CordonAI Site Health Doctor
| 开发者 | cordonai |
|---|---|
| 更新时间 | 2026年7月23日 00:20 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
CordonAI Site Health Doctor finds what is wrong with your site, explains it in plain language, and hands you the fix. It is a diagnostic tool: it never edits, deletes or blocks anything. It measures, explains and recommends — the decision always stays with you.
Everything described below works in this version. Three things usually scattered across different tools, now in one dashboard:
- Performance & health diagnostics — which plugins and hooks are slow, which SQL queries are heavy or repeated, what is happening to your database and disk, and which PHP errors keep occurring.
- Access-log analysis — traffic, bots and signs of attack, read straight from your server's own access logs inside wp-admin. Nothing is sent to any external service.
- Recommendations & warnings — every finding is explained on two levels: a plain "what it means and what to do" for everyone, and the technical detail (stack traces, SQL, commands) for developers.
- Health dashboard — an overall Health Score built from four sub-scores (errors, performance, database, security), each with a transparent breakdown of every penalty, plus a live environment summary: WordPress, PHP, database, web server, HTTPS, memory and more.
- Errors & warnings — an early error handler that starts catching PHP errors the moment WordPress loads — even while other plugins are still loading — de-duplicates them into groups, and attributes each one to the plugin, theme or core file that really caused it. Optional
debug.logparsing. - Performance — always-on light sampling of page-generation time, memory and query counts, plus on-demand deep-profiling sessions that measure each active plugin, your most expensive hooks, and your slowest SQL queries (with EXPLAIN).
- Database — per-table data and index sizes, autoload weight, overhead and bloat counters, growth tracking over time, and safe, copy-ready clean-up recipes.
- Disk & files — a resumable scanner for large files, junk, leftover plugin and theme folders, and web-exposed backups, plus a core-file integrity check against the official WordPress.org checksums.
- Logs & traffic — incremental parsing of Apache, Nginx and LiteSpeed access logs (including rotated and
.gzfiles) into compact hourly aggregates: traffic, top URLs, bots versus humans, and status codes. - Security — heuristics over those same logs that surface brute-force, scanning and injection attempts as ranked events, each with the evidence behind it and safe, copy-ready hardening advice.
- Recommendations — one prioritised to-do list distilled from every module. It also watches for change-over-time problems: an error rate or a page that suddenly runs far above your site's own normal range, and the slowest front-end pages.
- Notifications — opt-in alerts the moment a new fatal error happens, plus a weekly digest that shows what changed since last time. Delivered by e-mail and, if you want, to Slack, Telegram or Discord.
- Updates & vulnerabilities — flags out-of-date core, plugins and themes, and (optionally, with your own free WPScan token) checks the installed versions against the WPScan vulnerability database so you hear about a published CVE quickly.
- Uptime & SSL — an optional hourly check of your home page (catching front-end errors and slow responses) and a warning before your TLS certificate expires.
- Client reports — an optional, white-label monthly HTML report (health, performance, errors, security and recommendations) e-mailed to you or your client. Download it any time.
- For developers — WP-CLI commands (
wp site-doctor health|recommendations|scan|report) and an optional token-gated metrics endpoint for Prometheus / Grafana.
- Shared hosting is the baseline. No root, no
exec(), no special PHP extensions required. Anything that genuinely needs a VPS is clearly labelled. - Do no harm. A diagnostics tool must not slow your site down or bloat your database. Light always-on sampling plus deep, time-boxed profiling on demand; compact aggregates instead of raw data; automatic clean-up after a retention window you control.
- Privacy first. There is no telemetry and no tracking, ever. By default nothing leaves your site. A few clearly-labelled features are opt-in and only contact a service after you switch them on — vulnerability lookups, chat notifications and GeoIP — each listed in the Privacy section below. An optional IP-anonymisation setting helps with GDPR.
