Updates
Weight 3Outdated core, plugins and themes, PHP past its security-support date, and anything blocking automatic updates from landing.
- Core version
- Plugin versions
- Theme versions
- PHP support
- Auto-updates
- Update freshness
Free · Open source · WordPress 6.4+
Your whole site,
one number.
A free WordPress site audit that runs 32 checks across six areas and hands you a single health score out of 100 — with every problem ranked worst-first, explained in plain English, and backed by the evidence it found.
Install from WordPress.org
See what it checks
No account. No API key. Nothing to configure. Takes about ten seconds.
32CHECKS PER SCAN
6AREAS WEIGHTED
0EXTERNAL REQUESTS
FreeGPL-2.0-OR-LATER
86OUT OF 100
A few things worth tightening up when you have time.
Six areas measured · 18 issues found · 16 of 32 checks passed
Medium
Post revisions have built up2,867 post revisions are stored. These accumulate and enlarge the posts table.
Database
Medium
Active plugins have pending updates5 active plugins have updates available. Active plugin code runs on every request.
Updates
Low
Links with nothing for a screen reader to announce10 links have no text, no aria-label, and no described image inside.
AccessibilityWhat it checks
Six areas. Thirty-two checks.
Not everything matters equally, so the score does not pretend it does. An unpatched plugin counts for more than an unattached image — each area carries a weight in the final number.
Security & configuration
Weight 3The settings that quietly leave a site exposed — usually left at a default nobody revisited after launch.
- Authentication keys
- Debug mode
- Debug log location
- HTTPS
- Open registration
- File editor
- XML-RPC
- Admin usernames
- Version disclosure
Accessibility
Weight 3What a screen reader actually encounters on your published pages, sampled from real content rather than guessed at.
- Image alt attributes
- Empty links
- Heading structure
- Descriptive link text
Database
Weight 2The routine maintenance nobody remembers to do, and the bloat that slows every single request.
- Autoloaded options
- Post revisions
- Expired transients
- Orphaned metadata
SEO
Weight 2The handful of settings that can hide an entire site from Google — and usually do it silently.
- Search engine visibility
- robots.txt
- Permalink structure
- Site tagline
- XML sitemap
Media
Weight 1Images that went missing in a migration, originals nobody resized, and alt text never filled in.
- Files present on disk
- Image file sizes
- Library alt text
- Unattached media
Inside the plugin
Every area scored. Every check accounted for.
This is the dashboard itself, drawn live rather than screenshotted — the same figures a real scan produced, with the rings filling as you reach them.
85
Database
2 issues
80
Updates
5 issues
85
Config
6 issues
90
Media
2 issues
85
Accessibility
3 issues
100
SEO
5 checks passedWhat passed
Named, not just counted — so a clean area looks inspected rather than skippedDatabase
- Autoloaded options
- Expired transients
Updates
- WordPress core version
- Automatic updates
- Update data freshness
Security & configuration
- Authentication keys
- Debug mode
- Open registration
Media
- Image files present on disk
- Image file sizes
Accessibility
- Image alt attributes
SEO
- Search engine visibility
- robots.txt
- Permalink structure
- Site tagline
- XML sitemap
How the score works
Two rules make the number worth trusting.
A score is only useful if it moves for real reasons. These two decisions are why this one is not just another percentage with a colour on it.
01
What cannot be measured is never scored zero
If a check has no data source on your site, it is reported as not measured and excluded from the average entirely. Not having a particular plugin installed can never lower your score — which means nothing here is quietly upselling you something else.
02
Severity depends on where you are
Debug mode is a serious problem on a live site and completely normal on a developer's laptop. The plugin reads your environment type and scores accordingly, instead of nagging every local install about the same thing.
What it finds
The problems that never announce themselves.
None of these throw an error. Sites run for years with every one of them, which is precisely why nobody goes looking.
Autoloaded options bloat
Autoloaded options load on every single request, including ones nobody sees. Removed plugins routinely leave megabytes behind, and nothing in WordPress tells you.
Debug output on a live site
WP_DEBUG left on in production can print paths and query errors to visitors. It is the single most common thing found on a site that was "just launched quickly".
Authentication keys at their defaults
Salts and keys are meant to be unique per site. Copied wp-config files and bad migrations leave duplicates behind, and nobody ever checks.
PHP past its security support
Version numbers are not the point — support dates are. Plenty of sites run a PHP release that stopped receiving security fixes a long time ago.
Post revisions nobody pruned
Revisions accumulate quietly and enlarge the posts table indefinitely. Thousands of rows is normal on a site a few years old.
