{"id":387963,"date":"2026-10-19T01:06:21","date_gmt":"2026-10-19T01:06:21","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/mailwick-site-audit\/"},"modified":"2026-10-20T21:19:24","modified_gmt":"2026-10-20T21:19:24","slug":"mailwick-site-audit","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/mailwick-site-audit\/","author":23586452,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.0","stable_tag":"1.0.0","tested":"7.1.3","requires":"5.8","requires_php":"7.4","requires_plugins":null,"header_name":"Mailwick Site Audit","header_author":"Stephen Psaradellis","header_description":"Checks your site for email forgery protection (SPF and DMARC), padlock and mixed content problems, out-of-date software, phone view, tap-to-call links, contact form email delivery and the search snippet, then explains each fault in plain English with steps to fix it.","assets_banners_color":"385470","last_updated":"2026-10-20 21:19:24","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":63,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"spsaradellis","date":"2026-10-20 21:19:24","revision":3757487}},"upgrade_notice":{"1.0.0":"<p>First release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3753783,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3753783,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3753783,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3753783,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3753783,"resolution":"1","location":"assets","locale":"","width":1280,"height":900},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3753783,"resolution":"2","location":"assets","locale":"","width":1280,"height":900},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3753783,"resolution":"3","location":"assets","locale":"","width":1280,"height":900}},"screenshots":{"1":"Tools &gt; Mailwick Site Audit: every check with its result, the plain-English explanation and the evidence found.","2":"Each failing check comes with plain-English steps to fix it yourself, and a button to send a test email.","3":"The checks inside Tools &gt; Site Health."}},"plugin_section":[],"plugin_tags":[145801,287798,24593,145798,287799],"plugin_category":[54],"plugin_contributors":[287438],"plugin_business_model":[],"class_list":["post-387963","plugin","type-plugin","status-publish","hentry","plugin_tags-dmarc","plugin_tags-dmarc-checker","plugin_tags-mixed-content","plugin_tags-spf","plugin_tags-spf-record","plugin_category-security-and-spam-protection","plugin_contributors-spsaradellis","plugin_committers-spsaradellis"],"banners":{"banner":"https:\/\/ps.w.org\/mailwick-site-audit\/assets\/banner-772x250.png?rev=3753783","banner_2x":"https:\/\/ps.w.org\/mailwick-site-audit\/assets\/banner-1544x500.png?rev=3753783","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/mailwick-site-audit\/assets\/icon-128x128.png?rev=3753783","icon_2x":"https:\/\/ps.w.org\/mailwick-site-audit\/assets\/icon-256x256.png?rev=3753783","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/mailwick-site-audit\/assets\/screenshot-1.png?rev=3753783","caption":"Tools &gt; Mailwick Site Audit: every check with its result, the plain-English explanation and the evidence found."},{"src":"https:\/\/ps.w.org\/mailwick-site-audit\/assets\/screenshot-2.png?rev=3753783","caption":"Each failing check comes with plain-English steps to fix it yourself, and a button to send a test email."},{"src":"https:\/\/ps.w.org\/mailwick-site-audit\/assets\/screenshot-3.png?rev=3753783","caption":"The checks inside Tools &gt; Site Health."}],"raw_content":"<!--section=description-->\n<p>Mailwick Site Audit looks for the faults that quietly cost a small business website visitors, email and trust, and tells you about each one in plain English with short steps to fix it yourself.<\/p>\n\n<p>It adds one page, <strong>Tools &gt; Mailwick Site Audit<\/strong>, and adds its checks to <strong>Tools &gt; Site Health<\/strong>.<\/p>\n\n<p><strong>The seven checks<\/strong><\/p>\n\n<ol>\n<li><strong>Email forgery (SPF and DMARC).<\/strong> Looks up your domain's SPF and DMARC records. If DMARC is missing or set to <code>p=none<\/code>, anyone can send email that looks like it came from you@yourdomain, and your own mail is more likely to land in spam. Also catches two SPF records (which breaks both) and <code>+all<\/code>.<\/li>\n<li><strong>Padlock and mixed content (SSL).<\/strong> Confirms the site address uses https, that the SSL certificate passes verification, that the plain http:\/\/ address redirects to https:\/\/, and that the front page loads no scripts, styles, frames or images over insecure http:\/\/.<\/li>\n<li><strong>Out-of-date WordPress, plugins and themes.<\/strong> Reads the update information WordPress already stores and lists what is behind. It does not trigger extra update checks.<\/li>\n<li><strong>Phone view.<\/strong> Confirms the front page has a viewport tag, so phones show it at a readable size instead of a shrunken desktop page.<\/li>\n<li><strong>Tap-to-call.<\/strong> Finds phone numbers on the front page that are plain text instead of tap-to-call links.<\/li>\n<li><strong>Contact form email deliverability.<\/strong> Checks whether a mail-sending plugin (WP Mail SMTP, FluentSMTP, Post SMTP and others) is active. Without one, contact form messages leave straight from the web server and often land in spam. A button sends a test email to the site's admin address so you can see where it lands.<\/li>\n<li><strong>Search snippet.<\/strong> Confirms the front page has a meta description, so you choose the text under your link in Google rather than Google picking menu text or a cookie notice.