{"id":389235,"date":"2026-10-19T17:42:51","date_gmt":"2026-10-19T17:42:51","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/tibacheck-site-audit\/"},"modified":"2026-10-23T23:03:00","modified_gmt":"2026-10-23T23:03:00","slug":"tibacheck-site-audit","status":"publish","type":"plugin","link":"https:\/\/te.wordpress.org\/plugins\/tibacheck-site-audit\/","author":23588913,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"0.15.3","stable_tag":"0.15.3","tested":"7.1.4","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"TibaCheck \u2014 Site Audit","header_author":"Geoffrey Juma","header_description":"One-click site health and security audit: outdated software, PHP version, inactive plugins, and more. Know what's wrong before it breaks.","assets_banners_color":"004b58","last_updated":"2026-10-23 23:03:00","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":222,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"0.12.1":{"tag":"0.12.1","author":"omwamij","date":"2026-10-19 17:42:28","revision":3755283},"0.13.2":{"tag":"0.13.2","author":"omwamij","date":"2026-10-20 23:05:00","revision":3757544},"0.15.3":{"tag":"0.15.3","author":"omwamij","date":"2026-10-23 23:03:00","revision":3762565}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3755345,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3755345,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3755345,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3755345,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.12.1","0.13.2","0.15.3"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3755336,"resolution":"1","location":"assets","locale":"","width":2396,"height":914},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3755336,"resolution":"2","location":"assets","locale":"","width":2424,"height":1245},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3755336,"resolution":"3","location":"assets","locale":"","width":2410,"height":1176},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3755336,"resolution":"4","location":"assets","locale":"","width":595,"height":1242}},"screenshots":{"1":"One-click audit results with color-coded status pills and a summary bar \u2014 passing, needs attention, and failing at a glance."}},"plugin_section":[],"plugin_tags":[8533,287560,600,151481,2550],"plugin_category":[54],"plugin_contributors":[287561],"plugin_business_model":[],"class_list":["post-389235","plugin","type-plugin","status-publish","hentry","plugin_tags-audit","plugin_tags-owasp","plugin_tags-security","plugin_tags-site-health","plugin_tags-updates","plugin_category-security-and-spam-protection","plugin_contributors-omwamij","plugin_committers-omwamij"],"banners":{"banner":"https:\/\/ps.w.org\/tibacheck-site-audit\/assets\/banner-772x250.png?rev=3755345","banner_2x":"https:\/\/ps.w.org\/tibacheck-site-audit\/assets\/banner-1544x500.png?rev=3755345","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/tibacheck-site-audit\/assets\/icon-128x128.png?rev=3755345","icon_2x":"https:\/\/ps.w.org\/tibacheck-site-audit\/assets\/icon-256x256.png?rev=3755345","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/tibacheck-site-audit\/assets\/screenshot-1.png?rev=3755336","caption":"One-click audit results with color-coded status pills and a summary bar \u2014 passing, needs attention, and failing at a glance."},{"src":"https:\/\/ps.w.org\/tibacheck-site-audit\/assets\/screenshot-2.png?rev=3755336","caption":""},{"src":"https:\/\/ps.w.org\/tibacheck-site-audit\/assets\/screenshot-3.png?rev=3755336","caption":""},{"src":"https:\/\/ps.w.org\/tibacheck-site-audit\/assets\/screenshot-4.png?rev=3755336","caption":""}],"raw_content":"<!--section=description-->\n<p>TibaCheck runs a read-only audit of your site's configuration and shows you, in plain language, what needs attention. Every report leads with two scores \u2014 a <strong>Site Health Score<\/strong> and a <strong>Security Score<\/strong> built from checks mapped to the <strong>OWASP Top 10 (2025)<\/strong> \u2014 with a full OWASP coverage table showing what was assessed and what needs an external deep scan:<\/p>\n\n<ul>\n<li><strong>Software updates<\/strong> \u2014 pending WordPress core, plugin, and theme updates (outdated software is the #1 way sites get hacked)<\/li>\n<li><strong>PHP version<\/strong> \u2014 