A site hidden from Google
The discourage-search-engines checkbox, a robots.txt blocking everything, plain permalinks, a missing sitemap. Any one of them can cost you every visitor.
Images with no alt text
Both an accessibility failure and a wasted SEO signal. It is invisible until somebody using a screen reader tries to read the page.
Images missing from disk
A migration that copied the database without the uploads folder leaves attachment records pointing at files that are not there.
Works with what you run
It doesn't replace your SEO or security plugin.
Those go deep in one area. Nothing was looking at the whole. Your SEO plugin does not tell you a plugin is three versions behind; your security plugin does not tell you half your images have no alt text; neither tells you which matters more this week.
- Reads Rank Math and YoastWhere either is installed, their analysis is folded into your score and clearly labelled so you always know where a finding came from. Where neither is present, nothing is missing.
- Never counts a missing plugin against youIt will not ask you to install something else in order to work, and will not quietly deduct points because you did not.
- Never modifies anythingEvery check only reads. It tells you what to fix and how, and never changes, deletes or "optimises" anything on your behalf.
- Makes no external requestsNot one, of any kind. No accounts, no API keys, no telemetry, no "anonymous usage data" — even the typeface on this page is embedded rather than fetched from Google Fonts.
- Causes no bloat of its ownScan history lives in its own table, never in autoloaded options. It would be a poor look to create the problem it scans other sites for.
Reporting
A document you can hand to a client.
Your latest scan opens as a printable report: a plain-English summary of what the score means, then every finding with its fix and the evidence behind it. Save it as a PDF straight from the browser — no PDF library is bundled, so the result is selectable text rather than a picture of text.
Honest limits
What it cannot tell you.
Real-world page speed and Core Web Vitals cannot be measured from inside your own server, and neither can malware. Anything claiming otherwise from a plugin running on your site is guessing at it.
So this does not pretend to. It measures what it can verify and says plainly when it cannot — which is also why your score can read 100 while something is still wrong. A number you can trust is worth more than a number that flatters you.
Questions
Frequently asked.
Is Guru Site Health really free?
Yes. It is licensed GPL-2.0-or-later and distributed through the WordPress plugin directory. There is no paid tier, no trial, no account, and no feature held back behind an upgrade.
How is this different from WordPress's built-in Site Health?
Core's Site Health screen runs pass/fail tests and leaves you to decide which of them matter. This runs a weighted audit across six areas, reduces it to one number, and keeps a history of that number — so you can see whether last month's maintenance actually improved anything. Core tells you what is true right now; this tells you what changed and what to do next. It also reads Rank Math or Yoast where installed, which core does not.
Do I need Rank Math or Yoast for the SEO checks?
No. The SEO checks run on every site regardless. If one of those plugins is installed, its per-post analysis is additionally folded in and clearly labelled with where it came from.
Does it send my data anywhere?
No. It makes no external HTTP requests whatsoever — no accounts, no API keys, no telemetry, no analytics, no "anonymous usage data". Every scan runs on your server and every result is stored in your own database. The only email it sends goes to an address you choose, through your own site's mail configuration.
Will it change anything on my site?
No, and that is deliberate. Every check only reads. It tells you what to fix and how, and never modifies, deletes or optimises anything on your behalf. The only rows it ever writes are its own scan results, in its own table.
Will it slow my site down or bloat the database?
No. Scan history lives in a dedicated table rather than in autoloaded options, so it never loads on front-end requests. It keeps the last 100 detailed scans by default — adjustable from 10 to 2000 — and prunes older ones automatically. Long-term score history is kept separately in a much smaller table, so the trend survives even after the detail behind old scans is pruned.
Can it detect malware or measure page speed?
No, and it will not pretend to. Malware detection needs constantly-updated threat databases, and real-world page speed and Core Web Vitals can only be measured from outside your server. Both are jobs for dedicated tools built to do them properly.
Can I run scans automatically?
Yes, and it is on by default. Choose hourly, twice daily, daily or weekly. Email alerts arrive only when something genuinely regresses — a new high-severity problem or a real drop in score — because a daily "still fine" email is a daily email you learn to ignore. Note that WordPress's scheduler only runs when your site receives traffic, so a very quiet site may see scans run late.
Does it work on multisite?
Scans run per site and correctly account for network-activated plugins. A central network-wide dashboard is planned for a later release.
What are the requirements?
WordPress 6.4 or newer and PHP 8.1 or newer. On an older PHP version the plugin shows a notice and deactivates itself rather than breaking your site.
Run one scan. See where you stand.
About ten seconds, reads only, and nothing on your site is changed.