Technical Site Auditor scans your WordPress site the way visitors and search engines see it and reports technical problems in SEO, performance, security, accessibility, database health, e-mail deliverability and WooCommerce store setup. Every issue explains what was found, why it matters and how to
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 5.8 and PHP 7.4.
SourceWordPress plugins · Nov 15, 2026
01 / Source details
Aboutthistool.
Technical Site Auditor scans your WordPress site the way visitors and search engines see it and reports technical problems in SEO, performance, security, accessibility, database health, e-mail deliverability and WooCommerce store setup. Every issue explains what was found, why it matters and how to fix it step by step. The free version fixes everything except search visibility and WooCommerce: 67 one-click fixes, every one of them undoable.
A scan only reads. Nothing on your site changes until you apply a fix, and every fix records what it changed so you can undo it under Fixes → Applied & history.
The free version runs 251 checks in 26 groups, plus up to 6 page-builder checks when Elementor or Divi is installed and 12 WooCommerce store-setup checks when WooCommerce is active. Premium adds the search-visibility and WooCommerce fixes, 41 WooCommerce catalogue and store-operations checks, automation (scheduled scans, regression monitoring, scheduled maintenance, plugin-status alerts), backups and the Redirect, Meta and Breadcrumbs tools.
Key Features
Scanning and reporting * Scans your pages over HTTP in batches, up to 5,000 URLs per scan by default (filterable); site-wide facts such as robots.txt, sitemaps, headers and the database are checked once per scan * Problems that come from your theme and repeat on most pages are reported once for the whole site, with sample pages * Scan completeness: how many pages could not be read and why, so a clean result never hides pages that were never checked * Issues by page or by check, with Open, “Fix active, still detected”, Ignored and Resolved tabs and filters for severity, category, fix type and text * “Re-check this URL” verifies one page without a full scan; ignore a check everywhere or mark issues as resolved * New-since-last-scan markers with the date each issue was first seen, a site health score on the Overview, and CSV export of the filtered list
Content and SEO * Titles, meta descriptions, headings, thin content, duplicate titles and descriptions across the whole site * Open Graph and Twitter Card tags, social image size, Schema.org structured data * Canonical tags (including canonicals that point to a redirect or a noindexed page), noindex on important pages, X-Robots-Tag headers, robots meta conflicts, hreflang * robots.txt rules and syntax, XML sitemap contents and size limits, published pages missing from the sitemap, plain permalinks * Indexable internal search results, a duplicate author archive on single-author sites, classic themes without title-tag support * Broken internal links, links through redirects, orphan pages, redirect chains and loops; external links checked with retries so a slow or bot-blocking site is “could not be verified”, not broken * Sample content left published, links to development hosts, dead goo.gl links
Performance * Images: dimensions, lazy loading, srcset, alt text, WebP/AVIF delivery, priority hints for the largest image * Render-blocking CSS and JavaScript, file counts, cache busting, page size, DOM size, speculative loading * Fonts (font-display, preconnect, Google Fonts), iframes (lazy loading, titles, dimensions) * Server: PHP support status by date, compression, HTTP/2, TLS version, certificate validity and expiry, object cache, OPcache
Security * HTTPS, HTTP-to-HTTPS and www redirects, HSTS strength, mixed content on HTTPS pages * HTTP security headers verified with real requests * Downloadable sensitive files (.env, .git, wp-config.php backups, database dumps, phpinfo, Adminer), confirmed by their content * Missing or default authentication salts, PHP errors shown to visitors, XML-RPC, user enumeration, the file editor, debug.log exposure, directory listing, PHP execution in uploads, wp-config.php permissions, open registration with an elevated role
Accessibility, database and hygiene * Form labels, alt text on linked images, empty buttons and links, skip links, zoom blocked by the viewport tag, iframe titles, the page language * Autoloaded options, revisions, spam, trash, expired transients, orphaned metadata and cron events, table engine, fragmentation, utf8mb4, Action Scheduler bloat * Plugins and the active theme (and its parent) closed or removed on WordPress.org, abandoned, untested or with pending updates, and a “changed since last time” panel