安装:
- Upload the
cordonai-site-diagnosticsfolder to/wp-content/plugins/, or install the plugin through Plugins → Add New. - Activate it through the Plugins screen in WordPress.
- Open Site Doctor in the admin menu. You land on the dashboard with your Health Score and environment summary, and the Recommendations page already lists the issues found on your site.
- Visit Site Doctor → Settings to choose which modules run, point the Logs module at your access-log file, and set how long data is kept.
屏幕截图:
常见问题:
Does this plugin change anything on my site?
No. It is read-only by design. It will never clean your database, block an IP, or deactivate a plugin. Every finding comes with a recommendation that you choose to act on (or not).
Will it slow my site down?
The background monitor samples only a fraction of requests and is designed to stay under roughly 2% overhead. Deep profiling runs only when you start a time-boxed session, and stops automatically.
Does it work on cheap shared hosting?
Yes — that is the primary target. Everything works without root access or special PHP extensions. Anything that truly requires a VPS is labelled and provided as instructions.
Where does the security analysis get its data?
From your server's own access logs (Apache, Nginx or LiteSpeed), parsed locally inside wp-admin. You point the plugin at your log file in the settings. Nothing is ever sent to a third party.
Is any data sent to a third party?
No telemetry, ever, and nothing by default. Every outbound connection is opt-in and stays off until you switch it on: the WordPress.org checksum API (core-integrity check, the same one WordPress itself uses), MaxMind (GeoIP database download), the WPScan API (vulnerability lookups, only with your token), and the chat services you configure for notifications (Slack, Telegram, Discord). The uptime check requests your own home page, not a third party. They are all listed in the Privacy section below.
Do I need a MaxMind account?
Only if you want country-level GeoIP in the Logs module. It is optional and free; without it, log and security analysis still work.
更新日志:
1.1.2
- Plugin name and text domain aligned with the plugin's directory slug.
- Refreshed translations (English, German, Italian, Spanish) and minor interface polish.
- Includes the full diagnostic suite introduced in 1.1.0 (see below).
- Notifications: instant alerts when a new fatal error occurs, plus optional delivery to Slack, Telegram and Discord alongside e-mail.
- Weekly digest now shows what changed since the previous one (health, recommendations, errors, database, page time).
- Anomaly detection: flags an error rate or a page-build time that jumps far above the site's own recent baseline.
- Updates & vulnerabilities: flags out-of-date core, plugins and themes; optional WPScan lookups (with your own token) for published CVEs in installed versions.
- Uptime & SSL: optional hourly home-page health check with alerts, and a warning before the TLS certificate expires.
- Client reports: optional white-label monthly HTML report e-mailed to you or your client, plus on-demand download.
- Slowest-page ranking surfaces the front-end paths that take longest to build.
- Developer tooling: WP-CLI commands (wp site-doctor health|recommendations|scan|report) and a token-gated Prometheus / Grafana metrics endpoint.
- All new external connections are opt-in and documented in the Privacy section.
- First public release.
- Health dashboard with an overall score, four sub-scores and a live environment summary.
- Errors module: early error handler with de-duplication and accurate source attribution; optional debug.log parsing.
- Performance module: always-on sampling plus on-demand deep profiling of plugins, hooks and SQL queries (with EXPLAIN).
- Database module: table, index and autoload sizes, overhead and growth tracking, safe clean-up recipes.
- Disk module: resumable file scanner, junk and web-exposed-backup detection, and core-file integrity check.
- Logs & Traffic module: incremental Apache / Nginx / LiteSpeed access-log parsing into compact aggregates; optional offline GeoIP.
- Security module: log-based brute-force, scanning and injection detection with evidence and copy-ready hardening advice.
- Recommendations: one prioritised list across all modules, with opt-in e-mail alerts and a weekly digest.
- CSV and diagnostic-snapshot export.
- Read-only by design; full data clean-up on uninstall, with an optional "keep my data" choice.
- Accessible, mobile-friendly interface. Translations: English, German, Italian, Spanish.