n Slack (Pro).<\/strong> If you add a Slack webhook for alerts, Strata sends the alert text (site name, how long the scan took, how many issues are new or resolved, the titles of the newest issues, the reason a scan stopped, and a link to the results screen) to that webhook on Slack's servers. See the Slack terms<\/a> and privacy policy<\/a>.<\/p>\n\n Sites you link to (Pro).<\/strong> External link checks send a HEAD or GET request to each external address linked from your content, to see whether it still works. Private and local addresses are never requested.<\/p>\n\n\n Not unless you choose to. Scans run entirely on your server. Two things can contact outside servers, and only when you choose them: the optional parent theme comparison downloads the matching release from WordPress.org, and Strata Pro uses Freemius for licensing if you opt in. See the External services section below.<\/p><\/dd>\n A PDF that describes a site you are taking over: what runs it, where the custom code is, which template shows where and which plugin holds the redirects. It changes nothing and needs no new scan. Parts that come from a scan (custom code, media details, health) show \"Not scanned yet\" until that area has been scanned. It uses your report branding. It is part of Strata Pro.<\/p><\/dd>\n No. It flags a few things that are broken, such as a site still hidden from search engines after going live, or a canonical tag that names the staging site. It does not check meta descriptions, headings or structured data.<\/p><\/dd>\n Yes. Each Code scan compares the PHP version the site runs with the latest critical PHP security releases and reports a Critical finding when the version number is older. Your host installs PHP updates on managed hosting; on your own server you update the PHP packages. Ubuntu, Debian and Red Hat can include the fixes under an older number, so ask your host before you ignore it. Strata's list of fixed releases is updated with the plugin, and a new advisory is reported even if you ignored the last one.<\/p><\/dd>\n Yes. The Code scan reads every PHP snippet and theme file and lists lines that PHP 8.0 to 8.4 removed or warn about, with the line and what to write instead. It never edits your code.<\/p><\/dd>\n Strata first checks whether a plugin registers the tag, or whether the plugin or theme known to provide it (WPBakery, Divi, Avada and others in its list) is active. For the rest it loads one published page that uses the tag, logged out and past any page cache, and reports the tag when it shows there as raw text. Tags only on drafts, private pages, templates or widgets, or on pages it could not load (at most 30 per scan), are reported as \"may show as plain text\". Check one page before removing them.<\/p><\/dd>\n No. PHP is parsed into a syntax tree and read. Nothing is included or executed.<\/p><\/dd>\n Strata checks links by requesting your own pages from the server. Sites behind a password (common on staging) or a firewall that blocks the server from calling itself will skip this step. Everything else still runs.<\/p><\/dd>\n Yes. Every change appears on the Activity screen with an Undo button. If your host stops a fix part way, Undo puts back exactly the places the fix had changed (it asks you to wait a minute while the fix may still be running), and an Undo that cannot put back every place stays available for the rest and names the places it left.<\/p><\/dd>\n A link is reported broken only when your server answered with a real error such as 404 or 410. Busy or rate-limited answers (429, 502, 503, 504), timeouts, refused connections and login or firewall answers (401, 403) are listed as \"Could not check\" instead, and Technical details show exactly what Strata saw, such as HEAD 405 then GET 404. Open the finding and click Check again: if the address loads now, the finding is marked fixed. Findings from a scan made with an older version stay until you scan again.<\/p><\/dd>\n Yes, with Undo. It deletes a block of code stored in the database (snippets, Customizer CSS, Elementor custom CSS and code, HTML widgets), removes a widget or block type from every page, moves templates, popups and synced patterns to the trash, and removes globals. Each asks first and lists every place affected. It never edits theme or plugin files: for those it shows the exact lines to delete, and it shows theme PHP source only to users who may open the Theme File Editor (not when No. Strata reads the block editor, themes, custom CSS, code snippet plugins and redirect plugins on any site. Elementor support is built in for sites that use it.