Carticy SiteVitals – Security, Speed, Performance & Database Optimization
| 开发者 |
carticy
alikhallad |
|---|---|
| 更新时间 | 2026年9月11日 00:10 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
SiteVitals is a WordPress security and performance plugin that answers "why", not just "what".
Security plugins hand you a log. Speed plugins hand you a score. SiteVitals measures real visits to your site and names the plugin, the file and the setting behind each slow page. When a page takes 1.2 seconds, you find out what spent it.
On the security side it is WordPress hardening you can switch on immediately: limit login attempts to stop brute force guessing, require strong passwords, close the settings attackers probe first, and get told the moment a new administrator account appears.
The site check goes further and compares your plugin files against the official releases, so a file that no longer matches is named rather than left to find later.
Running a store? It blocks card testing attacks, also called carding, where bots run stolen card numbers through your WooCommerce checkout until one is approved. That runs entirely on your own site.
Every switch explains what it does before you turn it on, and every one can be turned back off.
Free, no account needed
Twenty-four switches. None of them send anything to us.
Security
- Turn off XML-RPC, an old WordPress feature attackers use to guess passwords. You can also keep it and remove only the risky parts.
- Turn off the file editor, so nobody can change your theme or plugin code from inside WordPress.
- Stop people scanning your site to collect your usernames.
- Keep your username off your posts, so only your display name is shown.
- Remove the "Remember Me" box from the login form.
- Limit login attempts. If someone is locked out, the message tells them how long it lasts and who to contact.
- Require strong passwords, and block the common ones attackers try first.
- Get warned when a new administrator account is created.
- Hide the file list in your uploads folder.
- Turn off application passwords. These let apps sign in without using your login page.
- Close new sign-ups if your site does not need them.
- Slow down repeated password reset requests.
- Stop your site notifying itself every time you link to your own posts.
- Remove the emoji script that loads on every page.
- Remove tags from your page code that most sites never use.
- Slow down the admin auto-refresh that runs while you work.
- Stop loading the Dashicons icon font for visitors who are not signed in.
- Save the results of database queries your admin screens repeat.
- Limit how many old copies of each post WordPress keeps.
- Keep the background task log shorter so it stops growing.
- Delete temporary data that has expired.
- Stop card testing attacks on your WooCommerce checkout, where bots try stolen card numbers one after another. Runs on your site and sends nothing to us.
- Hide the WooCommerce status box on your dashboard.
- Turn off WooCommerce marketplace adverts.
- A small counter records how long your pages take, how much memory they use, how many database queries they run, and any errors. It adds up the totals every hour. None of it leaves your site.
- A record of what changed and when, so you can match "the site got slow this week" against "that plugin updated on Tuesday".
- Two-step sign-in. Before it turns on, it checks that the code really reached you. It shows your backup codes once, and there is a command to switch it off if you are ever locked out.
- Security headers for your pages, tested on your live site first and only kept if everything still works.
- Automatic updates for plugins with known security problems. If one cannot be updated safely, it is switched off instead.
- A log of security events on your site, with the time each one happened.
- File permission checks that tell you what changed since your last check.
- Stop PHP files running from your uploads folder.
- Stop file lists showing in your uploads folder and every folder inside it.
- Shorter sign-in sessions for accounts that can change the site.
- Faster versions of some common slow database queries.
- Autoload optimizer, for the settings WordPress loads on every single page.
- Index manager, which adds the database indexes your queries are missing.
- Delete leftover data from posts, users and comments that were removed.
- WooCommerce: load product options in the background instead of all at once.
- WooCommerce: skip a slow scan on the product edit screen.
- The full report: slow queries traced back to the exact file and line, slow code traced back to the plugin that added it, autoload size split up per plugin, and a written summary of what to fix first.
- Reports covering speed, security, SEO and WooCommerce.
- Checks on a schedule, compared against the last one, so you can see what got worse.
- Uptime monitoring and email summaries.
- Checkout reports for WooCommerce stores.
安装:
- Upload the plugin ZIP under Plugins, Add New, Upload. Or install it from the WordPress.org directory.
- Activate the plugin.
- Open SiteVitals in the admin menu. On the first run you can either connect a Carticy account for a full health report, or skip that and go straight to the Toolkit.
- Optional: create a free Carticy account at https://carticy.com/sitevitals
屏幕截图:
常见问题:
Does the plugin work without a Carticy account?
Yes. Twenty-four switches are yours with no account: the security ones, the speed ones, the database cleanups, WooCommerce checkout bot blocking, the performance counter and the change record. All of it runs on your own site and contacts nobody. An account adds the full site check and the vulnerability lookups. A paid plan adds fourteen more switches, monitoring and reports.
Which features need a paid plan?
The fourteen switches listed under paid plans, plus scheduled checks, uptime monitoring, email summaries, checkout reports and the full report. In the Toolkit each one shows which plan it belongs to, so you can see what is available without being pushed to buy.
What information is sent to Carticy?
Nothing until you connect your site. After you connect and run a check, we receive your site address, the names and versions of your plugins and themes, your WordPress, PHP and MySQL versions, and some database numbers such as how many settings and posts you have. Your content never leaves your site. No posts, no user details, no customer records.
Is my data private?
Yes. Your results belong to your Carticy account and we never share them. The plugin can export or delete anything it has saved on your site, which covers GDPR requests, and removing the plugin removes every setting, table and scheduled task it created. The privacy text it adds to your privacy page lists every place data is kept.
How do I remove the plugin?
Deactivate and delete it under Plugins, Installed Plugins. The plugin always clears its scheduled tasks, saved results, any upload in progress, and any temporary accounts it created. Deleting your stored settings and tables is your choice, under Settings, Advanced, "Remove all data on uninstall". This is off to begin with, so that deleting the plugin by mistake during an update cannot erase your history. Turn it on first if you want everything removed. If your site is connected, removing the plugin also tells us to disconnect it. On a multisite network, every site is cleaned the same way.