whether your PHP is supported, outdated, or end-of-life<\/li>\n<li><strong>PHP critical security update<\/strong> \u2014 whether the PHP version actually running the site is affected by the October 2026 PHP security advisory (CVE-2026-109618 and CVE-2026-109619, critical unauthenticated remote code execution vulnerabilities with active exploitation reported), naming the patched release for your PHP branch (8.2.35, 8.3.36, 8.4.27 or 8.5.12)<\/li>\n<li><strong>Inactive plugins &amp; themes<\/strong> \u2014 unused code sitting on your site is a favorite hiding spot for malware<\/li>\n<li><strong>Backup status<\/strong> \u2014 whether we can confirm this site is backed up at all<\/li>\n<li><strong>User accounts<\/strong> \u2014 every administrator listed by name after each scan, plus a hidden-account test that catches backdoor users invisible to WordPress<\/li>\n<li><strong>Registration safety<\/strong> \u2014 open registration paired with a powerful default role is an open door; we flag it<\/li>\n<li><strong>File editor<\/strong> \u2014 whether the wp-admin theme\/plugin editor (one stolen password away from code execution) is disabled<\/li>\n<li><strong>Debug display<\/strong> \u2014 whether PHP errors are being shown to visitors, leaking server internals<\/li>\n<li><strong>Search visibility<\/strong> \u2014 whether the site is accidentally telling Google to stay away<\/li>\n<li><strong>SSL \/ HTTPS<\/strong> \u2014 whether both site URLs are actually configured for encrypted traffic<\/li>\n<li><strong>Permalinks<\/strong> \u2014 whether links are readable and search-friendly, or the plain <code>?p=123<\/code> default<\/li>\n<li><strong>Autoload size<\/strong> \u2014 how much data loads on every page view, with the biggest offenders named; bloat here is the #1 silent slowdown<\/li>\n<li><strong>Cron health<\/strong> \u2014 whether scheduled tasks (updates, backups, posts) are actually firing, or silently stalled<\/li>\n<li><strong>Comment queues<\/strong> \u2014 spam and unmoderated comments piling up in the database<\/li>\n<li><strong>PHP extensions<\/strong> \u2014 whether the extensions WordPress relies on for updates, images, and encryption are present<\/li>\n<\/ul>\n\n<p>Plus the <strong>Persistence Pack<\/strong> \u2014 the backdoor hunt most audits skip entirely:<\/p>\n\n<ul>\n<li><strong>Privilege audit<\/strong> \u2014 accounts whose real power exceeds their role label (a \"Subscriber\" who can actually run the site)<\/li>\n<li><strong>Must-use plugins &amp; drop-ins<\/strong> \u2014 code that runs on every request but never appears in your plugin list, listed by name; files matching names commonly installed by WordPress, hosts, or caching tools are called out separately from names we cannot recognize<\/li>\n<li><strong>Database triggers<\/strong> \u2014 triggers on account tables can silently recreate a deleted backdoor; we inspect the schema<\/li>\n<li><strong>Cron job origins<\/strong> \u2014 scheduled tasks that trace to neither core nor any installed plugin or theme are how cleaned infections return<\/li>\n<li><strong>Code in uploads<\/strong> \u2014 executable files inside the media folder, where only images and documents belong<\/li>\n<li><strong>Server prepend directives<\/strong> \u2014 auto_prepend_file \/ auto_append_file run code before WordPress even loads; we show you if they're set<\/li>\n<li><strong>File permissions<\/strong> \u2014 wp-config.php and the code folders (site root, wp-includes, wp-content, plugins, themes) fail the check if any account on the server can rewrite them; a world-writable uploads folder warns. Only the world-writable setting is graded \u2014 owner and group permissions differ legitimately between hosts, so they are not judged<\/li>\n<li><strong>Application passwords<\/strong> \u2014 an inventory of the standing credentials that bypass your login screen, with the oldest one's age<\/li>\n<\/ul>\n\n<p>Plus the <strong>WooCommerce store pack<\/strong> \u2014 four more checks that appear only when WooCommerce is active, so they never clutter a non-store report. A store that cannot take payment is down in the only way that matters, and these are what a care plan watches on a store every month:<\/p>\n\n<ul>\n<li><strong>Store pages<\/strong> \u2014 the Checkout page must be assigned and published