<\/p><\/dd>\n Scans run in the background in short steps, and the link checker waits between requests. Visitors are not affected. On a large site a full scan can take a while; you can pause, resume or cancel it at any time.<\/p><\/dd>\n Free runs every scanner by hand, checks up to 500 internal pages, applies single fixes with undo (including moving one unused file to the trash), empties the media trash and exports CSV. Pro adds scheduled scans with alerts, scan history, the 404 log, external link checks, unused CSS and plugins with no use found, merging duplicate media and trashing the extra copies, bulk fixes (including bulk Remove shortcode), white-label PDF reports, the handover report and an unlimited, faster crawl.<\/p><\/dd>\n Deactivate it on a staging copy first and check the site. Strata only looks for what it can trace (Elementor widgets, blocks, shortcodes, sidebar widgets, post types and calls from your theme files and snippets). It cannot see features that only change settings, run on a schedule or work in the admin, or other plugins that use its code. When Strata cannot read everything it needs, it skips the check instead of guessing. The filter The path that returned a 404, the referring address, how many times it was hit, and when. It does not store IP addresses, user agents or anything else about the visitor. It is off until you turn it on, and it is the only Strata code that runs on the front end of your site. Repeated hits are capped per visitor address; behind Cloudflare or another proxy every visitor shares one address, so add Not unless you ask it to. Strata's fixes never delete files permanently. It reports images that are too large, missing alt text, likely unused or uploaded twice. Adding alt text is a one-click fix with undo. On an image used on very many pages it works for a few seconds at a time, and Finish adding alt text does the rest with the text you saved. An unused file can be moved to the WordPress trash after you confirm, and Undo in Activity brings it back until WordPress empties the trash (30 days by default). WordPress keeps Media Library trash hidden unless MEDIA_TRASH is turned on, so on most sites Strata's Undo is the way to get a file back. Strata refuses when any use it can find remains (it checks again just before moving the file), and offers no trash at all on sites where the trash is turned off; the same applies to templates. Strata Pro can merge duplicates: every use is pointed at one copy and the extra copies go to the trash, with one Undo for the whole step.<\/p><\/dd>\n Yes. WordPress hides the Media Library trash by default, so files moved there wait until WordPress deletes them (30 days by default). Assets > Trash lists them: tick the files to delete or use Empty trash. Strata asks first and names the files, then checks each file again and keeps any that a page, a setting, builder data or a theme stylesheet still uses, and any it cannot be sure about. A permanent delete removes the file and every size of it from the server and cannot be undone; Activity records it.<\/p><\/dd>\n Strata checks post and page content (including drafts), featured images, WooCommerce galleries, Elementor data, the site icon and logo, custom CSS (including CSS far down a long stylesheet and minified theme stylesheets) and the Site Editor's styles. When it cannot read all of the CSS or a page, it lists no unused file at all, refuses to move media to the trash, and says so in a notice. A file can still be used from places it cannot see, such as theme options of some themes, hard-coded paths in PHP, emails or other websites. Just before it moves a file to the trash, Strata checks again: content, featured images, galleries, Elementor data and page settings, ACF fields, widgets, menus, the site icon, logo, header and background image, the Additional CSS and the theme's stylesheets as they are at that moment. When it cannot read every theme stylesheet, it keeps a file the last media scan did not cover and asks you to scan Media first. It still cannot see files used from theme or plugin PHP code, in emails or on other websites, so look over a file before you remove it.<\/p><\/dd>\n Yes. Each site keeps its own scans and findings. Network-wide Code Snippets are listed in every site's scan, but only a network admin can read their code or change them, and a site's own snippets follow Code Snippets' own permission setting.