Weio Site Check

Weio Site Check runs eleven read-only checks on your own site and explains every result in plain English: what was found, why it matters, and how to fix it yourself. It changes nothing on your site. What makes it different: most security plugins scan files for known malware signatures. Weio Site Check also looks at what visitors and Google actually receive: spam shown only to a Googlebot user agent, redirects only for visitors arriving from Google, spam URLs in your sitemap, an SSL certificate that is about to expire, and whether a WooCommerce shopper can reach checkout over https. It is one read-only page with no account, no scanning service and no settings to learn. Open Tools > Site Check and click Run checks now. A run takes up to about 30 seconds. The checks

1. HTTPS in WordPress settings: both WordPress addresses start with https://.
2. http to https redirect: the http:// address sends visitors to https:// with a permanent (301 or 308) redirect.
3. SSL certificate: connects to your domain on port 443 from your server and reads the certificate it is given: days until it expires, whether it matches your domain, and whether browsers trust it (self-signed or incomplete chain).
4. Outside-in HTTPS check (optional, off by default): asks the Weio service to load your domain and its www twin from the public internet, the way a visitor would. It also tests the www version of your address, which the local checks do not, and reports what a visitor sees, such as a "Not secure" label. Its view can differ from your server's when your host resolves your own domain to itself or blocks the site from loading itself. If your site is on a subdomain and has no www version, that is reported as normal. See "External services" below.
5. Mixed content: http:// scripts, styles, frames, images and media in your homepage HTML.
6. WordPress core files: compares every core file with the official WordPress.org checksums, and lists extra PHP files in wp-admin and wp-includes.
7. PHP files in uploads: lists PHP files in the uploads folder and flags code patterns that are typical of backdoors.
8. Spam and cloaking signs: looks for injected casino, pharmacy and similar spam text, spam hidden with CSS, spam links, pages shown only to a Googlebot user agent (cloaking), redirects only for visitors arriving from Google, the "Japanese keyword hack", spam URLs in your sitemap, and published posts with spam titles. Single ambiguous words (for example one news headline about a casino) are reported only as "worth a look". These are signs, not proof of a hack. To compare views, the plugin loads your homepage once with a Googlebot user agent from your own server; a firewall may log or block this. Cloaking that checks a visitor's IP address, not only the user agent, cannot be seen from your server.
9. New administrator accounts: administrators registered in the last 30 days.
10. WooCommerce store pages (only when WooCommerce is active): cart, checkout and account pages are set and published, checkout loads for a guest over https, and at least one payment method is enabled. A guest with an empty cart being sent from checkout to the cart is normal and reported as OK.
11. Homepage response time and size, measured from your own server.

Optional daily monitoring (off by default): runs the same checks once a day with WP-Cron and emails the site admin address only when a check newly becomes a problem. What this plugin is not

• It does not remove malware and it is not a firewall.
• A pass is not a guarantee that a site is secure, and a warning is not proof of a hack.
• It loads only your own site's address (and its www version). If a page redirects to another site, the plugin reports the redirect and does not follow it. It never fetches addresses that someone types in.

Privacy Apart from the WordPress.org checksum lookup (WordPress's own service, used by the core file check), nothing is sent outside your site unless you turn on the outside-in check. The plugin has no tracking, no analytics and no ads, and it adds nothing to your public pages. Most checks load your own homepage, sitemap and checkout page from your own server, the same way a visitor would. About Weio Weio (weio.ai) is an AI-operated company that makes this plugin. Next to a check with a problem, the results page shows a "Have Weio fix it" link to a matching paid service: HTTPS and SSL fix ($99 fixed price), hacked site cleanup ($199 for one site; complex cases are quoted first) or WordPress speed fix ($249 fixed price). The HTTPS and speed links also appear next to a warning from those checks; the cleanup link never appears next to a warning. These services are optional; every check and every fix instruction works without them.

1.0.0

• First release: eleven checks, optional outside-in HTTPS check, optional daily monitoring with email on new problems.