BoltAudit - Site Speed Audit and Performance Insights

BoltAudit is a read-only speed audit for WordPress. It scans your site, names the specific plugin, query, asset or database table making it slow, and gives you the measured evidence and the ordered steps to resolve each one. Most speed plugins hand you a score and a checklist. BoltAudit names the thing responsible: a plugin not updated since 2019, 41 images above the fold adding up to 4.2 MB, 12,438 post revisions in your database. It estimates what each costs you in visitors and orders them by what you win back. What BoltAudit does, and what it does not BoltAudit finds the work and ranks it. It does not change your site. Every audit is read-only. You get the finding, the evidence behind it, and ordered steps you can follow or hand to a developer. What happens to your site stays your decision. What the free Local Audit checks The Local Audit runs inside your WordPress admin. Nothing leaves your site, and there is no account, setup or credit card.

• Plugins, database, server environment and assets, scanned in one pass
• Mobile and desktop scores, measured separately
• Estimated visitor loss, with the research behind it published publicly
• Health Score out of 100, tracked audit over audit
• Plugin Audit flagging inactive, outdated and abandoned plugins
• Database Overview: table sizes, row counts, autoloaded options, transients and bloat
• Post type analysis including orphaned metadata and orphaned post records
• WooCommerce checks: checkout timing, cart fragments, oversized images, stuck jobs
• Environment checks with pass and fail states
• JSON export of every result
• Unlimited sites

AI Audit, optional and account-based The AI Audit runs on the BoltAudit cloud service. It ranks findings by estimated visitors recovered and attaches the evidence behind each one. This feature sends diagnostic data from your site to a third-party service that we operate. Nothing is transmitted until you connect an account and start an audit, and the exact payload is shown to you first. See External services below. Every plan reloads AI credits weekly, including the free one. Works alongside your cache plugin BoltAudit detects WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, WP Fastest Cache and Autoptimize, and accounts for what you already have. Where the numbers come from Every visitor-loss figure is an estimate, derived from published abandonment research mapped against your measured load times, and labelled as one everywhere it appears. BoltAudit never reads your analytics. When the engine cannot produce a defensible number it says estimate unavailable rather than inventing one. When a firewall blocks a measurement, it names the blocked check and lowers the report confidence. Privacy and safety

• Read only. No audit modifies your site, your files or your database.
• Local audits stay local. Nothing leaves your site unless you run a cloud audit.
• You see the payload first. The exact list of what will be transmitted is shown before the first AI Audit.
• No frontend overhead. Audits run on demand in the admin. Nothing loads on your public site.

Plans The Local Audit is free, on unlimited sites, with no time limit. Paid plans add more weekly AI credits, scheduled audits and multi-site switching. See boltaudit.com/pricing Roadmap An SEO and AEO visibility audit is in development and is not part of this release. Progress: boltaudit.com/roadmap. Development Methodology behind every estimate: boltaudit.com/methodology

1.0.2 – 2026-09-14 Fixed

• Fixed: The Dashboard said "No audit has run yet" after a Local Audit had finished, with that run's score, grade and fix list sitting one screen away. It now shows the Local Audit where there is no AI Deep Audit to show instead, and a site with no BoltAudit account sees its own results rather than an invitation to connect.
• Fixed: The AI credit count in the top bar was a full run behind. A credit is set aside when an audit starts, not when it finishes, so the number now updates as the run begins — and goes back up if the run fails and the credit is returned.
• Fixed: The top bar slid underneath the WordPress admin bar as soon as the page scrolled, hiding the search field and the light/dark switch. Local Audit's area chips did the same.
• Fixed: BoltAudit opened in dark mode for anyone whose computer is set to dark, inside an otherwise light WordPress admin. It opens light now; dark is the switch in the top bar and nothing else.

