Sitelemetry Audit – Security, SEO & AI Readiness Scanner
| 开发者 | ozandikici |
|---|---|
| 更新时间 | 2026年9月27日 16:34 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Security (included in every plan, including Free): DNS and email DNS, WHOIS/RDAP, TLS, HTTP security headers, HTTPS posture, technology fingerprint and, once the site is verified, exposed files, HTTP methods and API exposure. Paid plans add the WordPress checks, port scans and more modules; these need a verified site.
- Technical SEO, AI visibility (AI readiness), Integrations, Accessibility, Performance and Full (all pillars with one blended score) on paid plans.
- Results in WordPress: a status banner, the score and grade, the findings with a severity filter and each finding's evidence, impact and fix.
- Passing checks: the checks that passed, grouped by security module, each with its evidence.
- What was not measured: the checks that did not run, with readable module names and the likely cause when the site's own answers explain it (a redirect, a rate limit, a server error, no answer in time, ports a firewall silently drops, the per-audit script limit), the pages a crawl found but could not assess (for example because robots.txt disallows them), the metrics that were not measured (such as the Core Web Vitals when PageSpeed Insights returns no data), and the individual checks that ended without a pass or fail result (an error, no result, a manual review, not applicable). Unmeasured checks are never counted as passes.
- Copy AI fix prompt: one click copies a prompt built from the result (the findings with evidence and fixes, and what was not measured) for ChatGPT, Claude or your coding assistant. The prompt is built in wp-admin and only copied to your clipboard; nothing is sent. The assistant is asked to answer in your WordPress admin language.
- Verify this site: some checks run only on sites whose ownership is verified. With one click the plugin gets a verification code from Sitelemetry, publishes the verification file for this site and has Sitelemetry check it, so you need no FTP access; it renews the verification automatically when it expires and tells you exactly what to fix when a check fails (for example a server that blocks /.well-known/ or a redirect between www and non-www). Where one-click verification is not available yet, paste the token from the Sitelemetry app instead; a "Test the file" button checks that the file is reachable. On a multisite network only a network administrator can publish the file.
- Dashboard widget with the last score, the findings by severity, a reminder when the site needs to be verified or its verification renewed, and a link to the results. After a weekly audit that needs verification, a notice on the Dashboard and Plugins screens says so until you dismiss it.
- Settings page with a Sign in or create an account button (the Sitelemetry sign-in page, where new users create an account on a free or paid plan) and a link to the page that shows your API key, your Sitelemetry MCP API key (stored in the WordPress options table, shown masked, removable), the target (defaults to your site address), the audit kind and an optional weekly audit through WP-Cron.
- Plan and usage box with the connected plan and what each paid plan includes, read from the public plan catalogue.
/.well-known/sitelemetry-verification.txt on this host with that code and nothing else, tests the file and asks Sitelemetry to check it; the page then says "Verification complete ✓ valid until" and the date, or which problem to fix. A verification lasts 30 days; the plugin renews it automatically in the background (WP-Cron) when it expires or when an audit reports that it must be renewed, never earlier, and shows a notice only if the renewal fails. Remove token stops publishing the file and the automatic renewal until you click Verify this site again or save a token. Where one-click verification is not available yet, the manual steps remain: in the Sitelemetry app open Verified Domains, enter the host and click Start verification, copy the verification code (the token) shown under HTTP verification file, paste it into Verify this site, click Test the file, then click Verify HTTP in the app (renew with Reverify in the app). Without a token the path answers 404. A DNS TXT record or Google Search Console work as alternatives. On a multisite network the web server behind a site's host serves the whole network, so only a network administrator can publish the file there.
Thin client
The plugin bundles no libraries and runs no scanner on your server. It sends requests to sitelemetry.com with the WordPress HTTP API and renders the response. There is no tracking and no analytics.
External service
This plugin relies on the hosted Sitelemetry service (https://sitelemetry.com) operated by Sitelemetry. It sends requests to the service only when you run an audit or after you have stored an API key, as described in the Privacy section below. The terms of service are published at https://sitelemetry.com/terms and the privacy policy at https://sitelemetry.com/privacy.
安装:
- Upload the
sitelemetry-auditfolder to/wp-content/plugins/or install it from the Plugins screen. - Activate the plugin.
- Sign in at sitelemetry.com/app (the settings page's Sign in or create an account button opens it). New to Sitelemetry? Switch to Create account on the same page and choose a plan: Sitelemetry has free and paid plans, and the Free plan includes the security audit. Then open My account, expand Manual connection and API key and copy the API key (the settings page's Get your API key link opens that page).
- Go to Settings > Sitelemetry, paste the key, check the target and save.
- Click Run audit. The results tab updates while the audit runs.
- Optional: click Verify this site on the same page to include the protected checks.
屏幕截图:
常见问题:
Does the plugin scan my site itself?
No. Sitelemetry audits the live target from its own infrastructure. The plugin only starts the audit, polls its progress and shows the result.
What does an audit cost?
A completed audit uses one unit of the monthly allowance of the connected Sitelemetry account. Polling a running audit uses nothing more. Audits that are not started (plan not included, allowance exhausted, verification required) use nothing.
What data does the plugin send, and where?
Only to sitelemetry.com, and only after you store an API key: the target URL, the audit kind and the report language (from your WordPress admin language), authenticated with your API key, plus the plugin's User-Agent. For ownership verification the plugin sends this site's address (scheme and host). No site content, users, visitors, plugin list or WordPress version are sent. "Test the file" requests this site's own verification file from your server and contacts no other host. The Privacy section below lists every request.
