NPC Maintenance Inspector
| 开发者 | npc01 |
|---|---|
| 更新时间 | 2026年10月24日 11:17 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
NPC Maintenance Inspector performs 9-point health diagnostics on your WordPress site directly from the admin dashboard:
- WordPress core updates — Detect missing core updates.
- Plugin updates — List plugins with available updates.
- Site Health issues — Extract critical issues from WP standard Site Health API.
- PHP version — Warn on end-of-life PHP versions.
- Error log analysis — Summarize debug.log entries and save a one-click backup to uploads/ for safe review.
- File integrity — Detect suspicious code patterns in core files (eval / base64_decode / etc.) by comparing checksums against the WordPress.org Checksum API.
- Suspicious files — Find unexpected PHP files in wp-content/uploads/, with built-in whitelist for known legitimate plugin files (Ajax Load More templates, WP STAGING index.php, AIOS firewall rules, etc.).
- SSL certificate — Check days until expiration (warn under 30 days, critical at 0).
- File permissions — Check critical files like wp-config.php, .htaccess, wp-content/.
- History — Keep the last 10 diagnoses as a custom post type.
- Scheduled auto-check — Run daily, weekly, or monthly via WP Cron.
- Email notifications — Send alerts only on critical issues.
- One-click debug.log backup — Save a copy of debug.log without modifying the original.
- Optional AI report — Generate maintenance suggestions via Anthropic Claude API. Disabled by default; opt-in via a wp-config.php constant.
安装:
- Upload the plugin folder to
/wp-content/plugins/or install it via Plugins → Add New in the admin. - Activate NPC Maintenance Inspector through the Plugins menu.
- Open NPC Inspector in the admin sidebar.
- Click Run Diagnosis to start a manual check.
- (Optional) Open NPC Inspector → Settings to enable scheduled auto-checks and email notifications.
- (Optional) Define
NPCMI_API_KEYinwp-config.phpto enable the AI report feature (see FAQ).
屏幕截图:
常见问题:
Is the AI report feature required?
No. AI report is optional and disabled by default. To enable it, add this line above /* That's all, stop editing! */ in your wp-config.php:
define( 'NPCMI_API_KEY', 'sk-ant-xxxx' );
Without that constant the plugin still runs all 9 diagnostics, scheduled checks, email notifications, and history.
Does the plugin send any data externally?
Diagnosis results are sent only by the optional AI report feature, only to the Anthropic Claude API, and only when explicitly triggered (manual "Generate AI Report" button, or automatic generation when a scheduled check detects a critical issue). The File Integrity check itself downloads the official checksums for your WordPress version from WordPress.org (it sends the WordPress version and locale; as with every request WordPress makes, the user agent includes your site URL; no files or diagnosis results are sent). The update checks use WordPress core's own update check. See the External services section below for details.
Who can use the plugin after activation?
Only the user who activated it. The user ID/email and the site URL are recorded on first activation, and the plugin refuses to operate for other users or on a different domain. This is a deliberate constraint to keep the AI cost surface and the admin actions tied to a specific operator.
Why are AI reports in Japanese?
This plugin was initially built for Japanese-speaking WordPress maintainers. The AI prompt instructs Claude to reply in Japanese. We will localize the prompt for additional output languages in a future release.
My site shows "suspicious files" in wp-content/uploads/. Should I delete them?
Not automatically. The detector tries to whitelist known legitimate plugin files (Ajax Load More templates, WP STAGING index.php, AIOS firewall rules, etc.). Anything that still appears in the warning should be opened and inspected first — many backup/staging/security plugins legitimately drop PHP files there.
更新日志:
1.0.5 (2026-10-24)
- Suspicious Files: a PHP file hidden in a known plugin folder could pass as harmless. Files in folders such as
uploads/updraft/are treated as plugin files only when they contain nothing but comments, or start with a recognised stop statement such asexit;. The comment check removed single-line comments up to the end of the line, but in PHP a single-line comment ends at the closing tag (and at a carriage return). A file with a "Silence is golden" comment followed by a closing tag and a second PHP block was treated as comments only, so the code in the second block was never reported. The check now uses PHP's own tokenizer. When the tokenizer extension is not available, a character-by-character scanner that follows the same rules is used instead of regular expressions.#[...]lines are no longer treated as comments, because they are attributes (code) on PHP 8. - Suspicious Files: a file that starts with an
if ( ! defined( 'ABSPATH' ) )guard was accepted when the guard only began with "exit" or "die", such as a call to a function namedexitnow()orexit( print( ... ) ). The guard must now be a plainexit;/die;, optionally with a literal message: a single-quoted string, or a double-quoted string without$(a double-quoted string can run code inside{$...}). - When the SSL certificate could not be checked (connection failed or the certificate could not be read), the result is now a warning in the overall grade and on the card instead of being counted as OK.