or customers cannot buy at all (the check fails when it is not); the Cart, Shop, and My Account pages are checked too and warn when broken<\/li>\n<li><strong>Payment gateways<\/strong> \u2014 at least one gateway must be switched on, read from WooCommerce's own gateway registry so extension gateways count exactly like built-in ones; up to four enabled ones are named<\/li>\n<li><strong>Store details<\/strong> \u2014 store currency, base country, and street address, the details taxes, shipping, and invoices are calculated from (a currency or country that was never set is flagged with the default WooCommerce silently uses instead)<\/li>\n<li><strong>Checkout posture<\/strong> \u2014 the silent sales leak: guest checkout off, no account creation during checkout, <em>and<\/em> registration closed on the My Account page too, so only existing account holders can buy. Checkout encryption itself is graded once, by the SSL \/ HTTPS check, and cross-referenced here \u2014 never double-counted<\/li>\n<\/ul>\n\n<p>Every report also carries a <strong>Plugins Review<\/strong> section: every installed plugin grouped by the job it does \u2014 backups, security, SEO, speed, forms, builders, store, analytics, spam, media, email, languages, utilities \u2014 each with a one-line purpose and its active\/inactive state. When two or more <em>active<\/em> plugins share a job, the group is flagged <strong>repetitive<\/strong> and a Plugin Overlap check warns: duplicates conflict, slow the site, and double what you must keep updated. Plugins we don't recognize are listed honestly as \"not yet categorized\" \u2014 we never guess what a plugin does.<\/p>\n\n<p>Every report can also be opened as a <strong>printable client report<\/strong>: a branded document with the score cards, every check and its detail, and the plugin and OWASP coverage summaries \u2014 ready to print or save as a PDF for a client. It is generated fresh when opened; the plugin stores no full report (only scores, statuses, and time).<\/p>\n\n<p><strong>The Watch<\/strong> keeps an eye on the site between visits: once a week, TibaCheck quietly re-runs the same read-only audit on its own (using WordPress's built-in scheduler \u2014 no external calls, nothing phones home). If a check gets worse than the last audit, or the health score drops by 10 points or more, a notice appears in wp-admin naming what changed. A manual audit run answers the notice; improving checks never raise one, and each weekly run reconciles an unanswered notice \u2014 problems that recovered drop off it, problems still active stay on it. Deactivating the plugin stops the Watch and discards any pending notice (on a multisite network, deactivate on the site itself to clear that site's Watch).<\/p>\n\n<p>A note on honesty: TibaCheck does not claim to \"scan for malware\" the way signature scanners do \u2014 signatures miss modern, per-site malware, and a scanner runs inside the very environment an infection can hide from. What it does is audit the places malware <em>must<\/em> live, persist, and act: its hiding spots, its survival tricks, and the accounts it needs. Those it finds, it names.<\/p>\n\n<p>More checks are on the roadmap: deeper performance profiling.<\/p>\n\n<p>TibaCheck never changes your site's content or settings \u2014 it reports. The only thing it saves is its own last report (scores and statuses, in its own settings), any pending Watch change alert, and the time of the last automatic Watch run, so your next scan can show whether your scores are rising or falling. Fixing is up to you, or the care-plan team that handles it every month.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin files to <code>\/wp-content\/plugins\/tibacheck-site-audit<\/code>, or install through the WordPress plugins screen.<\/li>\n<li>Activate the plugin.<\/li>\n<li>Go to Tools \u2192 Site Audit and click <strong>Run Audit<\/strong>.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20the%20audit%20change%20anything%20on%20my%20site%3F\"><h3>Does the audit change anything on my site?<\/h3><\/dt>\n<dd><p>No. Every check is read-only \u2014 TibaCheck never updates, deletes, or modifies your site. It stores only its own last report (scores and check statuses), any pending Watch change alert, and the time of the last automatic Watch run, so it can show your trend on the next run.