Why does the result say "partial" or list checks that were not measured?
Some checks need ownership verification of the target or a plan that includes them, or a measurement was unavailable for the target. The results page lists each of them under "What was not measured", with the likely cause when the site's own answers explain it. Use Verify this site in the plugin settings, a DNS record or Google Search Console to include the protected checks.
How does "Verify this site" work?
Sitelemetry proves that you control a host by fetching https://<host>/.well-known/sitelemetry-verification.txt and comparing it with a token it generated for your account. With one click the plugin requests that token with your API key, serves the file for this site's own host (only for exactly this host and path) and asks Sitelemetry to check it, so no FTP upload is needed; it renews the verification in WP-Cron when it expires and never replaces a verification that is still valid. When a check fails, the page names the cause and the fix: a web server that keeps /.well-known/ for itself, a firewall or password, a redirect between www and non-www, a cached or other file at that path, no answer in time, DNS or TLS problems, too many attempts or a key Sitelemetry did not accept. Where one-click verification is not available yet, paste the token from the app; "Test the file" fetches the file the way Sitelemetry will and reports redirects to another host, 404 answers from the web server, firewall or maintenance pages and wrong content. Local and private sites cannot be verified this way, and subdirectory installs usually cannot; use the DNS record instead. Sitelemetry fetches the default port of the host (443 or 80), so a site that runs on another port must also answer there. On a multisite network only a network administrator (the manage_network_options capability, filterable with sitelemetry_audit_verification_capability) can publish the file, because the server behind the host is shared by the whole network.
Does the AI fix prompt send my data anywhere?
No. The prompt is built by WordPress from the stored result and the button only copies it to your clipboard. It contains the audited address and the findings, never your API key. You decide where to paste it.
Where is the full report?
The results page in WordPress is the result: Sitelemetry does not keep a separate report of audits run through the plugin. Run the audit again to refresh it.
Which languages does the plugin support?
The screens are translated into Turkish, Spanish, German (informal and formal), French, Portuguese (Brazil), Italian, Japanese and Simplified Chinese, and audit results arrive in your admin language when Sitelemetry supports it. The bundled translations work from WordPress 6.0; a language pack from translate.wordpress.org replaces them completely, so strings a pack does not translate yet appear in English. You can improve or add translations at translate.wordpress.org.
How does polling work?
Long audits return a job id. While the results page is open, the browser asks WordPress every few seconds (as Sitelemetry suggests) for one progress step; each step is one request from your server to Sitelemetry with the job arguments unchanged. If you leave the page, a WP-Cron event finishes the job in the background. A total time budget of 20 minutes applies; when a job exceeds it, run the audit again later to get a result.
Where is the API key stored?
In the WordPress options table, like other plugin settings. The settings page shows it masked, it is never written to logs and it is sent only to sitelemetry.com as a Bearer token.
Can I audit a site other than this one?
The target defaults to this site's address and can be changed to any URL you own or are authorized to test. Do not audit sites you are not authorized to test. The verification helper publishes the file only for this site's own host; verify other hosts in the Sitelemetry app.
Does the weekly audit work on a low-traffic site?
WP-Cron runs when the site receives visits. If your host runs a system cron for WordPress (recommended), the weekly audit runs on time regardless of traffic.
更新日志:
- Passing checks: the results page lists the checks that passed, grouped by security module, each with its evidence (full audits included).
- What was not measured: readable module names and the likely cause (redirects, rate limits, server errors, no answer in time, silently dropped ports, the per-audit script limit), with the service's own reason underneath, the pages a crawl could not assess and the metrics that were not measured, and the individual checks without a pass or fail result, grouped by status. Both sections are collapsible.
- Copy AI fix prompt: builds a prompt from the result in wp-admin and copies it to the clipboard; nothing is sent.
- Verify this site with one click: the plugin gets the verification code from Sitelemetry with your API key, publishes the verification file for this site's host, tests it and has Sitelemetry check it, then shows "Verification complete ✓ valid until" the date, or the exact cause and fix of a failure. It renews the verification automatically in WP-Cron when it expires or an audit reports that it must be renewed, and shows a notice only if the renewal fails. Where the service does not offer one-click verification yet, the manual helper (paste the token from the app, Test the file) stays as before. On multisite, only network administrators can publish the file.
- Settings: a "Sign in or create an account" button (the Sitelemetry sign-in page; new users create an account there on a free or paid plan) and a "Get your API key" link for a first setup.
- The running-audit status line is the plugin's own; it no longer shows the service's instructions for AI clients.
- Translations: Turkish, Spanish, German (informal and formal), French, Portuguese (Brazil), Italian, Japanese and Simplified Chinese ship with the plugin (WordPress 6.0 and later); translate.wordpress.org language packs take precedence.
- Audits are requested in your WordPress admin language when Sitelemetry supports it.
- Removed the "Open the full report" link and the remaining-scans lines: the service returns neither to the plugin, and no text promises a report in the app anymore.
- New directory name: Sitelemetry Audit – Security, SEO & AI Readiness Scanner. The slug and settings are unchanged.
- Plugin URI now points at the plugin repository; the author URI stays sitelemetry.com (WordPress.org requires the two to differ).
- Tested with WordPress 7.1. Plugin Check (all categories) passes without errors or warnings.
- Description and Privacy sections link to the exact terms and privacy policy pages.
- First release: settings page, manual audits with progress polling, results page with severity filter and coverage notes, dashboard widget, optional weekly audit, plan and usage box.