- The overall grade, the AI report input and the history list now use the same per-item status. Previously the AI report received raw values such as
update_availableandunknown, a File Integrity result whose differences were all in files known to differ was passed to the AI as a warning while the card and the grade showed OK, and the history list showed the grade saved at the time while the latest result was re-evaluated. - The AI report no longer states that notices from other plugins have no effect on the site, and no longer lists them under "no issues". They are shown in a separate reference section, because the diagnosis does not check their effect. The AI input now starts with a summary of each item's status, and the AI is asked to list only items whose status is OK under "no issues" (it used to move the parts of a warning item that were fine there), and not to describe checksum differences as false positives or probably safe.
- Admin screen texts are now translated. The JavaScript translation file (
languages/npc-maintenance-inspector-ja-npc-maintenance-inspector-admin.json) was missing, so the Japanese admin screen showed the JavaScript texts in English. Three untranslated texts around the debug.log backup are now translated as well. - A saved result without the SSL item no longer stops the results screen from rendering, and a saved result with missing items no longer stops the history list from rendering.
- An AI report that was cut off at the length limit is no longer saved as complete. When you generate it manually, you are asked to generate it again; a scheduled run sends the notification without the AI report, as with other AI errors. The length limit was raised from 2000 to 4000 tokens, the request timeout from 60 to 80 seconds, and the AI is asked to keep the report within about 2,500 Japanese characters (in a test with many warnings, the report used to stop in the middle even at 4000 tokens).
- The readme now describes the WordPress.org checksum request made by the File Integrity check. It previously said the AI report was the only external connection.
- File Integrity no longer reports "OK" when nothing was actually checked.
checked_filesused to be the number of entries in the WordPress.org checksum list, not the number of files compared, and target files that were missing on the site were skipped silently. A site where none of the target files could be read was still reported as "OK".checked_filesis now the number of files actually read and compared. Files outside the check scope (excluded_count) and target files that are missing or unreadable (failed_files/failed_count) are reported separately. - If any target file is missing or unreadable, or no file could be checked at all, File Integrity is now a warning instead of OK.
- When the checksum data cannot be retrieved from WordPress.org, File Integrity is now counted as a warning in the overall grade and in the AI report input instead of as OK, and the card shows the reason instead of "No changes to core files."
- An unreadable core file is no longer reported as "modified, no suspicious code". It is listed as a file that could not be checked.
- A modified file whose contents could not be scanned for suspicious code (unreadable or larger than 1 MB) is no longer described as having no suspicious code. It is counted in
unscanned_count, and the result is not downgraded to OK. - The File Integrity card now says "No changes in the checked core files." and shows how many files were checked and how many were outside the check scope, missing, unreadable or not scanned. The same counts are passed to the AI report.
- Suspicious Files: unreadable PHP files and folders in the uploads directory are now reported separately (
unreadable_files/unreadable_dirs) and keep the result at warning. Previously an unreadable folder stopped the whole diagnosis with an exception. If the uploads directory cannot be found, the result is a warning instead of OK. The number of readable PHP files that were examined is reported asscanned_count. - The admin script is now loaded with the plugin version (1.0.4). Version 1.0.3 still loaded it as 1.0.2, so browsers could keep using a cached older script.
- Site Health no longer shows a permanent warning for issues that are not meant to be fixed on a live site. WordPress core reports "good" when there are no critical issues, but this plugin flagged a warning whenever any recommended item existed. On maintained sites the same recommended items (outdated MySQL on shared hosting, no persistent object cache) are always present, so the warning was permanently on and stopped carrying information.
- Those items are now excluded from the warning and shown separately as "excluded as no action required", with the reason kept. Nothing is silently dropped.
- If an excluded test key never matches (e.g. WordPress renames a test), the unmatched keys are reported so the exclusion cannot fail silently.
- The keys of the remaining recommended items are now included in the result, making it possible to review what should be added to the exclusion list.
- Fixed a major bug: WordPress core Site Health tests were never executed. Core registers its tests as strings (e.g.
'test' => 'wordpress_version') which the caller resolves to aget_test_{$key}()method, so checking onlyis_callable()silently skipped all 22 core direct tests. Only tests added by other plugins were being counted. - Site Health results are now split into WordPress core tests (used for the diagnosis) and tests added by other plugins (shown for reference only). Plugins that report their own features as unconfigured no longer affect the overall grade.
- Site Health test results now pass through the
wp_site_health_test_resultfilter, matching core behaviour. - A Site Health test added by another plugin that throws an exception no longer aborts the whole diagnosis; it is recorded as skipped instead.
- AI report prompt updated so plugin-originated notices are listed as "no action required" instead of appearing as critical items.
- Update Claude model to
claude-sonnet-4-6(the previousclaude-sonnet-4-20250514will be retired by Anthropic on 2026-06-15).
- Initial public release on WordPress.org (forked from the internal
npc-wp-healthcheck0.7.8 series). - 9-point health diagnostics.
- Diagnosis history (last 10 entries) stored as a custom post type.
- WP Cron-based auto-check (daily / weekly / monthly).
- Email notifications on critical issues only.
- Optional AI-powered maintenance reports via Anthropic Claude API (opt-in via
NPCMI_API_KEY). - Full internationalization (English source strings, Japanese translation included).