NX::Site SEO Audit
| 开发者 |
netsolex
gaichenya |
|---|---|
| 更新时间 | 2026年8月31日 05:08 |
| PHP版本: | 7.4.3 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
NX::Site SEO Audit is a professional, all-in-one SEO and site health toolkit for WordPress. With a global SEO Site Score (0–100), page-by-page status classification, advanced DB Optimizer, Security Tools, full database Backup & Restore, CSS/JS Minification Analyzer, multilingual support in 6 languages, and automatic email notifications for new critical issues.
Developed by NETSOLEX — https://www.netsolex.com
安装:
- Download the plugin ZIP file.
- In your WordPress admin go to Plugins → Add New → Upload Plugin.
- Choose the ZIP file and click Install Now.
- After installation click Activate Plugin.
- Navigate to Site SEO Audit in the left admin menu to start your first audit.
nx-site-seo-audit folder to /wp-content/plugins/ and activating from Plugins → Installed Plugins.屏幕截图:
常见问题:
Does this plugin work with page builders?
YOOtheme — Tested and fully compatible. Elementor — Not yet formally tested. The plugin operates at the WordPress core level (hooks and meta), so it should work in most cases, but compatibility is not officially guaranteed. WPBakery (Visual Composer) — Not yet formally tested. Same considerations as Elementor apply. Divi — Not yet formally tested. Same considerations as Elementor apply. If you use one of the above builders and encounter issues, please report via the support tab.
What web server does this plugin support?
Apache — Fully tested and supported. .htaccess management features require Apache mod_rewrite.
NGINX — Not officially tested. The .htaccess and robots.txt file management features may not behave as expected on NGINX servers, as NGINX does not use .htaccess files. Other features (SEO audit, meta tags, backup) should still function normally.
Does the plugin slow down my site?
No. All audit operations run on demand from the admin area. The only frontend output is the meta tags injected into <head> (if NX Meta Generator is enabled for a page), which is negligible.
Will my data be deleted when I deactivate the plugin?
By default, no. You can enable the option Delete plugin database tables on deactivation from Settings if you want a clean uninstall.
Does it work with WooCommerce?
The plugin includes a dedicated eCommerce auditor (class-ecommerce-auditor.php) and can audit WooCommerce product pages when the product post type is added to the audit scope in Settings.
What PHP version is required?
PHP 7.4.3 or higher. PHP 8.3+ is recommended for best performance.
Is the plugin free?
Yes. Free for personal use without limits. Not licensed for commercial resale or redistribution.
更新日志:
5.3.0
- COMPLIANCE — Removed the free-form "paste your own code" input from the CSS/JS Minify & Unminify tool. It now only works on real, already-published CSS/JS files fetched from the site itself (via "Send to Minifier"), never on arbitrary typed/pasted code. The duplicate minifier previously also present in DB Optimizer has been removed; there is now a single tool, in Minify Analyzer.
- SECURITY — Inline JSON passed to the Dashboard's charts (
wpsapPagesData,wpsapIssuesData) is no longer emitted with unescaped forward slashes, preventing a</script>sequence in page titles/URLs/issue text from being able to break out of the inline script block. - CODE QUALITY — Added a defensive shutdown-time safety net that flushes any output buffer the plugin may have left open, on top of auditing every ob_start()/ob_get_clean() pair in the codebase to confirm none of them can be interrupted by another component mid-buffer.
- Renamed an unprefixed transient key in the upsell cache to use the plugin's own prefix.
- SECURITY/COMPLIANCE — Removed the wp-config.php raw code editor entirely. The plugin no longer offers any screen that saves free-form PHP into wp-config.php, .htaccess, or robots.txt. This also removed the associated backup/restore-by-timestamp feature for that editor, which is no longer needed.
- COMPLIANCE — The plugin no longer writes to any file at the WordPress site root. The "Preventive Settings" tool in DB Optimizer (post revisions, autosave interval) now generates a ready-to-paste code snippet instead of editing wp-config.php directly. The Table Prefix Rename tool renames the database tables (unchanged) but no longer patches wp-config.php automatically; it now shows the exact $table_prefix line to paste in manually.
- COMPLIANCE — robots.txt is now managed virtually through WordPress core's own
robots_txtfilter when no physical robots.txt file exists at the site root, instead of writing a physical file. If a physical robots.txt already exists (owned by the site or another plugin), this plugin only offers to manage its file permissions and does not touch its content. - COMPLIANCE — .htaccess changes (Force HTTPS redirect, initial file creation) now go through WordPress core's own
insert_with_markers()andsave_mod_rewrite_rules()functions instead of manual file read/write. - SECURITY — Completed a full sanitization pass across all AJAX and form-submission handlers: every
$_POST/$_GETvalue is now explicitly wrapped withwp_unslash()before the appropriate sanitization function (sanitize_text_field(),sanitize_email(),sanitize_key(),absint(), etc.), including IP-detection headers used internally for rate limiting. - CODE QUALITY — Removed now-unused database-stored file-backup helper functions left over after the wp-config.php editor removal.
- SECURITY — SMTP password now encrypted at rest. The SMTP password configured in Settings was previously stored in plain text in the WordPress database via update_option(). It is now encrypted using openssl_encrypt() with AES-128-CBC and WordPress-unique keys (wp_salt + AUTH_KEY) before being saved. The password is decrypted transparently when the mailer uses it. Falls back safely if OpenSSL is unavailable on the server.
- SECURITY — SSRF protection added to Minify Analyzer endpoints. The AJAX endpoints that fetch CSS/JS assets accepted a URL from $_POST without validating the resolved IP address, which could allow requests to private or loopback network ranges. A new is_private_ip() helper now blocks requests to 127.0.0.1, 192.168.x.x, 10.x.x.x, 172.16.x.x and all reserved ranges using PHP's FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE before any HTTP request is made.
- CODE QUALITY — Documented sslverify disabled across all audit classes. Ten instances of 'sslverify' => false across class-ajax-handler.php, class-sitemap-generator.php, class-core.php, class-links-auditor.php, class-page-speed-auditor.php, and class-ecommerce-auditor.php now include inline comments explaining that SSL verification is intentionally disabled to support auditing of sites running on self-signed or locally-issued certificates in staging and local development environments.
- BUG FIX — NX Meta Generator missing
<title>tag on frontend: The SEO Title field was saved and visible in the NX Meta Generator preview, but the<title>tag was never injected into the actual page<head>. Addedpre_get_document_titlefilter to override the WordPress default title, and added explicit<title>output insideoutput_meta_tags()when NX Meta Generator is enabled for a post/page.
- Stable release. Meta Tags Generator with full Open Graph, Twitter Card, Schema.org, and robots directive support.
- NX Meta Generator full-screen editor mode.
- Sitemap Generator with WP-Cron support.
- DB Optimizer with protected transient cleanup.
- Security Tools: XML-RPC disable, .htaccess, robots.txt, wp-config.php management.
- Backup & Restore with protected uploads directory.
- Multilingual support: ES, DE, FR, IT, PT.
- Internal Link Graph visualisation.
- Keyword Cannibalization Detector.
- Duplicate Content Detector.
- Image Converter (WebP batch conversion).
- Email Notifications with custom SMTP.
- Rate Limiter and Admin Auth (NX Plugin Administrator).