AI visibility and e-mail deliverability * Which AI crawlers your robots.txt allows, blocks or does not mention, and whether an llms.txt file exists * SPF and DMARC records present and valid, a mail server (MX) for the sending domain, a DKIM key at common selectors, and “WordPress could not send email” when the last e-mail failed * Send test e-mail (Settings → Advanced): whether wp_mail() succeeded, the error, the From address and whether PHP mail() or SMTP was used
WooCommerce * Free, when WooCommerce is active: cart, checkout and account pages set up, not cached and not indexable; terms and privacy pages; payment method; tax; REST and Store API exposure; the legacy API; webhooks over plain HTTP; checkout over HTTPS * Premium: products, variations, shipping, stock, reviews, cart fragments, sessions, Action Scheduler failures, a payment method in test mode on the live site, pending database updates, outdated template overrides, order e-mails switched off, HPOS compatibility mode, missing tax rates, large logs and product images without alt text
One-click fixes in the free version
The free version fixes everything except search visibility and WooCommerce. Its 67 fixes each record what they change and can be undone under Fixes → Applied & history:
Security hardening and headers: security headers, HSTS, upgrade-insecure-requests, deprecated headers, PHP execution in uploads, sensitive files, install.php, directory listing and debug.log. .htaccess changes are backed up, the site is tested after the change and the change is rolled back if it breaks the site; on nginx the fix says why it cannot be applied
More security: XML-RPC, the file editor, version disclosure, user enumeration, PHP errors, a safe default role, rel=”noopener”, readme.html, minor core auto-updates, Application Passwords, pingbacks, a REST API login requirement, a redirect to HTTPS and the main host, wp-config.php permissions
Database cleanups with 30-day restore: revisions, spam, trash, expired transients, orphaned metadata and cron events, auto-drafts and Action Scheduler history are saved before deletion and can be restored for 30 days. Plus autoloaded options, MyISAM to InnoDB, utf8mb4, table optimisation and a revision limit
Performance: emoji scripts, oEmbed discovery, head clutter, jQuery Migrate, deferred JavaScript, font-display and preconnect, lazy-loaded iframes, comment-reply.js only where needed, speculative loading, WebP for new uploads, GZIP, browser caching, Elementor and Divi optimisations
Cleanup, content and accessibility: comments, dashboard widgets, the admin bar, unused widgets, the welcome panel, update notices; http:// URLs rewritten to https:// in the database (serialization-safe), staging URLs, mailto: links, sample content, self-pingbacks, the HTML lang attribute and a skip link
Free vs Premium
Every check is free except the WooCommerce catalogue checks, and every fix is free except the SEO/search-visibility and WooCommerce fixes. Premium adds those, plus automation, backups and the Redirect, Meta and Breadcrumbs tools.
Free Version * 251 checks in 26 groups (plus page-builder checks), including WooCommerce store setup and e-mail deliverability, and a test e-mail * Fix guidance for every issue and 67 one-click fixes with undo * Up to 5,000 URLs per scan, scan completeness, re-check, ignore and resolve, health score, new-since-last-scan markers, CSV export
Premium Version * Everything in the free version, plus SEO and search-visibility fixes: search engine indexing, post-name permalinks, attachment pages, canonical tags on archives, noindex for empty archives and internal search results, the core sitemap, the sitemap line in robots.txt, an llms.txt generator, an AI crawler block list, redirect chains and rules, content links through redirects, the author archive redirect and title-tag support * 41 more WooCommerce checks and 12 WooCommerce fixes * Presets (Minimal, Balanced, Performance) that apply a curated set of fixes in one go * Regression monitoring: new, resolved and returned issues since the previous scan, issue history and a health score trend * Scheduled scans with an HTML e-mail report, optionally only when new problems appear * Scheduled maintenance: the database cleanups you choose run on a schedule, each run undoable for 30 days * E-mail alerts when an installed plugin is closed, removed or abandoned on WordPress.org * Backups of the database, themes and plugins with a safe, atomic restore (uploads and wp-config.php are not included) * Tools: Redirect Manager, Meta Title/Description Manager, Breadcrumbs * Undo never requires an active licence
Integrations
Technical Site Auditor recognises popular plugins and adjusts its checks to them: Yoast SEO, Rank Math, All in One SEO, SEOPress, The SEO Framework, WooCommerce, Elementor, Divi, WPBakery, and caching, image optimisation, security, backup, forms, analytics, multilingual and redirect plugins (Help → Integrations lists them all and shows which are active on your site).