<\/p><\/dd>\n<dt id=\"is%20the%20owasp%20score%20a%20certification%3F\"><h3>Is the OWASP score a certification?<\/h3><\/dt>\n<dd><p>No. The Security check score maps this plugin's checks to the OWASP Top 10 (2025) categories they assess, and the coverage table labels every mapped category as partial. A passing check does not establish category-wide security. Injection, insecure design and logging\/alerting remain unassessed. The score is a TibaCheck heuristic, not an OWASP certification, and is withheld when mapped evidence is incomplete. Separate code, architecture or dynamic assessment is required.<\/p><\/dd>\n<dt id=\"what%20do%20the%20statuses%20mean%3F\"><h3>What do the statuses mean?<\/h3><\/dt>\n<dd><p><strong>Pass<\/strong> \u2014 healthy. <strong>Warn<\/strong> \u2014 should be fixed soon. <strong>Fail<\/strong> \u2014 fix now; this is how sites get hacked or break.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>0.15.3<\/h4>\n\n<ul>\n<li>The <strong>PHP critical security update<\/strong> check now gives the threat its name \u2014 <strong>php2shell<\/strong> (CVE-2026-109618 \/ CVE-2026-109619) \u2014 in both its passing and failing results, and spells out what staying unpatched means: an unauthenticated attacker executing code as the web-server user before WordPress loads, leading to webshell installation, full site takeover, and theft of database credentials and site data, with attack attempts already observed in the wild. PHP 8.1 and older results add CISA's guidance (patch immediately, or take the system offline \/ move to a supported branch); results on Apache mod_php carry a highest-risk note, because the demonstrated exploit path runs pre-authentication on that setup; and the fix text lists interim mitigations \u2014 disable session upload progress, apply WAF rules \u2014 labelled honestly as exposure reduction, not a fix, plus a reminder to check for existing compromise after patching. Detection and grading are unchanged.<\/li>\n<\/ul>\n\n<h4>0.15.2<\/h4>\n\n<ul>\n<li>Fixed: the <strong>File permissions<\/strong> check could lose part of its message \u2014 when a code-folder failure coincided with a wp-config.php that could not be located and paths that could not be read, only one of the two cautions was reported. Both cautions are now always shown; grading and evidence-completeness behaviour are unchanged.<\/li>\n<li>The File permissions check is now covered by a committed test harness that runs both the free and bundled copies of the check against real filesystem fixtures, including the combined-caution case above.<\/li>\n<\/ul>\n\n<h4>0.15.1<\/h4>\n\n<ul>\n<li>Fixed: the <strong>Code in uploads<\/strong> check could create the uploads folder on a site that did not have one yet (or the current year\/month subfolder inside an existing one) \u2014 resolving the uploads path used WordPress's default, which creates the directory as a side effect. The check is read-only; it now resolves the path without creating anything, exactly as the File permissions check already did. No results change on sites that already have an uploads folder. (This closes the deferral recorded in the 0.14.0 review.)<\/li>\n<li>Fixed: the audit page header and the printable client report's scope paragraph said the audit runs twenty-four checks; since 0.15.0 it runs twenty-five (twenty-nine on a WooCommerce store). Both texts now agree with the readme and the check registry.<\/li>\n<\/ul>\n\n<h4>0.15.0<\/h4>\n\n<ul>\n<li>NEW: <strong>PHP critical security update<\/strong> check (Security Scan, OWASP A03) \u2014 grades the PHP version actually running the site against the October 2026 PHP security advisory: CVE-2026-109618 and CVE-2026-109619, two critical (CVSS v4.0 9.2) unauthenticated remote code execution vulnerabilities with active exploitation reported. It fails below the patched release for the site's branch (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35) and on PHP 8.1 and older, which receive no fixes from the PHP project (the check explains how to confirm a host\/distribution backport, and that a version string alone cannot prove one). The PHP 8.2 pass carries the branch's 31 Dec 2026 end-of-life note, and every outcome reminds the owner that updating PHP packages without restarting PHP-FPM\/Apache leaves the old version serving requests.