Improved

• Improved: Environment findings say what they are worth. Each one now carries how hard it is being pushed, how wide it reaches, who can carry it out, roughly how long it takes and what it costs — with your site's reading beside the value it should be. A finding that cannot be started yet says which one to fix first, and a check that passes stays short.
• Improved: Autoloaded options are read, not just measured. Every option in the list now says what it is — an expired transient, an oversized cache, a leftover from a plugin that is no longer installed, or a real setting to keep — with the plugin it belongs to where the scan can name one with certainty. The bar's colour follows that verdict, the size bands are labelled, and the fix steps say what each one frees.
• Improved: The AI Audit Report's findings say each thing once. Severity, scope, difficulty and time are one line, the speed gain appears once rather than three times, and the evidence is shown as the measurements it is. Every finding now carries an icon for its subject rather than the same bolt.
• Improved: The account card at the foot of the sidebar was carrying seven controls in a very narrow space. Help and Contact moved out from under it, and the profile icon is gone — the WordPress admin bar already links there.
• Improved: The screen you see while BoltAudit is starting up. It was one line of plain text in the corner of an empty page, which reads as something that has failed rather than something that is working. It is the logo in the middle of the page now, with a line that says what the plugin is doing: preparing data, analyzing it, then preparing the report.

1.0.1 – 2026-09-02 Fixed

• Fixed: A fatal error on sites where another plugin registers its Site Health test as a closure, which returned a server error for the backend layer of every AI Audit. The test's method name was built by interpolating the registered value, which holds for WordPress core's own string-named tests and nothing else. The registered value is now resolved to a callable first, so a plugin's own function or an [ $object, 'method' ] pair runs too — where before it was silently skipped.
• Fixed: The AI credit chip in the top bar drew its icon and the words "AI credits" but never the number, on every install and at every balance. A balance that has not loaded still shows nothing rather than a misleading zero.

Improved

• Improved: Activating BoltAudit now opens the Local Audit instead of the AI Audit's connect screen. A new install landed on a setup checklist with no score on it; it now lands on the audit that needs no account and shows the site's real numbers straight away.
• Improved: The Dashboard says what the plugin actually does. "Apply this fix" is now "Show me how" and opens the finding's own instructions, "Apply optimization fixes" is "See the fix plan", the Optimization gauge is "Fix readiness", and each finding carries an effort line built from its own difficulty and time estimate. The apply and rollback wording was left over from the fix actions withdrawn in 1.0.0.
• Improved: Your plan is named as the platform reports it, rather than every paid plan reading "PRO".
• Improved: The plugin's screens now end where the browser viewport ends. The page was measured against the largest viewport rather than the visible one, which left the app ending above the bottom of its own scroll.
• Improved: The sidebar is scaled down slightly, so more of each screen is the screen.

Removed

• Removed: The Fix History card on the Dashboard, the last surface still pointing at the withdrawn fix actions. Rollback of anything applied under an earlier version still works, as in 1.0.0.

1.0.0 – 2026-08-31 BoltAudit rebuilt. New admin screens, a Local Audit that runs entirely on your own server without an account, an AI Audit you can start and read without leaving WordPress. The guided fix actions from 0.1.0–0.4.0 are withdrawn in this release — BoltAudit now finds and explains the work rather than performing it. See Removed. The new admin experience

• New: Rebuilt admin interface with seven screens — Dashboard, Local Audit, Audit Report, Trends, PRO, Settings and the SEO & AEO placeholder. It is the same design as the BoltAudit web dashboard, so the two surfaces are one product rather than two that resemble each other.
• New: Dark mode across the whole plugin, on one toggle, remembered per browser.
• New: Command palette on Ctrl F / ⌘ F, a keyboard shortcut reference, mobile navigation and inline notifications.
• New: A Dashboard widget and a health score in the admin bar. Both are on by default and switched off in Settings, and both show the last stored result — neither runs an audit, so opening wp-admin never triggers a scan.
• New: Every string is translatable.
• Improved: The sidebar is grouped into Overview, Audits and General, with the connected BoltAudit account shown at the foot of it.

Local Audit

• New: The Local Audit replaces the Quick Audit. It runs in PHP on your own server, needs no BoltAudit account, and makes no outbound request — the plugin enforces that with a request filter rather than promising it in the copy.
• New: The Local Audit has its own page, rebuilt so that every claim shows the measurement behind it.
• New: Run a Local Audit in one click from either the top bar or the page itself.
• New: Your site's own score over time, kept in a table in your own database and shown on Trends.
• New: Export every result as JSON.
• Improved: Per-image weights the scanner already measured are now reported instead of discarded.
• Improved: When a check cannot complete, the report says what went wrong rather than only that something did.