External Services
This plugin connects to the following external services. Requests happen only while a scan or a re-check runs (including scheduled scans in the premium version), and when you apply certain fixes. Every outgoing request is made by your own server through the WordPress HTTP API, which identifies itself with WordPress’s standard user agent (your WordPress version and site address) unless stated otherwise.
WordPress.org API
The System Health checks use the official WordPress.org API.
What it does: * Tests whether your server can reach api.wordpress.org, which WordPress needs for updates (core/version-check) * Verifies that core WordPress files have not been modified (c
02 / Source details
Gettingstarted.
01Upload the plugin files to /wp-content/plugins/technical-site-auditor/ directory, or install the plugin through the WordPress plugins screen.
02Activate the plugin through the ‘Plugins’ screen in WordPress.
03Go to Site Auditor → Issues in the admin menu and click “Run scan”.
03 / Source details
Frequently asked questions.
Does a scan change my site?
No. A scan only reads your pages and settings. Changes happen only when you apply a fix, and each fix can be undone under Fixes → Applied & history.
Is there a limit on how many URLs I can scan?
Up to 5,000 URLs per scan by default, in both versions. Developers can raise or lower the limit with the wtsa_max_discovered_urls filter. Large sites are scanned in batches, and the scan tells you if the limit cut the URL list short.
Do I need a license key for the free version?
No, the free version works without a license key. You only need a license key for the premium version.
What is the difference between the free and the premium version?
The free version fixes everything except search visibility and WooCommerce; Premium adds those plus automation. In detail: every check is free except the WooCommerce catalogue and performance checks, and every one-click fix is free – security hardening and headers, database cleanups with 30-day restore, performance, cleanup, content and accessibility – except the SEO and search-visibility fixes (indexing, permalinks, canonical and noindex tags, sitemaps, robots.txt, llms.txt, AI crawlers, redirects) and the WooCommerce fixes. Premium also adds scheduled scans, regression monitoring, scheduled maintenance, plugin-status alerts, presets, backups and the Redirect, Meta and Breadcrumbs tools.
Which fixes are free?
All of them except two categories. The 67 free one-click fixes cover security hardening and headers (including .htaccess changes with a site test and automatic rollback), database cleanups whose deleted rows can be restored for 30 days, performance, cleanup, content rewrites and accessibility. The SEO and search-visibility fixes (indexing, permalinks, canonical and noindex tags, sitemaps, robots.txt, llms.txt, AI crawlers, redirects, title tags) and the WooCommerce fixes are premium. In the free version those issues show their step-by-step “How to fix” instructions instead of a Fix button. A few fixes that change something visible (for example the permalink structure or product reviews) ask you to confirm before they run.
Does it test e-mail delivery?
Partly, and honestly. Every scan checks the DNS of your sending domain (SPF, DMARC, a mail server for bounces and replies, and a DKIM key at the common selectors), and reports when the last e-mail WordPress tried to send failed. Under Settings → Advanced, “Send test e-mail” sends one message to the address you type and shows whether WordPress handed it over, the error if not, the From address and name used, and whether PHP mail() or SMTP was used. Neither can see whether the message lands in the inbox or in spam; for that, check the test message itself. The DKIM check is a heuristic: a key under an unusual selector is not found, so it is only a notice.