<\/li>\n<li>NEW: <strong>File permissions<\/strong> check \u2014 wp-config.php and the\ncode folders (site root, wp-includes, wp-content, plugins,\nthemes) FAIL when they are world-writable (any account on\nthe server can rewrite them, including the file holding the\ndatabase password); a world-writable uploads folder warns.\nOnly the world-writable setting is graded: owner and group\npermissions are not judged, because legitimate hosting\nmodels differ. A wp-config.php that cannot be located in\neither place WordPress looks reports \"could not confirm\"\ninstead of passing. The audit now runs twenty-five checks,\ntwenty-nine on a WooCommerce store.<\/li>\n<\/ul>\n\n<h4>0.13.2<\/h4>\n\n<ul>\n<li>Coverage correction: the debug display check now maps to OWASP A10:2025 \u2014 Mishandling of Exceptional Conditions (error output shown to visitors is an error-handling failure). Assessed coverage is now 7 of 10 categories; A02 keeps the file editor, uploads code and prepend directive checks.<\/li>\n<li>Fixed the wordpress.org short description being truncated (now within the 150-character limit).<\/li>\n<\/ul>\n\n<h4>0.13.1<\/h4>\n\n<ul>\n<li>Reports use OWASP Top 10:2025 with partial coverage labels, explicit unassessed risks and evidence-completeness safeguards.<\/li>\n<li>Missing or unavailable mapped evidence withholds the security check score; model-versioned snapshots avoid incompatible historical score comparisons.<\/li>\n<li>The printable client report now shares the dashboard coverage table.<\/li>\n<\/ul>\n\n<h4>0.13.0<\/h4>\n\n<ul>\n<li>NEW: the <strong>WooCommerce store pack<\/strong> \u2014 four checks that run\nonly when WooCommerce is active (on any other site they do\nnot appear at all): <strong>Store pages<\/strong> (Cart\/Checkout assigned\nand published, or the store cannot sell \u2014 plus Shop and\nMy Account), <strong>Payment gateways<\/strong> (at least one gateway\nswitched on, read from WooCommerce's own registry so\nextension gateways count; up to four enabled gateways are\nnamed, and an unreadable registry reports \"could not\nconfirm\" instead of guessing), <strong>Store details<\/strong> (currency,\nbase country, and street address \u2014 what taxes, shipping,\nand invoices are calculated from), and <strong>Checkout posture<\/strong>\n(the guest-checkout\/account-creation\/registration\ncombination that silently locks out new customers;\ncheckout encryption stays graded once, by the SSL check).\nThe\naudit now runs twenty-three checks, twenty-seven on a\nWooCommerce store.<\/li>\n<li>Hidden client reports now set their WordPress admin page titles before the header renders, avoiding blank titles and PHP deprecations.<\/li>\n<li>Missing or malformed update data for any component now remains unknown rather than producing an all-current result; known pending updates remain visible.<\/li>\n<\/ul>\n\n<h4>0.12.1<\/h4>\n\n<ul>\n<li>Fixed (verification re-review of 0.12.0): the Watch notice's\nscore arrow could understate a fresh drop. If the score rose\nwhile a notice was open and then dropped 10+ from that higher\npoint, the arrow still started from the notice's original\nscore (an 11-point drop rendered as \"85 \u2192 84\"). The arrow now\nstarts from the score the current drop is measured against.<\/li>\n<\/ul>\n\n<h4>0.12.0<\/h4>\n\n<ul>\n<li>NEW: <strong>The Watch<\/strong> \u2014 TibaCheck now re-runs its read-only audit\nautomatically once a week (WordPress's built-in scheduler; no\nexternal requests). When a check gets worse than the previous\naudit (manual or automatic), or the health score drops by 10\npoints or more, an admin notice names what changed. With no\nprevious audit, the first run just sets the baseline. Manual\nruns clear the notice; deactivation stops the Watch.<\/li>\n<li>Fixed: the plugin version constant had drifted from the\nrelease version (it still read 0.9.3 at 0.11.1). Header,\nconstant, and Stable tag are back in agreement.<\/li>\n<\/ul>\n\n<h4>0.11.1<\/h4>\n\n<ul>\n<li>Plugins Review catalog: TibaCheck Pro is now categorized\n(security, scanner role) instead of Not yet categorized,\nand TibaCheck itself moves from Utilities to Security\n(audit role). Catalog: 169 entries.