<\/li>\n<\/ol>\n\n<p>Each result is marked <strong>Critical<\/strong>, <strong>Recommended<\/strong> or <strong>Good<\/strong>, with a one-sentence explanation, the evidence found, and numbered steps to fix it yourself.<\/p>\n\n<p><strong>Private by design<\/strong><\/p>\n\n<ul>\n<li>No account, no API key, no sign-up.<\/li>\n<li>No tracking and no data leaves your site. The plugin makes DNS lookups for your own domain and loads your own front page, nothing else.<\/li>\n<li>No ads or notices anywhere in the dashboard. A short \"Prefer it done for you?\" link appears only on the plugin's own page, under a failing check.<\/li>\n<\/ul>\n\n<h3>External services<\/h3>\n\n<p>This plugin does not connect to any third-party service.<\/p>\n\n<ul>\n<li><strong>DNS lookups.<\/strong> To check SPF and DMARC, the plugin asks your server's own DNS resolver for the TXT records of your site's domain and its <code>_dmarc<\/code> name. Only your domain name is looked up; this is the same public lookup any mail server does when it receives mail from you.<\/li>\n<li><strong>Your own home page.<\/strong> To check the padlock, mixed content, phone view, tap-to-call and search snippet, the plugin requests your site's own home URL (and its http:\/\/ version, to see whether it redirects to https:\/\/).<\/li>\n<\/ul>\n\n<p>Under a failing check, the \"See the fix guide and a fixed price\" link points to that check's guide under https:\/\/stephen-psaradellis.github.io\/demos\/ and is only followed if you click it. The plugin never requests those pages and sends them no data.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>In your dashboard go to Plugins &gt; Add New, search for \"Mailwick\", then Install and Activate. Or upload the <code>mailwick-site-audit<\/code> folder to <code>\/wp-content\/plugins\/<\/code> and activate it.<\/li>\n<li>Go to Tools &gt; Mailwick Site Audit. The checks run on your first visit and take a few seconds.<\/li>\n<li>Work through anything marked Critical first, then Recommended. Click \"Run the checks again\" after each fix.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20plugin%20send%20my%20data%20anywhere%3F\"><h3>Does this plugin send my data anywhere?<\/h3><\/dt>\n<dd><p>No. The only network activity is DNS lookups for your own domain and requests to your own home page. There is no tracking, no analytics and no remote account.<\/p><\/dd>\n<dt id=\"what%20are%20spf%20and%20dmarc%2C%20in%20plain%20english%3F\"><h3>What are SPF and DMARC, in plain English?<\/h3><\/dt>\n<dd><p>SPF is a public list of the servers allowed to send email for your domain. DMARC tells receiving mail servers what to do with email that claims to be from you but fails that test: nothing (<code>p=none<\/code>), send it to spam (<code>p=quarantine<\/code>) or refuse it (<code>p=reject<\/code>). Without DMARC, or with <code>p=none<\/code>, a scammer can send invoices or password-reset emails that appear to come from your address.<\/p>\n\n<p>To check a domain that is not on WordPress (a client's, a supplier's), the same SPF and DMARC test runs free in your browser at https:\/\/stephen-psaradellis.github.io\/demos\/email-forgery-check.html - nothing is installed and no data is stored.<\/p><\/dd>\n<dt id=\"why%20does%20it%20say%20%22not%20checked%22%20for%20some%20rows%3F\"><h3>Why does it say \"Not checked\" for some rows?<\/h3><\/dt>\n<dd><p>Some hosts block a site from loading its own pages (a \"loopback request\"), or block DNS lookups from PHP. When that happens the plugin says so instead of guessing. Tools &gt; Site Health shows whether loopback requests work.<\/p><\/dd>\n<dt id=\"will%20it%20slow%20down%20my%20site%3F\"><h3>Will it slow down my site?<\/h3><\/dt>\n<dd><p>No. Nothing runs for visitors. Results are cached for 12 hours and the checks run only when you open the plugin's page or Site Health, or click \"Run the checks again\".<\/p><\/dd>\n<dt id=\"does%20it%20fix%20things%20automatically%3F\"><h3>Does it fix things automatically?<\/h3><\/dt>\n<dd><p>No. It tells you what is wrong and how to fix it. Changes to DNS, certificates and themes are yours to make, so nothing changes on your site without you.<\/p><\/dd>\n<dt id=\"who%20sees%20the%20test%20email%3F\"><h3>Who sees the test email?<\/h3><\/dt>\n<dd><p>The address in Settings &gt; General &gt; Administration Email Address. Only administrators can send it.<\/p><\/dd>\n<dt id=\"is%20the%20%22prefer%20it%20done%20for%20you%3F%22%20link%20required%3F\"><h3>Is the \"Prefer it done for you?\" link required?<\/h3><\/dt>\n<dd><p>No. Every check comes with steps to fix it yourself. The link is an optional paid service, shown only on this plugin's page and only under a failing check.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>First release: email forgery (SPF, DMARC), padlock and mixed content, updates, phone view, tap-to-call, contact form email with a test email button, and search snippet checks, on Tools &gt; Mailwick Site Audit and in Site Health.<\/li>\n<\/ul>","raw_excerpt":"A DMARC checker and SPF record check, plus SSL padlock, mixed content, updates, phone view and contact email, each fault explained in plain English.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/387963","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=387963"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/spsaradellis"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=387963"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=387963"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=387963"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=387963"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=387963"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=387963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}