AI Audit

• New: Start an AI Audit, follow its progress, read the report and see your remaining credits without leaving WordPress. Your account credential stays on the server and is never handed to the browser.
• New: Sites that nothing can reach from the outside — behind Cloudflare, a WAF, a stripped authorization header, a staging password or a private network — now collect their own data and send it out. This was previously impossible.
• New: The outbound run sends one layer at a time. Sending all four in a single request is how a shared host hits its execution limit with nothing delivered.
• Improved: An audit blocked in one direction continues in the other instead of stopping at an error.
• Improved: The Audit Report ranks findings by estimated visitors recovered and gives each one a Show me how panel: what is happening, the measured evidence in copyable rows, the ordered steps, and the estimated improvement.
• Improved: The AI Audit is no longer labelled PRO. Every plan reloads AI credits weekly, including the free one, so the upgrade prompt was interrupting people on their way to something they already had.
• Improved: Paid-only cards are now gated on your actual plan, and controls that lead nowhere are no longer drawn.

Connecting your site

• New: Connect by sending your browser to the BoltAudit dashboard and letting your server collect the keys on the way back. The previous flow required the platform to call into your site, which any firewall answers with a challenge page instead — connecting simply failed, and the account was rolled back each time.
• New: Create a BoltAudit account from wp-admin in one click.
• New: A reachability check that tells you whether the platform can reach your site before an audit depends on it.
• New: When a firewall is in the way, the plugin shows that firewall's own instructions in wp-admin, and lets you re-check when you are done. The notice stays until you dismiss it.
• Improved: Connection failures name the specific obstacle instead of reporting "could not connect" for all of them.
• Improved: One Connection card in Settings, replacing two competing flows.
• Improved: Plugin preferences and a settings export, both of which work whether or not you have an account.
• Improved: Uninstalling keeps your audit history by default. People uninstall to troubleshoot, to migrate, or by accident, and destroying months of measurements on the way out is not a decision a plugin should make. Opting in to a full purge also deletes the stored credential.

Fixed

• Fixed: A fatal error on activation under PHP 8 that took the site down. A missing configuration key meant the database migration list was read as a boolean instead of an array.
• Fixed: Every Local Audit on a WooCommerce site returned a server error. One WooCommerce check was still being called with the old number of arguments after the signature changed, and the failure brought the whole summary down with it.
• Fixed: A fatal error when the asset loader was included twice.
• Fixed: Blank rows on the Local Audit page's Post Types, Database and Plugin cards.
• Fixed: A crash on the dashboard for connected accounts, caused by a missing field in the credits data.
• Fixed: Two AI Audit contract errors between plugin and platform. The contract is now tested against the live API rather than a fixture.
• Fixed: Only half the site credential was being sent on some requests.
• Fixed: Three layout defects, along with the browser test harness that found them.
• Fixed: The row you clicked no longer jumps when a panel above it collapses.

Removed

• Removed: Applying fixes. The guided fix actions added in 0.1.0 through 0.4.0 — the cache, compression, revision, transient, Action Scheduler and debug-log actions — no longer run. This is enforced on the server, not merely hidden: hiding a button leaves the route behind it live. They are being rebuilt into an apply engine with a preview, an automatic backup and a one-click revert on every change.
• Removed: Fix History, withdrawn alongside the actions it logged.
• Note: Rollback of anything already applied still works. Revert, snapshot and verification are deliberately left running. Every fix applied under an earlier version was promised a way back, and withdrawing the feature is not a reason to strand a site that was already changed.
• Removed: The Quick Audit, replaced by the Local Audit.
• Removed: The older connection flow, and the browser message that carried account keys through the page.
• Removed: Surfaces with no data behind them — the notification feed, the industry benchmark comparison, the site switcher, pausing a running audit, and the per-device optimization toggle. Each is switched off rather than deleted.