<\/p><\/dd>\n Deleting Strata from the Plugins screen removes its database tables, settings and scheduled jobs on every site. Changes you made with Strata's fixes stay as they are.<\/p><\/dd>\n No. Undo first checks whether the post or kit changed since the fix. If nothing changed, the exact original comes back. If you edited it in between, Strata reverses only its own change inside your current content (for example it swaps the link back) and keeps your edits. Items moved to the trash can be restored until WordPress empties the trash, 30 days by default.<\/p><\/dd>\n Yes. Links > Redirects > Export CSV saves every rule from every supported redirect plugin. With Pro, Import CSV on the other site shows each row with what is wrong with it before anything is written, then adds the valid rows to Strata's own redirects in one step. Undo in Activity removes exactly the imported rules. Rules in your redirect plugins are never changed.<\/p><\/dd>\n Yes, with Pro. On one site choose Report, Export snapshot. On the other choose Report, Compare with another site and pick that file. Strata lists the issues each site has that the other does not, plugins that are missing or on another version, and differences in WordPress, PHP, theme and settings that are safe to share (no passwords, keys or email addresses are in the file). A checksum catches damaged or accidentally edited files, and Strata refuses them. Both sites need the same version of Strata: a snapshot exported by an older version is refused, so export it again after updating. Nothing changes on either site.<\/p><\/dd>\n No. Pro's Resize to 2560 px saves a smaller copy next to the original, named like the copy WordPress makes for big uploads (photo-scaled.jpg), and points the image at it. The original stays in the uploads folder and is kept as the original image in WordPress. Featured images, galleries and page builder widgets show the copy; an image address typed into a post keeps loading the original. Undo puts the image back and deletes only the files the resize made, and keeps any of them that a page, a theme stylesheet, a setting, a user profile or a category still names. Animated GIFs and file types other than JPEG, PNG and WebP are left alone.<\/p><\/dd>\n Pro replaces it. After checkout you download the Pro version from your Freemius account (or from the link in the plugin) and install it over the free one; your settings, scans and history stay. If a license lapses, the plugin keeps working as the free edition.<\/p><\/dd>\n It depends on the plan: one site, five sites, 25 sites or unlimited sites. Licenses are annual; there is no monthly or lifetime option. You can move a license between sites from your account. A multisite network counts each site that activates Strata.<\/p><\/dd>\n Scheduled scans, alerts, the 404 log, external link checks, bulk fixes and PDF and handover reports stop. Everything the free edition does keeps working, and your scan history and settings are kept so they return when you renew.<\/p><\/dd>\n Elementor (Free and Pro) and the block editor are read in detail: templates, global colors and fonts, widgets and their links and images. Other builders are not parsed, but the code inventory, CSS analysis, link checks, conflicts and media audit work on any site.<\/p><\/dd>\n Yes. Pro is licensed per site, so each client site you manage counts toward your plan. PDF reports can carry your agency's name, logo and accent color instead of Strata's, and CSV exports carry your agency's name in the file name.<\/p><\/dd>\n Pro has a 7-day free trial with no card required. If it is not for you, there is a 7-day refund policy; contact support first so we can try to help.<\/p><\/dd>\n No. The Overview has a Scan button on every audit area and a \"Scan selected\" button for several at once. A partial scan refreshes only the areas it covers: every screen, export and PDF report shows the newest result for each area, and each Overview row says when its area was last scanned. Old scans are cleaned up automatically, but Strata always keeps the scans the current results come from. Scheduled scans are always full scans.