Can it block AI crawlers?
The free version reports which AI crawlers (GPTBot, ClaudeBot, Google-Extended and others) your robots.txt allows, blocks or does not mention. In the premium version you tick the crawlers to keep out under Settings → Advanced; saving adds a two-line group for each ticked crawler (for example “User-agent: GPTBot” followed by “Disallow: /”) to the robots.txt WordPress generates, recorded as a fix with undo, and unticking everything removes the groups again. Crawlers you leave unticked follow your normal rules. robots.txt is a request, not a lock: well-behaved crawlers honour it, others may not. A physical robots.txt file on the server cannot be changed this way, and the setting says so.
Are backups safe?
Backups (premium) are stored in wp-content/tsa-backups with 32-character random file names and are only offered for download to administrators, through WordPress. The folder is protected with .htaccess and web.config files; nginx ignores those, so on nginx the Backups screen shows the one-line rule to add to the server configuration (location ^~ /wp-content/tsa-backups/ { deny all; }). A restore first creates a restore point, refuses damaged or truncated backups and archives with unsafe file names before anything is changed, runs only the kind of statements a backup made by this plugin contains, and swaps the database in as the last step. Backups cover the database, themes and plugins – not uploads or wp-config.php – and are kept on the same server, so keep a copy elsewhere too.
Will the plugin slow down my site?
Scanning only runs when you start it (or on a schedule, premium). For visitors the plugin loads nothing except the small hooks of the fixes you switched on (and, in the premium version, the modules you enabled).
Can I undo a fix?
Yes. Every fix records what it changed, and you undo it under Fixes → Applied & history. Database cleanups (spam, trash, revisions, transients, orphaned metadata and others) save the deleted rows first, so they can be restored for 30 days – in the free version too. If a cleanup reaches the backup size limit, it stops and leaves the remaining rows untouched; running it again continues. Three cleanups cannot be undone, and say so: optimizing database tables (the rows stay the same), and, in the premium version, deleting expired WooCommerce sessions and deleting WooCommerce logs older than 30 days (both ask for confirmation first). Undo never requires an active licence.
Why does an issue still show after I applied its fix?
Results come from the last scan. Use “Re-check this URL” on the issue or run a new scan, and clear page caches first. If the scan still finds the problem, the issue moves to “Fix active, still detected”: the fix is on, but something else on your site (the theme, another plugin, the server) still produces the problem.
What is llms.txt, and do I need one?
llms.txt is a young, community-proposed convention (llmstxt.org): a Markdown file in your site root that gives AI assistants a curated summary of your most important pages. Major search engines have said they do not use it, and not having one is not a problem. The check only reports whether a file exists. The premium version can generate one from your site title, tagline and key pages, leaving out password-protected and noindexed pages; any existing file is backed up first and the change can be undone.
What does the plugin and theme hygiene check do?
It looks up your installed plugins, your active theme and its parent theme in the WordPress.org directory and reports which ones have been closed or removed, which have not been updated in years and which have pending updates; for plugins it also reports which are untested with recent WordPress versions or conflict with your PHP/WordPress version. Only plugins and themes that WordPress.org serves updates for are looked up; premium or custom ones are never sent. The check never deactivates or deletes anything.
Does it work with page builders?
The plugin detects Elementor, Divi and WPBakery, and includes dedicated checks for Elementor and Divi.
Is WooCommerce supported?
Yes. The free version checks the store setup and security: cart, checkout and account pages, terms and privacy pages, payment method, tax, page caching and indexing of the cart and checkout, REST API and Store API exposure, the legacy REST API, webhooks and checkout HTTPS. The premium version adds 41 checks for the catalogue, performance and store operations (test-mode payment methods, pending database updates, outdated templates, order e-mails, tax rates, logs and more), plus 12 WooCommerce fixes. The link checker never follows add-to-cart, cart-removal or logout links, so a scan does not put products in a cart.
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
