Proactive Site Advisor – Privacy‑First Anomaly Alerts

Your site talks. Don't wait until it screams. Most site problems — ranking drops, broken links, bot attacks — don't show up in your dashboard. They simmer silently until a visitor complains or your SEO takes a hit. Proactive Site Advisor acts as your first line of defense, scanning your site daily and alerting you the moment something goes off track. No Google Analytics needed. No external services. No complicated dashboards. Just clear, actionable alerts inside WordPress. Why Proactive Site Advisor? Alerts you can actually act on When an anomaly is detected, you don't just get a number. You get a human-readable summary that tells you what changed, what it means, and exactly what to check next. Here’s a real example of a traffic drop alert:

Traffic — August 2, 2026 Traffic dropped 41% Your human traffic decreased sharply compared to recent activity. What this means: A decrease in human traffic means fewer real visitors reached your site compared to your normal activity. This does not always indicate a problem and can happen after website changes, availability issues, visibility changes, broken links, or changes in visitor behavior. Why this alert? The decrease exceeded your configured threshold of 30% by a significant margin, indicating an unusual deviation from your recent traffic pattern. Today: 445 · 7-day average: 754 · Change: -41% Pattern: This alert has appeared for the second consecutive day. Related activity: Detected together with: 404 Errors, Bot Activity. What you should check next: - Verify that your most important pages are available and responding correctly. - Review major recent changes, migrations, deployments, or settings updates that may have affected visitor access. - Check that your site is loading normally and important pages are accessible. - Review recent content updates, deleted posts, or changes to important pages.

404 alerts include the top 3 broken URLs with fix suggestions. Bot alerts list the top 3 crawlers by name with visit counts and context. This is just the beginning. We're actively building new alert types based on real user feedback — slow page detection, server error monitoring, and more — so your site advisor gets smarter over time. Built for privacy and performance The plugin never phones home. All data is collected, summarized, and stored inside your own database. We use lightweight tables that hold only the last 7 days of aggregated metrics. No personal visitor data is ever saved. No cookies. No front‑end scripts. GDPR‑friendly by design. Zero‑configuration monitoring Install, activate, done. The plugin starts logging and comparing data from day one. No API keys, no tracking codes, no setup wizard. It just works. Features

• Bot anomaly detection – Detects unusual crawler activity with top bot names and auto-corrected traffic counts.
• Built-in rate limiting – Mitigates aggressive scraping and bot floods in real-time.
• Human traffic monitoring – Drops or spikes compared to the previous 7‑day average.
• 404 error surge alerts – Top 3 broken URLs with hit counts and fix suggestions.
• Actionable recommendations – Every alert includes a "What you should check next" list.
• Daily WP‑Cron scans – Automatic checks after each full day.
• 100% local processing – No external APIs, zero data leaves your server.
• Atomic database operations – Reliable metric collection without race conditions.
• Accurate bot detection – 1,500+ bot signatures, updated regularly.
• Future‑ready – More anomaly types (slow pages, server errors, plugin conflicts) are planned.

Privacy & Performance by Design

• Truly self‑hosted – All statistics stay in your WordPress database. We never see your data.
• No personal data – Only daily summaries. No IP addresses, no cookies.
• Ultra‑light footprint – Lightweight background processing, zero front-end impact.
• GDPR/CCPA friendly – No cookies, no cross‑site tracking, no consent banner needed for monitoring.

Who is Proactive Site Advisor for?

• Site owners who hate surprises – Know the moment traffic dips or errors rise, before clients notice.
• Agencies managing multiple sites – Proactive alerts let you fix issues before reports go out.
• SEO and content teams – Catch 404s and broken links instantly, protecting your rankings.
• Privacy‑conscious WordPress users – Get site insights without giving data to third parties.

Installation

1. Download the plugin zip file.
2. In your WordPress dashboard, go to Plugins → Add New → Upload Plugin.
3. Choose the zip file and click Install Now, then Activate.
4. Visit the new Site Advisor menu in your admin sidebar.

That's it. No configuration pages to fill out, no API connections to set up. Proactive Site Advisor starts monitoring immediately.

1.2.0

• New: Daily Email Digest – automatic daily email summary after cron run when alerts are detected.
• New: Email content includes total alerts, alert types with percentage changes, recommendations summary, and direct link to alerts dashboard.
• New: Email settings – enable/disable, recipient email (default: admin email), and alert type checkboxes (Traffic, 404, Bot).
• New: Three-level severity for traffic spike alerts – info, warning, and critical (previously only info).
• New: Severity now dynamically calculated based on spike intensity relative to user‑defined threshold.

1.1.1

• New: AcceptEncodingDeflateSignal – dedicated signal for missing deflate in browser Accept-Encoding headers.
• New: SecFetchSiteNoneWithRefererSignal – dedicated signal for detecting contradictory Fetch Metadata and Referer headers.
• New: Http2CleartextUpgradeSignal – detects non-browser HTTP/2 cleartext upgrade attempts.
• New: SecFetchUserSignal – detects missing Sec-Fetch-User header on top-level navigations from modern browsers.
• New: Alert patterns – highlights recurring changes over recent days.
• New: Related activity context – shows when multiple anomaly types are detected together.
• New: Centralized alert text definitions into the alerts.php configuration file, adding shared alert strings and improving message consistency.
• New: Improved alert explanations with clearer context, severity details, and actionable next steps.

