內容簡介
wpBara Audit 是一款 WordPress 外掛，能夠一鍵檢查網站的安全性、更新、效能及配置，並提供清晰的評分和問題清單，幫助使用者了解網站狀況。
【主要功能】
• 提供安全性、更新、效能及配置的總體評分
• 檢查外掛及佈景主題的安全性及更新狀態
• 顯示資料庫健康狀況及過期的選項
• 生成可分享的報告，支持 PDF 儲存
• 檢查網站的混合內容及安全標頭
外掛標籤
開發者團隊
原文外掛簡介
wpBara Audit checks your WordPress site in one click and shows what needs attention: security, updates, performance and configuration. You get a clear score, a list of issues ordered by importance, and a report you can save as PDF.
The plugin only looks and never changes your site. The report is never stored – it exists only in the browser tab that generated it.
What you get
A score that sets priorities – an overall score from 0 to 100% across Security, Updates, Performance and Configuration, with every issue that lowered it, the most serious first
Plugins and themes checked live against WordPress.org – removed from the directory (often for a security issue, with the date and reason), no release in over a year or two, not tested with recent WordPress versions, updates waiting, and where each one gets its updates from
Missing security releases – whether WordPress is missing a security release of its own version line, and when PHP and the database server stop, or stopped, receiving support
What your site exposes – security headers, log files and configuration files that can be downloaded from a browser, usernames given away by the REST API, XML-RPC, and folder listings
Mixed content, with the addresses – what the home page loads over plain http://, whether the browser blocks it, and http:// resources stored in your posts
Database health – tables on MyISAM or below utf8mb4, heavy autoloaded options, expired transients, trash, spam and posts keeping more revisions than the limit
A report ready to share – print it or save it as PDF
Who it is for
Site owners who want to know where their site stands, and agencies and freelancers who look after client sites. Use it before taking over a site, as a regular check-up, or to show a client what needs fixing and why.
Everything the audit checks
Security
WordPress core: missing security releases of the installed version line, checked live against WordPress.org
Plugins and themes: removed from WordPress.org, unmaintained, and where their updates come from
HTTP security headers (HSTS, X-Content-Type-Options, X-Frame-Options, CSP)
Public access to sensitive files: wp-config.php, .htaccess, .user.ini and log files in the WordPress folder, wp-admin and wp-content
REST API user enumeration, XML-RPC, and folder listings in uploads
Developer leftovers that should not be on a live site: phpinfo.php, .env, SQL dumps, .git folders
PHP errors shown to visitors, secret keys in wp-config.php, and a user named “admin”
End-of-life dates for PHP and the database server
Forms that send visitor data over plain http://
Updates
WordPress core, plugins and themes with pending updates
Time since each plugin’s and theme’s last release, and plugins not tested with the last three WordPress versions
Where each plugin and theme gets its updates from: WordPress.org, its author’s server, or unknown
Whether the server can reach WordPress.org for updates at all
Performance
Autoloaded options, with the largest ones listed
Expired transients, trash, spam, auto-drafts and orphaned metadata
Posts keeping more revisions than the revision limit
Database size, overhead and tables on MyISAM
OPcache, object cache and PHP limits
Configuration
Key WordPress constants with the value actually in effect
WordPress tables below utf8mb4, where emoji and some characters are cut off when saved
Mixed content on the home page and in published posts
The PHP error log: whether it has content and whether errors were written in the last seven days – the entries themselves are never read
Search engine visibility and robots.txt, read the way crawlers read it
Scheduled cron jobs, inactive plugins and unused themes
The report also lists system details, must-use plugins, file permissions, post types, taxonomies, permalinks and content statistics.
Safe and read-only
Only administrators (the manage_options capability) can run an audit
Every request is protected with a nonce, and every database query is a read-only SELECT
The report is never stored on the server
No personal data in the report: no logins, email addresses or registration dates
No server paths, database name, database host or table prefix in the report
No database tables, cron jobs or REST API endpoints of its own
The only thing it writes is a one-hour cache of public WordPress.org answers, removed when the plugin is deleted
Third-party libraries
None. The plugin ships only its own code.
External services
The plugin connects to external services only while an audit is running, never in the background. No site content, credentials or personal data is sent.
Your own site. The audit requests pages and files from your own domain to read security headers, check which files are publicly reachable, test the REST API and XML-RPC, read robots.txt and check the home page for mixed content. These requests stay on your server and are limited to 20 seconds in total.
WordPress.org (api.wordpress.org). Used to check plugins, themes and WordPress core for updates, release dates and removal from the directory.
The plugin and theme information APIs receive the folder name (slug) of each installed plugin and theme – including ones not from WordPress.org, since a removed plugin can only be recognised by asking. Plugins and themes whose Update URI points to another server are skipped. These requests carry no site address.
The core version-check API is read without any parameters.
A connectivity check calls the update endpoints with the same user agent WordPress core uses, which includes your WordPress version and site address.
Answers are cached for one hour.
WordPress.org privacy policy: https://wordpress.org/about/privacy/
Support end dates for PHP and MySQL/MariaDB ship with the plugin and are not looked up online.
About wpBara
wpBara Audit is made by wpBara – taking care of your site. We look after WordPress sites every day: updates, security, backups and performance. If you would rather have someone handle what the report finds, we can help: https://wpbara.com/