<\/p><\/dd>\n Yes. Strata is tested on a generated site with over 10,000 media files, thousands of Elementor pages and thousands of findings. Every screen loads in pages, every fix searches the database a fixed number of times however big the site is, and a scan runs in short background steps (about 20 seconds each by default) that pick up where the last one stopped, so host time limits such as WP Engine's 60 seconds are never reached. A full scan of a large site can take an hour or more; you can close the tab and Pro emails you when it is done.<\/p><\/dd>\n The crawl requests your own site, and every page it checks is built by WordPress (a page cache rarely helps, since the crawl visits each page once). Images, PDFs, scripts and other files are checked with a quick HEAD request instead of being downloaded. On Pro the crawl starts with two pages at a time, adds more while your site keeps up (up to Most requests at once in Settings) and backs off when the site slows down or answers \"busy\", so you rarely need to tune it. On managed hosting (WP Engine, Kinsta, Cloudways and the like) you can also set Pause between requests to 0 and Time per background step to 40. A scan started from the Strata screen also moves a little faster while that screen stays open.<\/p><\/dd>\n Everywhere WordPress stores it: post and page content, block editor attributes (navigation links, embeds, buttons), Elementor data and templates, shortcode attributes of builders such as Divi, WPBakery and Avada, reusable blocks, menus, custom fields (ACF included) on posts, users and terms, user profiles (website and biography), classic widgets, theme and Customizer settings, plugin settings, and WPML string translations. Plugin settings are saved through WordPress, so the plugin's own checks run on them. Before anything changes, the panel lists the places it will change. Only the link itself is replaced: a longer address that starts the same, or text that merely mentions the address, is left alone. Every change can be undone from Activity, and Undo leaves alone any place someone edited after the fix and tells you which. Strata never touches core settings such as the site address, never edits theme or plugin files, and cannot change a link written into theme or plugin code; it says so when that is the case.<\/p><\/dd>\n Yes. After a fix or an undo, Strata asks the page caches it knows to clear, once per request: WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, WP Fastest Cache, NitroPack, Breeze, Hummingbird, Autoptimize, and the host caches of WP Engine, SiteGround and Kinsta. Other caches can listen to the The link check requests your own pages the way a visitor would, with the user agent Yes, on Pro. Add your email addresses or a Slack webhook in Settings, then start a scan and close the tab. When the scan finishes you get one message with how long it took, what is new since the previous scan and a link to the results. If the scan stops part way, the message says why. Scheduled scans follow the \"Alert me when\" setting instead. Scans run from WP-CLI send nothing, since the terminal already shows the result. If no email arrives, use Send test in Settings: many hosts only deliver mail through an SMTP plugin.<\/p><\/dd>\n Open Strata, then Account, and click Activate or Reactivate License. Your key is still valid; the re-upload only interrupted the activation.<\/p><\/dd>\n They run through WordPress's background job system, so they work with WP-Cron on a normal site. Hosts that turn WP-Cron off (WP Engine, for example) run a real cron that calls wp-cron.php, which is even better. Each step of a scan starts the next one itself, and a watchdog re-queues a scan that has gone quiet whenever anyone requests the site, so a scan keeps going with the Strata screen closed. If the host kills a step part way, the watchdog clears it and starts a fresh one within about five minutes; Resume does the same at once.<\/p><\/dd>\n\n<\/dl>\n\n\n\n
\n
[vc_row]<\/code> or [et_pb_section]<\/code>, which visitors see as plain text<\/li>\nwp strata scan --wait, `wp strata findings`, `wp strata fix <id>`, `wp strata undo <id>` and `wp strata report`.\n<\/code><\/pre>\n\n\n
External services<\/h3>\n\n
\n
Does any data leave my site?<\/h3><\/dt>\n
What is the handover report?<\/h3><\/dt>\n
Is Strata an SEO plugin?<\/h3><\/dt>\n
Does Strata check the PHP version itself?<\/h3><\/dt>\n
Can Strata tell me if my site is ready for a newer PHP?<\/h3><\/dt>\n
Why does Strata say a shortcode shows as plain text?<\/h3><\/dt>\n
Does Strata run the code it scans?<\/h3><\/dt>\n
The link check says it was skipped. Why?<\/h3><\/dt>\n
Can I undo a fix?<\/h3><\/dt>\n
Strata said a link was broken but it loads for me<\/h3><\/dt>\n
