WordPress site health check

What it looks at

Our server asks for the one page at the address you give, the way a browser does, follows any redirect, and reads what comes back: the status, a few headers, and the start of the page.

• Whether it answers. The status the server gives, how many redirects come first, and how long the server takes to begin its answer.
• How it is secured. Whether the page is served over https, whether anything on it is still asked for over plain http, and whether it tells the world which WordPress or PHP version it runs.
• What search engines are told. Whether the page asks not to be listed, and whether it has a title, a description and a setting for phones.
• What it is built with. The platform and, for a WordPress site, the theme's folder, the page builder and the plugins that load a file on that page.

What it cannot see

It looks from outside, at one page, once. It does not sign in, so it cannot see pending updates, the state of backups, or anything in the admin. It does not read the site's files, so it is not a scan for malware. A plugin that does its work without loading a file on the page does not show. For what is inside, WordPress has its own report under Tools, then Site Health.

A version that is out of date is checked against php.net's and WordPress.org's own records, the same ones behind the end-of-life checker.

What happens to the address

The address goes to our server, which makes the request and sends back the report. Neither the address nor the page is kept or logged. The request names itself as WPMinistry-SiteCheck, so it can be told apart in the site's own logs. Only public web addresses are asked.