SteadyScore
| 开发者 | steadypress |
|---|---|
| 更新时间 | 2026年7月4日 04:35 |
| PHP版本: | 8.1 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Rating & reviews — the plugin's WordPress.org star rating and review volume.
- Active installs — how widely the plugin is deployed and trusted.
- Update recency — how recently the author last shipped a release.
- Compatibility — tested-up-to against your version of WordPress.
- Security — known vulnerabilities, via Wordfence Intelligence.
- Author reputation — the author's track record across their whole portfolio.
- A reliability score, 0–100, for every plugin listed on WordPress.org.
- The full six-factor breakdown for each plugin, with a plain-English recommendation.
- Known-vulnerability data from Wordfence Intelligence (add a free key of your own).
- Lifecycle flags — abandoned, removed from WordPress.org, or not updated in 2+ years.
- A sortable dashboard with risk / active / in-use filters and CSV export.
- Background scoring through Action Scheduler — no wp-cron load, nothing on your front end.
- Reliability scoring for commercial & closed-source plugins — LearnDash, WP Rocket, premium Gravity Forms add-ons, and the like — via the SteadyPress API.
- AI-powered upgrade & replacement recommendations for the plugins that need attention.
- Google Sheets export of the full audit.
- Scheduled monitoring with monthly email alerts on score drops and newly disclosed vulnerabilities.
- wordpress.org plugin API (
https://api.wordpress.org/plugins/info/1.2/) — to fetch plugin metadata (rating, install count, last-update date, tested-up-to version). No personal data is sent; only plugin slugs. Used on first install to score the inventory, and on a daily refresh thereafter. Documented at https://codex.wordpress.org/WordPress.org_API. - Wordfence Intelligence API (
https://www.wordfence.com/api/intelligence/v3/) — to fetch vulnerability data for installed plugins. Requires a free API key from wordfence.com, which you configure in plugin settings. No personal data is sent; only plugin slugs. Wordfence Intelligence terms: https://www.wordfence.com/products/wordfence-intelligence/
- SteadyPress API (
https://api.steadypress.ai) — to score commercial plugins, run AI analysis, and validate your license. Only the plugin slug, version, your site's domain, and your license key are sent. SteadyPress terms: https://steadypress.ai/terms/ · SteadyPress privacy: https://steadypress.ai/privacy/.
安装:
- Install SteadyScore from the Plugins → Add New screen, or upload the
steadyscorefolder to/wp-content/plugins/. - Activate the plugin.
- Open SteadyScore in the WordPress admin menu — it begins scoring your installed plugins automatically, and the dashboard fills in within a few minutes.
- (Optional) Add a free Wordfence Intelligence API key under SteadyScore → Settings to include vulnerability data in scores.
- (Optional) Activate a Pro license to unlock scoring for commercial plugins and AI recommendations.
屏幕截图:
常见问题:
Will SteadyScore change, deactivate, or remove any of my plugins?
No. SteadyScore is strictly read-only — it reads your plugin list, scores each one, and shows you the results. It never activates, deactivates, updates, or deletes anything. Acting on a score is always your decision.
Does it slow down my site?
No. Scoring runs in the background through Action Scheduler (not wp-cron), and results cache for 12 hours, so your admin screens stay fast. Nothing runs on your front end, and nothing is added to page loads for your visitors.
How is the SteadyScore calculated?
It's a weighted composite of six factors: rating & reviews, active installs, update recency, tested-up-to compatibility, known vulnerabilities, and author reputation. The exact weights and formulas are transparent and live in the plugin source under includes/free/Scoring/ — no black box.
A plugin I rely on has a low score. Should I remove it?
Not necessarily — a low score is a prompt to look closer, not an automatic verdict. Open the plugin's detail panel to see which of the six factors pulled it down. An open vulnerability or a plugin abandoned two years ago is far more urgent than a modest install count. SteadyScore surfaces the risk; you decide what to do with it.
Why do some plugins show "needs Pro" instead of a score?
Those are commercial or closed-source plugins (LearnDash, WP Rocket, premium add-ons) that aren't in the WordPress.org directory, so the free data sources can't score them. They still appear in your inventory; the Pro addon scores them via the SteadyPress API.
Where does the vulnerability data come from?
From Wordfence Intelligence. Add a free Wordfence API key under Settings to include known-vulnerability data in the Security factor. Without a key, that one factor is simply left out and the score is composed from the other five.
Does this plugin send data about my site anywhere?
The free tier only contacts the public WordPress.org plugin API and — if you add a key — the Wordfence Intelligence API. Both send nothing but plugin slugs: no personal data, no site URL. The Pro tier additionally contacts the SteadyPress API to score commercial plugins and validate your license (see our privacy policy: https://steadypress.ai/privacy/). The free tier never contacts SteadyPress.
Can I use it on client sites?
Yes. Agencies and consultants run SteadyScore as part of client-site audits, and the free tier has no site limit. The Pro addon adds the commercial-plugin scoring and exportable reports that audits usually call for.
更新日志:
- Pro: new "Re-check license now" button on the license screen — refreshes license status immediately after renewing or changing domains, instead of waiting for the 12-hour cache.
- Pro: license revocations (released domain, expired or deactivated license) now disable Pro features promptly instead of coasting on cached status.
- Pro: AI analysis reliability — long-running custom-plugin analyses keep a 90-second window, and failed analyses show an honest error with a one-click "Retry AI analysis" action.
- Pro: clearer AI failure messaging — unknown failures no longer mislabeled as "No readable source code found".
- Security hardening (WordPress.org plugin review): Google Sheets / Google OAuth / AI analysis REST routes are no longer registered in the free plugin — they are Pro-only and now ship exclusively with the Pro build.
- Security hardening: the Google OAuth callback now requires a one-time state nonce minted when an administrator starts the connect flow. The nonce is bound to the initiating admin, compared in constant time, consumed on first use (replays rejected), and no site state is modified without it.
- Free-tier punch-list polish across the dashboard and detail slide-over.
- Security factor reweighted; renamed to a clear "Security" label in the breakdown.
- AI recommendation quality rework for more accurate, actionable verdicts.
- OAuth connect flow hardened with an HMAC state token.
- Commercial (paid) plugins now gated with honest "rating data unavailable" messaging instead of a blank score.
- Plugin lifecycle detection: removed-from-WordPress.org (abandoned), not-on-WordPress.org (off-repo), and not-updated-in-2+-years (stale) states now surface as badges and detail copy.
- Pro build now identifies as "SteadyScore Pro".
- Plugin toggle and assorted UI fixes.
- Initial public release.
- Scoring engine with six factors and five scoring paths.
- WordPress.org plugin API integration (Path 1).
- Wordfence Intelligence vulnerability data (when API key configured).
- Background scoring via Action Scheduler (no wp-cron load).
- Dashboard with filtering, sorting, slide-over detail panel, CSV export.
- Optional Pro tier: commercial plugin scoring, AI recommendations, Google Sheets export, scheduled monitoring, email alerts.