Can Strata delete code, widgets or templates for me?<\/h3><\/dt>\n
DISALLOW_FILE_EDIT<\/code> is set, and not to a site admin on a multisite network). It does not remove whole sections or groups, because that would take everything inside them.<\/p><\/dd>\nDo I need Elementor?<\/h3><\/dt>\n
Will a scan slow down my site?<\/h3><\/dt>\n
What is the difference between Free and Pro?<\/h3><\/dt>\n
Can I delete a plugin Strata says has no use?<\/h3><\/dt>\n
strata_infrastructure_plugins<\/code> (plugin basename to a category) marks more plugins that should never be judged.<\/p><\/dd>\nWhat does the Pro 404 log store?<\/h3><\/dt>\n
add_filter( 'strata_404_client_id', function () { return $_SERVER['HTTP_CF_CONNECTING_IP'] ?? ''; } );<\/code> to a small plugin to count visitors separately.<\/p><\/dd>\nWill Strata delete my images?<\/h3><\/dt>\n
Can I empty the media trash?<\/h3><\/dt>\n
Why does Strata say a file is only \"likely\" unused?<\/h3><\/dt>\n
Does Strata work on multisite?<\/h3><\/dt>\n
What happens to my data if I delete the plugin?<\/h3><\/dt>\n
Can undo overwrite something I changed later?<\/h3><\/dt>\n
Can I move redirects from one site to another?<\/h3><\/dt>\n
Can Strata compare my staging site with the live site?<\/h3><\/dt>\n
Does resizing an image change the original file?<\/h3><\/dt>\n
Do I keep the free plugin when I buy Pro?<\/h3><\/dt>\n
How many sites can I use a Pro license on?<\/h3><\/dt>\n
What happens when my license expires?<\/h3><\/dt>\n
Which page builders does Strata understand?<\/h3><\/dt>\n
Can I use Strata Pro on client sites, and can I remove the Strata name from reports?<\/h3><\/dt>\n
Is there a trial or a refund?<\/h3><\/dt>\n
Do I have to run a full scan every time?<\/h3><\/dt>\n
Does Strata work on very large sites?<\/h3><\/dt>\n
Why is a scan slow, and how do I speed it up?<\/h3><\/dt>\n
Where does Replace link change the link?<\/h3><\/dt>\n
Do fixes show up on cached sites?<\/h3><\/dt>\n
strata_purge_caches<\/code> action. To turn this off, return false from the strata_purge_caches_after_fix<\/code> filter. A CDN with its own cache (Cloudflare, for example) may still serve the old page until it expires or you purge it there.<\/p><\/dd>\nA firewall or security plugin blocks the link check<\/h3><\/dt>\n
Strata-Audit\/<\/code>. Security plugins, Cloudflare bot rules and some hosts can block or slow those requests, which shows up as skipped or failed links. Allow that user agent (or your server's own IP address) in the firewall, then scan the Links area again. When a host answers \"too many requests\" or \"busy\" (429, 502, 503 or 504), Strata tries that page again later in the same scan, up to four more times with growing pauses, and never reports your page as a broken link. A page that is still busy after the last try gets a \"Could not check\" warning, so a gap in the scan is never silent; raise Pause between requests in Settings and scan again.<\/p><\/dd>\nCan Strata tell me when a long scan is done?<\/h3><\/dt>\n
I re-uploaded the plugin and Pro features are gone<\/h3><\/dt>\n
Do scheduled scans need a real cron job?<\/h3><\/dt>\n
1.1.3<\/h4>\n\n
\n
1.1.2<\/h4>\n\n
\n
1.1.1<\/h4>\n\n
\n
1.1.0<\/h4>\n\n
\n
wp strata report --format=handover<\/code>.<\/li>\nwp strata report --format=handover<\/code> works before the first scan.<\/li>\n$1<\/code> and prices such as $10 no longer change it), finds an empty alt anywhere in the image tag, leaves image tags inside comments, scripts and attribute values alone, and its Undo restores the whole page unless it was edited since. On an image used on very many pages it stops writing after a few seconds, says how many pages are left, and the next run with the same text does the rest.<\/li>\nurl()<\/code> in a theme stylesheet, by a minified theme stylesheet (*.min.css<\/code>) or by the Site Editor's styles is no longer reported as unused. When Strata cannot read all the CSS (or a post) it lists no unused file, refuses to trash media, and says so in one notice.<\/li>\n!important<\/code> rule in the same file is respected, and CSS for one page is no longer compared with site-wide CSS when Strata advises which rule to delete.<\/li>\n1.0.4<\/h4>\n\n
\n
wp strata report --output<\/code> writes inside the uploads folder only (a bare name goes to uploads\/strata-site-audit\/), as WordPress.org requires of plugins.<\/li>\n1.0.3<\/h4>\n\n
\n
1.0.2<\/h4>\n\n
\n
1.0.1<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n