<\/li>\n<li>Fixed a role-model defect the catalog review exposed: the\nsecurity category default role reused the bundle exemption\ntoken, so two firewall suites could never be flagged as\noverlapping. They now can; layered sub-jobs (firewall +\ntwo-factor + audit + scanner) still do not flag.<\/li>\n<\/ul>\n\n<h4>0.11.0<\/h4>\n\n<ul>\n<li>Client report restyled as a formal audit document: serif\ndisplay type, document-control meta table, numbered\nsections, attestation footer. Same design family as the\npaid report; content and claims unchanged.<\/li>\n<\/ul>\n\n<h4>0.10.3<\/h4>\n\n<ul>\n<li>Client report design refresh: typography scale, grid summary\ncards, styled tables. Same design language as the paid report.<\/li>\n<\/ul>\n\n<h4>0.10.2<\/h4>\n\n<ul>\n<li>The client report gains a Back to Site Audit button.<\/li>\n<\/ul>\n\n<h4>0.10.1<\/h4>\n\n<ul>\n<li>Author name aligned to Geoffrey Juma across both plugins.<\/li>\n<\/ul>\n\n<h4>0.10.0<\/h4>\n\n<ul>\n<li>NEW: printable client report. A branded document (score\ncards, every check with its detail, plugin and OWASP coverage\nsummaries) opens from the audit page and prints or saves to\nPDF cleanly. It runs the same read-only audit fresh when\nopened \u2014 consistent with the plugin's storage disclosure,\nno full report is stored.<\/li>\n<\/ul>\n\n<h4>0.9.3<\/h4>\n\n<ul>\n<li>Fixed (from a real Plugin Check run on a live site): the Plugin overlap message used unordered translation placeholders (numbered now), and the Application passwords lookup no longer uses a meta_query \u2014 it reads the indexed usermeta table directly, with a \"cannot confirm\" state if the database does not answer. That run's only other outcome was the proof we wanted: <strong>zero findings on every direct database query<\/strong> in the plugin, Persistence Pack included.<\/li>\n<\/ul>\n\n<h4>0.9.2<\/h4>\n\n<ul>\n<li>Catalog accuracy audit (independent review, per the rule that we classify only what we can verify): TibaCheck now <strong>knows itself<\/strong> \u2014 it, Plugin Check, and Essential Addons for Elementor (plus its sibling add-on packs) are cataloged, so they no longer land in \"Not yet categorized.\" Corrections from the audit: a dead Asset CleanUp key fixed to its real folder name; a phantom Solid Security key replaced with the real Pro\/current folders; the Matomo connector is no longer misdescribed as self-hosted analytics, and Matomo Analytics itself was added; backup tools and one-shot migration tools no longer count as the same job; media library\/slider and membership\/profile pairings split so deliberate combinations do not false-flag; block libraries are exempt from overlap (additive by design); two purposes reworded to drop stale or marketing claims \u2014 including our own (\"saves nothing but its own last report,\" matching the readme disclosure).<\/li>\n<\/ul>\n\n<h4>0.9.1<\/h4>\n\n<ul>\n<li>Fixed (independent review of 0.9.0): Plugin overlap now judges by <strong>job = category + role<\/strong>, so layered stacks and components no longer false-flag: a firewall plus two-factor plus a login limiter is one security posture; a store plus its payment gateways is one store; add-ons (Elementor Pro) and suites (Jetpack) never count as duplicates; the utilities drawer is no longer judged at all. The PASS message now claims only what was actually judged (recognized active plugins), and if no active plugin is recognized the check says \"could not be judged\" instead of passing. Must-use plugins: the name-only caveat moved into the result message itself, the generic <code>mu-plugin.php<\/code> name no longer counts as recognized, and recognized files are listed with their on-disk filenames.<\/li>\n<\/ul>\n\n<h4>0.9.0<\/h4>\n\n<ul>\n<li>New: a <strong>Plugins Review<\/strong> section in every report \u2014 every installed plugin grouped by the job it does (backups, security, SEO, speed, forms, builders, store, analytics, spam, media, email, languages, utilities) with a one-line purpose and active\/inactive state, from a curated local catalog of 150+ well-known plugins. A new <strong>Plugin overlap<\/strong> check (the audit now runs twenty-three checks) flags repetitive plugins: two or more ACTIVE plugins doing the same job, named. Plugins we do not recognize are listed as \"not yet categorized\" \u2014 never guessed at.