Technical Site Auditor

Changelog

3.2.0

A feature release focused on making cleanups reversible, keeping the plugin off your front end, and adding checks people actually asked for. Tested with WordPress 7.1 and PHP 8.4.

New

• Added: Database cleanups can now be undone. Spam, trash, revisions, transients, orphaned metadata, auto-drafts and removed scheduled events are backed up row by row before deletion and can be restored from the Fixes page for 30 days (very large runs that exceed the backup limit are reported honestly as permanent)
• Added: The plugin no longer loads its admin and scanning code on visitor requests. A normal page view now loads only the handful of files belonging to the fixes you actually switched on, which cut what the plugin contributes to a front-end request by around 97%
• Added: Plugin Hygiene check – finds installed plugins that have been closed or removed from WordPress.org, abandoned for years, untested with recent WordPress versions, overdue for updates, or in conflict with your PHP/WordPress version
• Added: Email alerts when an installed plugin’s status changes – closed, removed or newly abandoned – so you hear about it without watching the report (Premium, and switchable under Settings)
• Added: AI Visibility check – see which AI crawlers your robots.txt allows, blocks or does not mention, plus an optional llms.txt generator
• Added: Security checks for open registration with elevated default roles, PHP execution in the uploads directory and wp-config.php file permissions
• Added: Search engine indexing check – catches the “Discourage search engines” setting left on after launch, with a one-click fix
• Added: Email deliverability check (SPF and DMARC DNS records)
• Added: WooCommerce REST API security – unauthenticated API access, the legacy REST API, unused write-capable API keys and webhooks delivering over plain http
• Added: Schema checks for duplicate markup from two sources, missing product identifiers and broken @id references
• Added: Duplicate sitemap detection when an SEO plugin and the WordPress core sitemap both respond
• Added: Action Scheduler bloat check for large stores
• Added: New one-click fixes – block PHP execution in uploads, enable indexing, disable the duplicate core sitemap, disable attachment pages, limit future post revisions, and a CSP upgrade-insecure-requests header
• Added: Setting for excluding specific script handles from the defer fix
• Added: Deactivating the plugin now tells you plainly what stays behind – applied fixes, .htaccess rules and wp-config changes are not undone by deactivating – and the plugin says so again if you reactivate it
• Added: Translation template (.pot), so the plugin can now be translated

Improved

• Improved: The Optimize page and the Fixes page are now two views of one system rather than two implementations, so a fix behaves, reports and undoes the same way whichever page you use
• Improved: New checks are enabled automatically when updating, without overriding your existing choices
• Improved: Orphan page detection now runs as a proper pass at the end of a scan instead of guessing while the scan is still going, and says plainly when part of the site could not be inspected
• Improved: Fewer false alarms. Accessibility, parked-domain, security-header, image-format and compression checks were each reporting problems that were not there – on Bootstrap markup, on filenames that merely contained a domain name, on cached responses, and on servers whose answers were read too strictly
• Improved: Checks that cannot be certain from a page scan now say so instead of asserting a cause, and report what was actually measured
• Improved: Scan progress shows the number of queued URLs from the start and explains the pause while the site-wide checks (DNS, plugin directory, sitemap, server headers) run, instead of sitting on “Initializing…”
• Improved: A clear notice if the plugin’s database tables are missing, instead of features quietly failing

Fixed

• Fixed: Several optimizations reported themselves as active without taking effect, among them four security ones. They now apply as described
• Fixed: The HSTS and PHP-version header fixes could end up sending their header twice, in one case replacing a stronger policy already set by your host with a weaker one
• Fixed: Undo and deactivate no longer report success when there was nothing to undo them with, and a cleanup that has run no longer hides the issues it cleaned from later scans
• Fixed: A PHP deprecation notice that appeared above some of the plugin’s screens on PHP 8.1 and newer, and those screens now carry a proper browser title
• Fixed: Alignment of the controls on the Issues screen’s filter bar
• Fixed: Deleting the plugin with “delete data” enabled now removes every option it created

Security

• Security: Hardened the database search-and-replace behind the mixed-content fix so that serialized data cannot be corrupted, with the result verified before anything is written

3.1.0

A major reliability and quality release. We went through every check, fix and help text in the plugin and tightened the whole codebase.

