Looking after a WordPress site is mostly a short list of small jobs that nobody wrote down. This reads the report WordPress already generates about itself, turns it into that list in the order worth doing it, links each line to the screen where it gets done, and hands you the commands if you would rather work in a terminal. Save a snapshot and the next pass shows you what you fixed.
More from Chris Pirillo
Questions
How do I find out if a WordPress plugin is abandoned?
Check the date of its last release against the WordPress releases that shipped after it. A plugin untouched for more than two years, whose "tested up to" version trails current WordPress by several majors, has almost certainly been left behind. WordPress Checkup reads both figures from the WordPress.org API and shows you the gap.
What does it mean when a plugin is removed from the repository?
A confirmed withdrawal means WordPress.org will not send another directory update. That is different from a plugin that simply is not found there: paid, private, and custom plugins are commonly distributed elsewhere, so absence is shown as unknown until you confirm the source.
What does “hasn’t been tested with the latest 3 major releases” mean?
It is WordPress telling you the author has not refreshed the plugin’s compatibility declaration in about eighteen months. It is a statement about the author’s attention, not a test result, so it is a reason to look rather than a reason to panic. WordPress Checkup shows you how many releases behind the declaration is, and weighs that against how much the plugin actually does.
Why can a known plugin have a different directory name?
Site Health copies the display name, author, version, and auto-update state, but not the WordPress.org slug. Directory titles can gain taglines while an installed copy keeps its shorter name. The app confirms a strong name or slug match against the reported author and leaves close or ambiguous results unknown.
Why isn’t this a plugin?
Because a read-only maintenance decision does not need more code running on every request. A page you paste into adds nothing to the site, asks for no credentials, and cannot deactivate or delete anything. The tradeoff is deliberate: changes still happen inside WordPress or your terminal, where your login, backups, and review process belong.
Why paste Site Health instead of connecting to my REST API?
The public REST API does not expose a site’s full plugin, theme, and server inventory to strangers. A direct connection would require privileged credentials such as an Application Password. The Site Health report is WordPress’s own structured source and provides the needed state without asking this page to hold access to your site.
Does this send my site data anywhere?
The full paste is parsed in your browser and is not uploaded. During a check, plugin and theme names are sent to public WordPress.org APIs for directory and declared-dependency facts. A city is sent only when you request local events. Your credentials, database details, server paths, and site address are not sent by the app. If you choose Remember, a compact snapshot and your recorded decisions stay on this device.
Will my plugins break when I upgrade PHP?
Not with certainty, and it will not pretend to. The WordPress.org API publishes a minimum PHP version, never a maximum. What it can tell you is whether a plugin's last release came out before that PHP version existed, which means the author never tested against it. That is an inference from dates and it is labelled as one.
How are the alternatives chosen?
Every plugin on WordPress.org declares its own tags. WordPress Checkup reads the tags of a failing plugin, finds other plugins sharing them, and ranks those by the same health signals used in the audit. They are plugins that describe themselves the same way, sorted by which ones are still alive. Candidates to evaluate, not recommendations, and swapping one usually means rebuilding whatever it stored.
Why does a plugin that has not updated in three years still say it is fine?
Because age alone is not danger. A small snippet plugin that does one thing correctly can sit untouched for years without risk, while a page builder shipping its own JavaScript cannot. The verdict here weights how long it has been since the last release against how much the plugin actually does, judged by install count and support activity.
What can it actually do for me beyond telling me things?
It builds the worklist in priority order, shows declared plugin dependencies, routes each job to the person most likely to own it, and gives you manual checks based on the site’s actual plugin stack. It also writes reviewable WP-CLI commands, creates a redacted support packet, remembers decisions only when you ask, and verifies progress with a fresh report. The app never executes a site change.
Is the upkeep number a security score?
No. Nobody can score site security from this report. The upkeep number is hidden on the first run and appears only when a same-site comparison makes it a direction. It still does not verify malware, known vulnerabilities, restorable backups, speed, or whether forms and checkout work.
Why is my paid plugin listed but not marked as a problem?
Commercial, private, and custom plugins can all be absent from WordPress.org normally. The app labels that absence unknown and asks you to confirm the vendor account, licence, code owner, or deployment process. Only an explicit WordPress.org withdrawal response is treated as a confirmed withdrawal.
Why does it want my site address?
Only to build links. Knowing the address lets each line of the worklist point at the exact screen in your own admin where that job gets done, and lets a suggested replacement open with the plugin already searched for. The address is used by JavaScript on this page and is not sent to WordPress.org or anywhere else. Leave it blank and everything still works, you just navigate by hand.
Why run this now rather than next month?
Because the first run is the one that makes every later run useful. The number only means something once you have two of them to compare, so today’s checkup is what turns the next one into a progress report. It is also better done before a round of updates than after, since knowing which plugins are unmaintained beforehand is the difference between a routine afternoon and an evening spent working out what broke.
Something on my site is broken. Will this tell me why?
Sometimes, and it will not guess when it cannot. After a checkup you get a list of symptoms people commonly notice, filtered down to the ones actually explained by something found on your site. A menu that loses its last few items, a post that cuts off at an emoji, an upload that fails silently, nothing appearing in Google. Those are settings problems with dull causes that people spend evenings searching for. If the cause is not in your Site Health report, that section stays empty rather than inventing something.
Where do all these verdicts come from?
Site state comes from the report you paste. Core and PHP status, release dates, compatibility declarations, and explicit withdrawal reasons come from public WordPress.org APIs. Age thresholds, possible feature overlap, and PHP-era compatibility are labelled as inferences. Failed lookups and outside-directory code are labelled unknown.
How near is “near me” for the events?
WordPress sets that, not this page. Meetups are matched within 100 kilometres and WordCamps within 400, which is why a search from Seattle can legitimately return a WordCamp in Vancouver. Many meetups run online and are marked as such, so distance does not rule them out. The lookup wants a city or town name; a postcode or a street address comes back empty.
Related apps