<\/li>\n<li>Improved: <strong>Must-use plugins &amp; drop-ins<\/strong> no longer warns on every managed-hosting site. Files are now matched by name against the drop-ins WordPress core itself defines plus the loader files major managed hosts install (Bluehost\/Endurance, GoDaddy, Kinsta, Pantheon, WP Engine's loader): when everything present is recognized, the check passes and lists the names \u2014 with the plain caveat that matching is by file name, not contents, so a familiar name is not proof a file is genuine. Anything unrecognized still warns and is named separately, so nothing is hidden. (The refinement recorded by the 0.8.0 independent review.)<\/li>\n<\/ul>\n\n<h4>0.8.1<\/h4>\n\n<ul>\n<li>Fixed (independent review of the Persistence Pack): Cron job origins now recognizes major plugins whose hook prefixes differ from their folder names (Yoast, MonsterInsights, Bluehost, UpdraftPlus, and dozens more) and words its findings as \"could not match\" instead of overclaiming; Database triggers can no longer report a silent all-clear when the database user lacks trigger visibility (privilege probe + Plugin Check annotations added); Code in uploads now stops at its safety cap and reports partial scans honestly instead of passing; Privilege audit fetches and caches users in bulk (no per-account query storm on large sites).<\/li>\n<\/ul>\n\n<h4>0.8.0<\/h4>\n\n<ul>\n<li>New: the <strong>Persistence Pack<\/strong> \u2014 seven checks that hunt how malware survives, not just how it gets in: <strong>Privilege audit<\/strong> (power vs. role labels), <strong>Must-use plugins &amp; drop-ins<\/strong> census, <strong>Database triggers<\/strong> inspection, <strong>Cron job origins<\/strong>, <strong>Code in uploads<\/strong>, <strong>Server prepend directives<\/strong>, and <strong>Application passwords<\/strong> inventory. The audit now runs twenty-two checks, and the OWASP coverage grows to six of ten categories (A07 Authentication and A08 Integrity now assessed). Includes an honesty note on what in-plugin detection can and cannot prove.<\/li>\n<\/ul>\n\n<h4>0.7.3<\/h4>\n\n<ul>\n<li>Internal: code-comment precision and an explicit date-parse guard in the User accounts check (independent review). No behavior change.<\/li>\n<\/ul>\n\n<h4>0.7.2<\/h4>\n\n<ul>\n<li>Smarter User accounts check: on a site whose oldest admin account is itself under 30 days old, new admin accounts are the founders \u2014 the check now passes with a note to eyeball the names instead of raising a false alarm. On older sites a fresh admin account still warns, exactly as before.<\/li>\n<\/ul>\n\n<h4>0.7.1<\/h4>\n\n<ul>\n<li>Fixed (independent review): printing the report now includes both tabs \u2014 the hidden tab no longer vanishes from printouts; keyboard focus is visible on the tab controls.<\/li>\n<\/ul>\n\n<h4>0.7.0<\/h4>\n\n<ul>\n<li>Improved: the report is now tabbed \u2014 <strong>Health Check<\/strong> and <strong>Security Scan<\/strong> (OWASP-mapped checks plus the Top 10 coverage table) \u2014 so a fifteen-check report reads in two short views, with attention badges on each tab.<\/li>\n<\/ul>\n\n<h4>0.6.1<\/h4>\n\n<ul>\n<li>Robustness: malformed check results now surface as a visible warning instead of vanishing; score engine hardened against unexpected statuses. (Independent review polish \u2014 no behavior change.)<\/li>\n<\/ul>\n\n<h4>0.6.0<\/h4>\n\n<ul>\n<li>New: <strong>Site Health Score<\/strong> and <strong>OWASP Security Score<\/strong> headline every report, with score trends versus your previous run.<\/li>\n<li>New: <strong>OWASP Top 10 (2021) coverage table<\/strong> \u2014 each category shows its assessed status and basis, or is honestly marked \"not assessed\" (those need an external deep scan).<\/li>\n<li>Fixed (independent review): the hidden-account test no longer false-alarms on multisite; audit queries are deliberately uncached so a re-run always shows the current truth; the runner now survives PHP Errors, not just Exceptions; the updates check reports \"unknown\" instead of a false PASS when WordPress has never checked; registration grading follows the network setting on multisite; PHP grades now treat 7.4\u20138.0 as end-of-life; several accuracy and translation fixes.