Security

• Hardened: The connect handshake uses PKCE. The secret never leaves your server, so a code seen in browser history, a proxy log or a referrer header cannot be used by whoever saw it.
• Hardened: The platform refuses to issue a code for any address that is not your own wp-admin, so it can only ever be delivered to the site being connected.
• Hardened: Your BoltAudit credential stays in PHP. No admin screen and no browser request ever holds it.
• Hardened: Redacted findings are kept out of the admin screens.
• Hardened: Every action that writes requires the manage_options capability, and an unrecognised feature flag fails closed rather than open.
• Hardened: A full uninstall now deletes the stored API secret along with everything else. A live key left in a database nobody is watching is the part that matters most.

Compatibility

• Tested up to WordPress 7.1. Requires WordPress 6.0 and PHP 7.4.

0.4.0 – 2026-06-14

• New: One-click fix for orphaned post metadata, removing database rows left behind by deleted posts.
• Improved: The fix action layer reorganised into smaller, focused files, with no change in behaviour.
• Tested up to WordPress 7.0.

0.3.0 – 2026-05-11

• New: Three cleanup actions for the guided-fix pipeline — post revisions, failed Action Scheduler jobs older than 30 days, and the WordPress debug log.
• New: Partial completion on those actions. Each call processes a bounded batch inside a 25-second budget, so it never overruns PHP's execution limit on shared hosting.
• New: A collector signal for failed Action Scheduler records older than 30 days.
• Hardened: Expired-transient cleanup switched to batched SQL, removing the cost spike on sites with tens of thousands of them.
• Hardened: Strict end-state verification on every cleanup, so a partial run can never report as a completed one.
• Hardened: A path check on the debug-log action refuses any log file outside the WordPress install.
• Hardened: Action Scheduler cleanup now confirms both of its tables exist before touching either.

0.2.0 – 2026-05-08

• New: A public capability manifest so the dashboard can discover what a site supports.
• New: The Local Audit summary redesigned as five previews — frontend, backend, database, infrastructure and environment.
• New: Backend collectors expanded, giving the AI Audit more evidence to work from.
• Improved: Collectors are multisite-aware and no longer cap administrator enumeration early.
• Improved: The TTFB endpoint accepts a URL parameter for single-page measurement.
• Fixed: Namespaced collector edge cases.

0.1.0 – 2026-05-02

• New: Guided fix endpoints covering all ten action keys.
• New: Batch data collectors for the backend check registry.
• New: Active plugin summaries in the baseline.
• Improved: The Local Audit and AI Audit screens redesigned.
• Improved: JWT replaces HMAC on authenticated endpoints, which firewalls handle better.
• Improved: Request and response logging for easier diagnosis.
• Fixed: Site Health class lookup in the namespaced collector.
• Fixed: Local Audit status pills now reflect actual state.
• Fixed: Performance-budget labels, the HTTPS check, relative asset URLs and lazy-load behaviour.

0.0.9 – 2026-04-23

• New: The AI Audit workflow inside BoltAudit.
• New: A bottleneck-focused report model with evidence-backed findings.
• New: Connection and Deep Scan controls for AI Audit setup.

0.0.8 – 2025-09-05

• New: Database Details page.
• New: WooCommerce Details page.
• Fixed: An uncaught error.

0.0.7 – 2025-08-08

• New: Post Details page, with orphaned metadata and orphaned post record reports.
• Fixed: Environment user lookup, so the username reported is the right one.

0.0.6 – 2025-07-30

• New: WooCommerce Performance Insights.
• New: A Settings link on the Plugins screen.
• Fixed: A plugin fetch error.

0.0.5 – 2025-07-25

• New: Asset impact metrics — script and style file size and load duration.
• Improved: Repository caching, for faster repeated audits.
• Improved: The metrics breakdown UI.

0.0.4 – 2025-07-16

• New: Site Details section.
• Fixed: Plugin Audit on sites with a large number of plugins.
• Improved: Table UI.

0.0.3 – 2025-07-13

• New: Plugin Audit, detecting inactive, outdated and abandoned plugins.
• New: Warnings for unused or risky plugins.
• Improved: Environment and database reporting.

0.0.2 – 2025-07-05

• New: Database Overview — table sizes, row counts, autoloaded options, transients and bloat detection.
• Improved: Post type detection and metadata analysis.

0.0.1 – 2025-07-03

• Initial beta release: post-type analyzer and environment report.