Sysadmin Total Suite

No. It does not write to or delete any file inside wp-admin , wp-includes or the site root. The integrity section is a read-only report: it tells you which core files differ from the official ones and can show you the diff, but repairing them is left to WordPress itself through Dashboard > Updates > Reinstall now.

Outside the core, it only writes in the uploads directory (resolved at runtime with wp_upload_dir() ):

• The cached copy of the official WordPress package used for the diff, in its own folder. It is a public file; the folder carries an .htaccess and an index.php against listing, and it is removed when you purge the cache or uninstall the plugin.
• The quarantine of the Unused media section, only when you move media items to it. Its folder name includes a random key, so its files cannot be reached by guessing the address (an .htaccess file is not applied by every web server, for example nginx). Uninstalling the plugin restores everything that is still in quarantine.

No. It contains no PHP or JavaScript editor, no file manager, no upload form and no field where code can be entered. It never calls eval() , base64_decode() , exec() or any dynamic include, and it does not generate or execute code.

To show a real diff, the original file is needed. The plugin downloads the official package for your exact version and locale from WordPress.org — the same source WordPress itself uses — and reads the single file being compared straight out of it. Nothing from the download is executed and nothing is written outside the uploads cache.

It looks for references to every media item, by ID and by file name in any size, in the content of posts, pages and templates, in custom fields (ACF, Elementor and other page builders, WooCommerce galleries), in the site options (logo, site icon, widgets, theme settings) and in term and avatar data. Only items with no reference at all are reported. It cannot see images used only from theme files, from other websites or in emails, so review the list before moving anything, and check the site while items are in quarantine.

The media item stays in the database but is hidden from the media library, and all its files (every thumbnail, the original image before scaling, edited copies and WebP/AVIF copies made by optimization plugins) are moved to a folder inside uploads. Right before moving, the plugin checks again that nothing references the item. Restoring moves the files back without ever overwriting an existing file. “Empty quarantine” deletes the items permanently with WordPress’s own wp_delete_attachment() , which also lets other plugins clean their data.

They are the copies of the original images that image optimization plugins such as LiteSpeed Cache keep so that you can restore them. They are not orphans: if you no longer need them, remove them from that plugin, not by FTP.

Yes, the ZipArchive extension is needed to show the differences of a modified file against the official package. The integrity analysis itself works without it.

The query time is only available when the SAVEQUERIES constant is enabled. The number of queries and the remaining timings are shown regardless.

Some sites run the international WordPress package while their locale is set to another language. In that case a few files (for example wp-includes/version.php , which carries $wp_local_package in translated packages) differ from the localized checksums without anything being wrong. The plugin compares against the international package as well before reporting a file, so this no longer produces a false positive.

LiteSpeed caches at server level and does not use WP_CACHE or advanced-cache.php . The plugin detects that case and shows its real status; you can confirm it with the x-litespeed-cache: hit response header.

No. The User-Agent can be spoofed, which is why the 403 blocking complements, but does not replace, the robots.txt opt-out.

Because it contacts an external service (WPVulnerability). WordPress.org guidelines require your explicit consent before a plugin sends data to a third party, so you have to enable it in the Audit section. Plugin and theme slugs are sent, and the WordPress version for the core check; the comparison with your installed plugin and theme versions is done locally.

No. It only means that the database has no public report affecting the installed version. Keep WordPress, plugins and themes updated and remove the ones you do not use, including inactive ones: their files are still on the server.

It is a premium or custom plugin or theme that is not hosted on WordPress.org, so its updates and closure status cannot be checked there. Its vulnerability check still runs by slug, but if a different plugin or theme shares that slug the result may not apply.

The plugin adds up the size of the files it can read inside the WordPress installation and the size of its database tables. Your hosting quota may also count email, logs, other sites or the space taken by file system blocks, and some folders may not be readable because of their permissions (they are flagged in the report).

No. It is a read-only report.

No. It only reports. Updates are installed from Dashboard > Updates, which is WordPress’s own mechanism.