<\/li>\n<\/ul>\n\n<h4>0.5.2<\/h4>\n\n<ul>\n<li>Fixed: the three read-only aggregate queries (user count, autoload size) are now wrapped in a short-lived object cache, per WordPress coding standards \u2014 Plugin Check runs fully clean again.<\/li>\n<\/ul>\n\n<h4>0.5.1<\/h4>\n\n<ul>\n<li>Improved: results are now ordered by severity \u2014 failures first, then warnings, then passes \u2014 so the report reads in fix-it order.<\/li>\n<li>Fixed: autoload size now counts the newer WordPress autoload values ('on'\/'auto', WP 6.6+) as well as the classic 'yes', so the total is no longer understated.<\/li>\n<\/ul>\n\n<h4>0.5.0<\/h4>\n\n<ul>\n<li>Four new checks: <strong>Autoload size<\/strong> (names the biggest offenders), <strong>Cron health<\/strong> (catches silently stalled scheduled tasks), <strong>Comment queues<\/strong> (spam pile-up), and <strong>PHP extensions<\/strong>. The audit now runs fifteen checks.<\/li>\n<\/ul>\n\n<h4>0.4.0<\/h4>\n\n<ul>\n<li>Six new checks, each chosen because it is something a care plan watches monthly: <strong>Registration safety<\/strong> (FAILs on open registration with an Administrator default role), <strong>File editor<\/strong>, <strong>Debug display<\/strong>, <strong>Search visibility<\/strong>, <strong>SSL \/ HTTPS<\/strong>, and <strong>Permalafety<\/strong> (FAILs on open registration with an Administrator default role), <strong>File editor<\/strong>, <strong>Debug display<\/strong>, <strong>Search visibility<\/strong>, <strong>SSL \/ HTTPS<\/strong>, and <strong>Permalinks<\/strong>. The audit now runs eleven checks.<\/li>\n<\/ul>\n\n<h4>0.3.0<\/h4>\n\n<ul>\n<li>New check: <strong>User accounts<\/strong> \u2014 lists every administrator by name after each scan, flags admins named \"admin\", brand-new admin accounts, and long admin lists, and fails loudly if the database holds users that WordPress queries cannot see (the hidden-backdoor pattern).<\/li>\n<\/ul>\n\n<h4>0.2.3<\/h4>\n\n<ul>\n<li>Improved: header polish \u2014 the brand line \"Know what's wrong before it breaks\" now leads the page, with a larger title, bigger logo, and a cleaner divider.<\/li>\n<\/ul>\n\n<h4>0.2.2<\/h4>\n\n<ul>\n<li>Improved: branded report header with the TibaCheck logo, the results table in a rounded card, and the care-plan message presented as a proper callout panel.<\/li>\n<\/ul>\n\n<h4>0.2.1<\/h4>\n\n<ul>\n<li>Improved: color-coded results \u2014 green\/amber\/red status pills, colored summary bar (passing \/ needs attention \/ failing), and bold statuses so the report reads at a glance.<\/li>\n<\/ul>\n\n<h4>0.2.0<\/h4>\n\n<ul>\n<li>New: inactive plugins &amp; themes check (unused code is attacker territory).<\/li>\n<li>New: backup status check (honest heuristic \u2014 warns when no backup tool is detected).<\/li>\n<li>Fixed: child-theme parents no longer miscounted as inactive themes.<\/li>\n<\/ul>\n\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>Initial release: software-updates check and PHP-version check, Tools \u2192 Site Audit page.<\/li>\n<\/ul>","raw_excerpt":"One-click security &amp; health audit: OWASP-mapped scores, hidden-account and plugin reviews, 25 read-only checks, plus a WooCommerce store pack.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/te.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/389235","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/te.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/te.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/te.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=389235"}],"author":[{"embeddable":true,"href":"https:\/\/te.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/omwamij"}],"wp:attachment":[{"href":"https:\/\/te.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=389235"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/te.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=389235"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/te.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=389235"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/te.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=389235"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/te.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=389235"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/te.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=389235"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}