WebDiagnosis Site Audit

Find what’s actually wrong with your WordPress site, and know exactly what to fix.

WebDiagnosis Site Audit is the WordPress audit that tells you what to fix, not just another score or generic list of recommendations.

Run 170+ automated checks across 14 critical areas including SEO, security, performance, accessibility, WordPress configuration, eco-design, and more.

Every finding tells you what was detected, why it matters, how urgent it is, and how to fix it.

Stop auditing. Start fixing.

Most audit tools give you a score and leave you to figure out what it means.

WebDiagnosis turns 170+ checks into a clear, prioritized action plan.

• 170+ checks across 14 themes
• Clear severity: Blocker, Major, Minor
• No false alarms: unverified checks are reported as “Not verifiable”
• Actionable findings: every issue includes its impact and recommended fix
• Practical guidance: know what needs to change, who can do it, and how difficult it is

Built to be trusted

A score can tell you that something is wrong. A diagnosis tells you what to do next.

WebDiagnosis never guesses when the required data cannot be verified, and never turns a minor recommendation into an emergency.

The result: less time interpreting reports, more time fixing what actually matters.

One plugin. A complete website diagnosis.

Audit the dimensions that matter to modern WordPress websites:

• SEO & technical SEO
• Security
• Performance & Core Web Vitals
• Accessibility
• WordPress configuration
• Eco-design & sustainability
• And more

Know what matters. Fix what matters.

Other audit tools tell you how your website scores.
WebDiagnosis tells you what’s wrong and what to fix first.

External Services

This plugin connects to an external service to perform website diagnostics.

The plugin sends technical data about the site, never its posts, pages, comments or user
accounts. This data is sent only once you have accepted data sharing, and you can withdraw that
consent at any time from the plugin settings. Every request the plugin makes is listed below,
including the few it makes on its own.

Service name: WebDiagnosis
Service URL: https://webdiagnosis.io/en/

What the service is used for:
The service analyzes the WordPress website configuration and provides a diagnostic report with recommendations about performance, security and best practices.

What data is sent when a diagnostic runs:

• Site URL, WordPress version, language and main WordPress settings (debug mode, permalinks, file editing, automatic updates, XML-RPC)
• Server details: PHP and MySQL versions, PHP limits, disk space, database size, caching, cron and file permissions
• Installed plugins and themes, with their versions and update status
• Security settings: whether the security keys are set, whether an account named “admin” exists and its role (never its password or email address)
• The latest entries of the PHP error log: error type, message, line, and file path relative to the site root
• Names, sizes and paths of sensitive files found under the site root (backups, database dumps, private keys). Their content is never read nor sent
• Findings of a scan of the active theme’s code: file path, line and a short code excerpt for each finding
• Content statistics: number of images with or without alternative text, menu locations, presence of the default sample content
• How the diagnostic was started: from the plugin interface, the WP-CLI command, the REST endpoints or the Abilities API. The service uses it only for its usage statistics
• A random number generated for each diagnostic and kept on the site for one hour. During the diagnostic, the service calls the site back once, at /wp-json/webdiagnosis/v1/ownership, to check that the request really came from this site before running its security checks (login page, sensitive files). The site answers with a fingerprint of the service’s challenge, never with the number itself

When data is sent:

• When a diagnostic is explicitly requested: from the plugin interface, from the WP-CLI command, or through the plugin’s authenticated REST endpoints or the WordPress Abilities API.
• When a fatal PHP error occurs on the site, and only if data sharing is accepted: the error type and message, its file path relative to the site root, its line, the page URL, the time, and the PHP and WordPress versions, so that the site owner can be alerted. Errors that could not be sent at once are retried every hour.
• Once a day, and only if you have linked the plugin to a WebDiagnosis account with a subscription key: the site URL and that key, to keep the account status shown in the plugin up to date.
• When you request help from an expert or send feedback from the plugin: your name, your email address and your message, so that the WebDiagnosis team can answer you.
• When you accept data sharing, deactivate, reactivate or delete the plugin, and only if data sharing is accepted: the site URL, the plugin version and the event, so that the service knows whether the plugin is still in use.

Links to the service:
* Privacy policy: https://webdiagnosis.io/en/privacy-policy/
* Terms of service: https://webdiagnosis.io/en/terms-of-service/