1.1.0

• New: Admin settings page with Alerts and Thresholds sections
• Improved: Settings validation and sanitization with range limits (5–100%)
• New: BehavioralSignal – detects bots with unnaturally regular request timing
• New: Definitive bot detection for IPs rotating 4+ distinct User-Agents
• Improved: Accurate burst rate detection without timestamp interference
• Removed: Redundant scoring logic from BrowserHeadersSignal
• Bot detection: Separated hard bot signals from suspicion scoring – high‑confidence signals now trigger direct bot classification.
• Firefox support: Extended missing client‑hints detection to modern Firefox browsers.
• Tuning: Improved burst detection sensitivity for 3‑request‑in‑2‑second patterns.
• Performance: Removed redundant per‑request scoring cache.
• New: ClientHintsSignal – dedicated signal for Sec-CH-UA header analysis
• New: AcceptLanguageSignal – dedicated signal for Accept-Language analysis
• New: FetchHeadersSignal – dedicated signal for Sec-Fetch-* header analysis
• New: DistinctUserAgentSignal – dedicated signal for multi-UA detection
• New: MissingHeadersSignal – score for missing common browser headers
• New: BrowserHelper – centralized browser detection utility
• New: ClientHintsHelper – centralized Client Hints analysis utility
• Improved: Cleaner signal architecture with focused, single-responsibility classes
• Improved: Better code maintainability and testability through class decomposition
• Removed: Monolithic FingerprintSignal – split into 5 focused signals
• Code Quality: Refactored signal architecture following SOLID principles
• Code Quality: Centralized browser and client hints logic in dedicated helpers
• Fixed: Opera browser no longer incorrectly flagged as suspicious due to Client Hints version mismatch.
• Fixed: RefererConsistencySignal no longer penalizes cross‑site navigations with missing Referer header.
• Fixed: Baseline calculation now includes the fully completed day (stats_date <= %s) instead of excluding it, ensuring accurate 7‑day averages for anomaly detection.
• Fixed: Dashboard no longer displays incomplete current day data – history and averages now only include fully completed days.
• Fixed: Alert severity (critical/warning) is now dynamically calculated based on user‑defined thresholds, making severity levels consistent with each site’s custom settings.
• Fixed: Empty top_404_json or top_bots_json values no longer result in malformed alert metadata – now properly handled as empty arrays.
• Fixed: FOR UPDATE locking in markAsBot() is now wrapped in an explicit transaction, eliminating race conditions under concurrent requests.
• Removed: Deprecated and unused analyzer classes (TrafficAnalyzer, Error404Analyzer, BotTrafficAnalyzer) – their logic is fully covered by the new Generator architecture.

1.0.8

• New: Atomic rate counter for burst detection without race conditions
• New: Daily fingerprint tracking to retroactively correct bot pageviews
• Improved: Burst detection now reliable under heavy concurrent requests
• Improved: PHP 8.1+ compatibility – fixed pathinfo(null) deprecation
• Improved: Real-time bot traffic correction – human counts no longer inflated
• Database: Added transferPageviewsToBot() for accurate daily corrections
• Retention: Automatic cleanup of expired rate counters and old fingerprints (7‑day window)
• Fix: RateCounter no longer returns 0 after immediate read (burst detection reliability)
• Code quality: Centralized fingerprint generation in HeaderReader
• Performance: All rate counting now atomic and fully self‑contained
• New: Detection of browser version mismatch between User-Agent and Sec-CH-UA headers
• New: Detection of IPs rotating multiple User-Agents within a short window
• Improved: Suspicion score threshold lowered to catch more advanced bots

1.0.7

• Improvement: Fine-tuned bot fingerprinting for better precision.

1.0.6

• Fix: Daily metrics now stored in durable database (prevents data loss on cache clear)
• Fix: Incorrect bot classification on local development environments
• Database: Added atomic increment and JSON map update methods for reliable metric collection
• Performance: Removed cache-to-database sync cron (data written in real‑time now)
• Stability: Eliminated race conditions using atomic database operations
• Improvement: Simplified browser validation for accurate localhost testing
• Improvement: Enhanced bot detection accuracy with refined User-Agent analysis (reduced false positives)
• Performance: Unified cache clearing on install, update, activation, and deactivation
• Performance: Optimized lifecycle operations for better reliability

1.0.5

• Fix: Database table creation bug on activation resolved
• Update: Bot detection patterns upgraded with 1500+ new signatures (GPTBot, ClaudeBot, AmazonBot, etc.)
• Improvement: Better User-Agent parsing and reduced false positives
• Performance: Faster bot detection with lower memory usage
• Stability: Improved error handling for DB updates and cron jobs

1.0.4

• Feat: Bot traffic detection – separate human vs bot pageviews
• Feat: Bot anomaly alerts – spike/drop with Top 3 bots
• Dashboard: New “Bot Alerts” KPI card and bot pageviews column in history
• Dashboard: Bot alert cards with top bot names and recommendations
• Performance: Combined 1500+ bot pattern regex in a single static file
• Database: Added bot_pageviews and top_bots_json columns to daily_stats

1.0.3

• Fix: Alert messages now fully translatable via WordPress i18n
• Database: Removed redundant “title” column

1.0.2

• Added RTL support for admin dashboard

1.0.1

• Fix: Prevented duplicate alerts in digest cards
• Feat: Added percentage change for 404 errors

1.0.0

• Initial release
• Traffic drop/spike detection
• 404 surge detection with Top 404 URLs
• Dashboard (critical issues, digest, alerts, 7‑day history)
• Actionable recommendations
• Daily WP-Cron scans