AJC Site Health

A twice-daily health report from each WordPress site A&J Computers maintains, so updates and security findings are reviewed across every site at once instead of one dashboard login at a time.

It only reports. The plugin never updates, installs or changes anything, and it gives A&J Computers no way to log in to the site or run anything on it.

What it reports

• WordPress core: the running version, whether an update is waiting, and whether this server's PHP can run it.
• Plugins and themes: installed version, the update on offer, whether auto-updates are on, and what is blocking the update: PHP too old, WordPress too old, or no download (usually an expired premium licence).
• Wordfence, when installed: when the last scan finished, whether it succeeded, and its open findings. A plugin Wordfence marks as vulnerable, abandoned or removed from wordpress.org is flagged on that plugin, even when no update exists for it.

Updates Wordfence also lists are not repeated: they are already in the plugin, theme and core sections.

How it works

Twice a day WordPress's scheduler asks WordPress for its normal update check, builds the report and sends it over https, signed with this site's own secret. Setup is one step: paste the site key A&J Computers sends you on the plugin's Tools page. Until then it sends nothing at all.

A&J Computers' review reads every site's latest report, puts security findings first, and flags any site that has gone quiet for more than two days.

Staging copies and moved sites

The plugin remembers the address it first reported from. A copy of the site answers to a different address, so it pauses itself instead of reporting as the live site. See Setup for what to do when a site really moves.

A report is the site's own account

A signed report proves which site sent it, not that the site is telling the truth. A compromised site could report itself clean, so "nothing reported" is not the same as "nothing wrong".