• Added: Six additional checkers are now active – 404 page, accessibility, external links, fonts, iframes and pagination
• Improved: Checks now verify your site’s actual state instead of settings, which removes a large number of false positives across the security, performance and page-builder checks
• Improved: Word counting now handles Swedish and other non-English languages correctly
• Improved: Recommendations brought up to current best practice, and checks updated for WordPress 6.6+ and current PHP versions
• Improved: All .htaccess fixes are written safely – Apache 2.4 compatible, verified after every change, with automatic backup and rollback
• Improved: Hardened backup system with protected storage on all server types; database restore is now atomic, so an interrupted restore can no longer harm your database
• Improved: More reliable auto-fixes – one setting per fix everywhere, clear “cannot be undone” warnings before database cleanups (which can now be re-run), and heavy operations run in batches on large sites
• Improved: Safer defaults – HSTS starts conservatively, and the REST API restriction keeps contact forms and WooCommerce guest checkout working
• Improved: Admin UI polish – better error handling during scans, working issue filters, accurate counts and consistent free/premium information
• Fixed: The iframe lazy-loading fix could blank post content on some PHP versions
• Fixed: The mixed content fix now safely updates post content only, with per-post backups
• Fixed: Premium updates from pihlfelt.se did not work due to an incorrect update endpoint
• Removed: A few obsolete toggles that no longer provide value on modern WordPress
• Code: General cleanup – removed unused and legacy code, tightened output escaping and export handling

3.0.2

• Added: Server Environment section in Settings showing PHP max_execution_time, memory_limit, and PHP version
• Added: Recommended batch_size and request_timeout based on server configuration
• Added: One-click “Apply” buttons for recommended scanner settings
• Added: New issue “Page HTML is large/too large” for bloated pages (Divi/Elementor detection)
• Added: New issue “Email link missing mailto:” for malformed email links
• Fixed: Undefined variable $failed_count PHP warning in scan view
• Fixed: rtrim() null parameter deprecation warning (PHP 8.1+ compatibility)
• Fixed: Email addresses without mailto: incorrectly reported as broken internal links
• Fixed: Scanner hanging on problematic pages (now auto-skips after 2 failed attempts)
• Improved: Reduced external link checks from 25 to 10 per page for faster scanning
• Improved: Batched database operations for better performance
• Improved: Faster retry delays when processing slow pages
• Improved: Large pages (>3MB) skip DOM parsing but still report size issues
• Improved: Clearer progress messages during scan

3.0.1

• Fixed: Database tables created with incorrect prefix preventing scans from working
• Fixed: Duplicate issues appearing multiple times for the same URL
• Fixed: Scanner analyzing error pages (429/5xx) instead of actual content
• Fixed: Progress bar not updating during scan (polling improvements)
• Fixed: Polling continuing after server errors, causing rate limiting
• Improved: Sequential polling to prevent overwhelming the server
• Improved: Added delay between URL requests to avoid rate limiting
• Improved: Reduced default batch size from 50 to 10 for better compatibility
• Improved: Immediate stop on 429/500 errors with user-friendly message

3.0.0

• Major: Unified Optimizer system for all optimizations
• Added: Auto-marking of issues as fixed when optimizations are activated
• Added: Automatic reopening of issues when optimizations are deactivated
• Added: Full backup system for database, themes, plugins, and full site backups
• Added: Chunked backup processing to handle large sites without timeouts
• Improved: Fix History now syncs correctly with actual optimization state
• Improved: Categories hide properly when requirements are not met
• Improved: WooCommerce category shows “WooCommerce required” notice
• Fixed: Empty category display for premium-only features
• Fixed: Various CSS styling issues
• Removed: Legacy optimization systems

1.0.7

• Added: Comprehensive issue details for 50+ more issue types
• Added: Fix guidance for accessibility issues (form labels, skip links, tabindex)
• Added: Safe .htaccess auto-fix system (Premium) with automatic backup and rollback
• Improved: Redirect chain display shows hop count and source plugin
• Improved: Security header issues show recommended values
• Improved: Database autoload issues show largest offending options

1.0.6

• Changed: “How to fix” now uses expandable button like “Why does this matter?”
• Fixed: Empty issue detail boxes no longer show
• Improved: Issue details now show WHAT was found, not just counts
• Improved: Database issues more human-readable

1.0.5

• Added: Complete fix guidance for all issue types
• Added: Knowledge base explanations with “Why this matters?”, impact, and how to fix
• Fixed: “Manual” badge now always shows step-by-step guidance

1.0.0 – 1.0.4

• Initial releases: core audit engine, issue knowledge base, robots.txt refinements, duplicate detection improvements