Does the plugin contact your servers before I agree?
No. On a new install with no account connected, activating contacts nobody, opening any screen contacts nobody, and turning on a switch contacts nobody. The first contact happens when you click "Connect to Carticy" or "Run audit". We test this before every release.
Does the plugin slow down my site?
The performance counter takes well under 1ms per page, and it runs after your visitor already has the page. Our admin files load only on SiteVitals screens, so every other admin page and your whole public site load none of our JavaScript or CSS.
Is this a replacement for a security plugin?
No, and we are not trying to be one. There is no malware scanner here and no firewall. What we do is check the places a scanner does not look, close the settings most sites leave open, and tell you when something changes. Use SiteVitals alongside your security plugin.
更新日志:
1.0.4
- Fixed: sites that updated from an older release were not recording security activity at all, so the Security Activity Log stayed empty however much happened on the site. Recording resumes on update and the history builds from there.
- Fixed: two-step sign-in entries in the Security Activity Log did not say what had happened. They now record which method was used, whether a code was wrong or the attempts ran out, and why a second factor was removed from an account.
- Fixed: five kinds of two-step sign-in entry appeared in the Security Activity Log under a short name rather than a description of the event.
- Improved: the daily clean-up of expired security activity no longer reads through the whole log to find what to remove, so it stays quick as the log grows.
- Fixed: turning performance monitoring off also stopped the site keeping count of what its security settings turned away. Those counts are kept whatever that setting says, because nothing on the Settings screen offers to switch them off.
- Fixed: disconnecting a site could report a failure while the disconnect had already gone through, leaving the plugin connected with no way to leave. Disconnecting now completes, and confirms it.
- Fixed: after a disconnect the plugin could still show the old account, its plan and its site count, next to panels reporting no account was connected.
- Added: when Carticy cannot be reached, you can disconnect the site on its own and clear it from your account later.
- Fixed: disconnecting a site a moment after someone else had already disconnected it warned that your account might still list the site, when it had in fact been released.
- Fixed: the account bar never showed the date a cancelling plan stays active until.
- Changed: when the version with your plan's performance tools is already installed on the site, the Account page offers to activate it instead of asking you to download it again.
- Fixed: the checkout protection panel on the Checkout page reported the last 14 days whatever the page's date control was set to, so its figures covered a different period than its heading. It now follows the control, and the Overview's checkout card asks for the 30 days its title names.
- Fixed: a read-out asked for a longer period than the site keeps security history for was labelled with the period asked for rather than the one it covers. It now names the period it can answer for and says why.
- Added: a Protection panel on the Overview showing how many protections are guarding the site and what they have turned away, over 24 hours, 7, 30 or 90 days. Protections your web server or WordPress enforces say so and show no figure, because there is no honest number to show.
- Added: every tweak that turns something away now shows what it has turned away in the last 30 days, on its own card in the Toolkit.
- Changed: checkout protection moved from a card of its own on the Overview into a row of the new Protection panel, keeping its switch and gaining a way into the full list of blocked submissions.
- Improved: the Settings screen used to load all nine of its tabs to show the one you opened. It now loads only the tab you are looking at, so the page opens faster.
- Fixed: a help icon near the right of the screen could push the whole page sideways, leaving it scrolling horizontally for no visible reason.
- Fixed: dates and times were written several different ways across the plugin, and some of them could not be translated. They now read consistently, and anything older than a day is given as a date rather than a count of days to work out.
- Fixed: uninstalling the plugin left two background jobs scheduled on the site. Everything the plugin schedules is now removed when it is deleted.
- Fixed: a fresh install read four settings from the database on every page view until each was saved for the first time; they are now in place from install and load with the page.
- Fixed: a part of the site the audit could not read was shown as if it had been measured, with an empty checkout and no orders. It is now named at the top of Insights instead, and is never scored.
- Improved: order history is counted with a few database queries instead of loading thousands of orders, so large stores no longer run the audit out of time.
- Fixed: PHP files in the uploads folder are reported as one entry per folder instead of one per file, and are only flagged as a possible web shell when the code actually behaves like one.
- Added: database cleanups now run from the Performance Optimizer, with a button on every finding instead of a query to copy.
- Added: remove the tables and custom fields left behind by plugins you no longer have installed.
- Added: the Optimizer is organised into Indexes, Cleanups, Autoload and Tweaks, each showing what is still outstanding.
- Improved: audit results open faster on sites with a lot of findings.
- Fixed: orphaned term assignments counted review and user tags as leftovers, so the figure was far too high and cleaning it up would have removed live data.
- Fixed: the size reported for leftover WooCommerce line items was an estimate, and the item metadata that goes with them was not counted at all.
- Fixed: cleaning old post revisions now keeps the most recent ones for each post, as it always said it did.
- Fixed: every cleanup asks for confirmation before it runs, and says whether it can be undone.
- Fixed: performance monitoring now shows the full chart and history on every site, with or without a Carticy account.
- Fixed: backend health explains what your OPcache hit rate and memory limits mean, instead of calling a healthy cache degraded.
- Fixed: profiler and slow-request figures report what was actually captured.
- Fixed: the connected-sites count no longer shows a stale number after a site is removed.
- Improved: audit results are easier to scan, with clearer grouping and labels.
- Improved: one-click fixes open where you need them.
- Improved: Toolkit and Settings save from a single bar, with fewer notices.
- Improved: account, connection and plan details are more accurate.
- Added: clear cached results from the Privacy screen.
- Fixed: removing a spare copy of the plugin no longer fails, and leaves the copy you keep untouched.
- First public release.