=== Site Health Doctor for WordPress ===
Contributors: sgplugins
Tags: site health, php errors, performance, monitoring, security check
Requires at least: 5.9
Tested up to: 7.1
Requires PHP: 7.2
Stable tag: 2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Finds what is wrong with your site before visitors do: PHP errors and who causes them, slow pages, database, disk, security, mail and updates.

== Description ==

A site rarely breaks all at once. A plugin starts throwing warnings, pages get slower week by week, the disk fills up with forgotten backups, the mail records of the domain are incomplete, a backup archive lies in the web root where anyone can download it. Site Health Doctor watches all of this on your own server and tells you, in plain words, what is wrong, why it matters and how to fix it.

Everything is collected and stored on your server. No account, no connection to SiteGuarding, and no visitor data leaves your website.

= What it checks =

* **PHP errors.** Reads debug.log and the PHP error log, catches errors on the pages itself, groups the same error, and tells which plugin or theme it comes from. A sudden spike of errors or a new fatal error becomes a problem on the Issues screen and an e-mail.
* **Server time.** Measures 1 request in 10 (you choose): time, memory and database queries, separately for pages, admin, AJAX, REST and cron. Shows the slowest addresses and warns when the site became slower than its own normal.
* **Database.** Table sizes and growth, MyISAM tables, wasted space, old revisions, spam and expired cache rows, autoloaded options that slow every page down.
* **Files and disk.** Free disk space, the largest files, archives and database dumps in the web root, PHP files in the uploads folder, server tools left on the site, and the WordPress core files compared with the official release.
* **Security.** Debug mode on a live site, a user named admin, weak secret keys, the file editor, outdated plugins and plugins left inactive, known vulnerabilities (with your own free WPScan token), attacks and password guessing seen in the server access logs, HTTPS, HSTS and the SSL certificate expiry.
* **E-mail.** SPF, DKIM, DMARC and MX records of your domain, and whether WordPress sends mail through PHP mail() or SMTP.
* **Server and WordPress.** PHP version and its end of support, memory limit, OPcache, missing PHP extensions, object cache, the WordPress scheduler (WP-Cron), search engine visibility, mixed site addresses.

= What you get =

* **A health score** from five areas: errors, performance, security, database and files, server and configuration. An area without data says "not measured" instead of pretending to be fine.
* **Issues with the fix.** Every problem comes with what was found, why it matters and the steps to fix it. Hide an item for 30 days if you decided to live with it.
* **Alerts by e-mail** for critical problems and the events you choose, with a pause so the same alert does not arrive again and again, and a "resolved" message when it is gone.
* **A weekly e-mail** with the score, new and fixed problems, errors and speed.
* **A printable report** of the last 7 days: print it or save it as PDF from your browser.
* **WP-CLI:** `wp site-health-doctor status`, `issues`, `run` and `report`.
* **Early error capture** (this build of the plugin): a switch in Settings adds one small file to wp-content/mu-plugins, so errors of plugins that load before Site Health Doctor, and fatal errors that stop WordPress before it, are recorded too. Turning it off, deactivating or deleting the plugin removes the file.

= Light on your server =

A visitor request costs one random number. A measured request writes one line to a file. No database query and no outside request ever runs during a visit: the work is done in the background every 5 minutes, in short portions.

= Site Health Doctor Pro =

The Pro add-on is installed next to this plugin and adds 12 months of history, alerts to Slack, Discord, Telegram and webhooks, the timeline "what changed before it broke", one-click clean-up of the database and logs with a copy for 7 days, and white-label reports by e-mail every month. This plugin works fully without it.

== Installation ==

1. Install the plugin from Plugins > Add New, or upload the zip in Plugins > Add New > Upload Plugin.
2. Activate it. The first checks start at once.
3. Open Site Health Doctor in the admin menu. Some numbers appear only after a day of data.

== Frequently Asked Questions ==

= Does it slow my site down? =

No. Visitor requests do not query the database or call anything outside. Only 1 request in 10 writes one line to a file. All analysis runs in the background in portions of 2 seconds.

= Where does it keep its data? =

In its own database tables (prefix sgshd_) and in wp-content/uploads/sgshd. Visitor addresses are shortened (the last part removed) before they are stored, page addresses are stored without the query string, and full log lines are never kept. The free plugin keeps 7 days of history.

= The Traffic screen says that no access log was found. =

Server access logs are not readable for PHP on every hosting. On cPanel, enable "Archive logs" in Raw Access, or enter the path of the log file in Settings. Everything else works without access logs.

= What happens when I remove the plugin? =

Deactivation stops the background tasks. Deleting the plugin keeps the data unless you ticked "Delete all data when the plugin is uninstalled" in Settings.

== External services ==

Site Health Doctor contacts these services from the admin area and the background task, never during a visit:

* **WordPress.org (api.wordpress.org)**, through the functions of WordPress itself: the official checksums of the core files of your WordPress version, once a day, and the recommended PHP version that the Site Health screen of WordPress also uses. Sent: the WordPress version and language. [Terms](https://wordpress.org/about/privacy/)
* **WPScan (wpscan.com)**, only if you enter your own WPScan API token in Settings: the names and versions of WordPress, the active plugins and the active theme, at most 24 requests a day, to list known vulnerabilities. [Terms](https://wpscan.com/terms-and-conditions/), [privacy](https://wpscan.com/privacy-policy/)
* **Your own site**, once a day: the home page (HTTPS, HSTS, the certificate), and whether archives, .env and .git files found in the web root can be downloaded. Only files that PHP does not run are requested.
* **DNS** of your domain, once a day: SPF, DKIM, DMARC and MX records.

* **SiteGuarding (www.siteguarding.com)**: twice a day, whether a new version of the plugin is published (the update manifest). Nothing about your site is sent.

Nothing else is sent to SiteGuarding by this plugin.

== Screenshots ==

1. Overview: the health score, the five areas and the most important problems.
2. Issues: every problem with what was found, why it matters and how to fix it.
3. Errors: groups of PHP errors and the plugin or theme that causes them.
4. Performance: server time, slow addresses and the trend.
5. Settings: what to check, alerts and data.

== Changelog ==

= 2.0 =
* New version, rebuilt from the ground up: checks with explanations and fixes, health score by area, PHP errors grouped by plugin and theme, sampled server time, database and disk, access logs, mail records, alerts, weekly e-mail, printable report, WP-CLI.
