Settings > Sitelemetry<\/strong> you run a security scan or a full site audit and read the result inside WordPress: a score and grade, every finding with its severity, location and fix, the checks that passed, a clear list of what was not measured and why, and a ready-made prompt for your AI assistant to fix the findings.<\/p>\n\nAudit kinds<\/strong><\/p>\n\n\n- Security (included in every plan, including Free): DNS and email DNS, WHOIS\/RDAP, TLS, HTTP security headers, HTTPS posture, technology fingerprint and, once the site is verified, exposed files, HTTP methods and API exposure. Paid plans add the WordPress checks, port scans and more modules; these need a verified site.<\/li>\n
- Technical SEO, AI visibility (AI readiness), Integrations, Accessibility, Performance and Full (all pillars with one blended score) on paid plans.<\/li>\n<\/ul>\n\n
What the plugin does<\/strong><\/p>\n\n\n- Results in WordPress<\/strong>: a status banner, the score and grade, the findings with a severity filter and each finding's evidence, impact and fix.<\/li>\n
- Passing checks<\/strong>: the checks that passed, grouped by security module, each with its evidence.<\/li>\n
- What was not measured<\/strong>: the checks that did not run, with readable module names and the likely cause when the site's own answers explain it (a redirect, a rate limit, a server error, no answer in time, ports a firewall silently drops, the per-audit script limit), the pages a crawl found but could not assess (for example because robots.txt disallows them), the metrics that were not measured (such as the Core Web Vitals when PageSpeed Insights returns no data), and the individual checks that ended without a pass or fail result (an error, no result, a manual review, not applicable). Unmeasured checks are never counted as passes.<\/li>\n
- Copy AI fix prompt<\/strong>: one click copies a prompt built from the result (the findings with evidence and fixes, and what was not measured) for ChatGPT, Claude or your coding assistant. The prompt is built in wp-admin and only copied to your clipboard; nothing is sent. The assistant is asked to answer in your WordPress admin language.<\/li>\n
- Verify this site<\/strong>: some checks run only on sites whose ownership is verified. With one click the plugin gets a verification code from Sitelemetry, publishes the verification file for this site and has Sitelemetry check it, so you need no FTP access; it renews the verification automatically when it expires and tells you exactly what to fix when a check fails (for example a server that blocks \/.well-known\/ or a redirect between www and non-www). Where one-click verification is not available yet, paste the token from the Sitelemetry app instead; a \"Test the file\" button checks that the file is reachable. On a multisite network only a network administrator can publish the file.<\/li>\n
- Dashboard widget<\/strong> with the last score, the findings by severity, a reminder when the site needs to be verified or its verification renewed, and a link to the results. After a weekly audit that needs verification, a notice on the Dashboard and Plugins screens says so until you dismiss it.<\/li>\n
- Settings page<\/strong> with a Sign in or create an account<\/strong> button (the Sitelemetry sign-in page, where new users create an account on a free or paid plan) and a link to the page that shows your API key, your Sitelemetry MCP API key (stored in the WordPress options table, shown masked, removable), the target (defaults to your site address), the audit kind and an optional weekly audit through WP-Cron.<\/li>\n
- Plan and usage box<\/strong> with the connected plan and what each paid plan includes, read from the public plan catalogue.<\/li>\n<\/ul>\n\n
Languages<\/strong><\/p>\n\nThe plugin's screens are available in English, Turkish, Spanish, German (informal and formal), French, Portuguese (Brazil), Italian, Japanese and Simplified Chinese. The audit itself is requested in your WordPress admin language when Sitelemetry supports it (English, Turkish, Spanish, German, French, Portuguese, Italian, Japanese, Simplified Chinese), so findings, evidence and fixes arrive in that language too; otherwise in English. Translations from translate.wordpress.org take precedence over the bundled ones, which the plugin uses when no language pack is installed.<\/p>\n\n
Plans and allowance<\/strong><\/p>\n\nSitelemetry has free and paid plans. A Free Sitelemetry account includes the security audit with the public security modules and a monthly number of security scans; the public plan catalogue at sitelemetry.com\/api\/plans is the source of truth and the plugin reads it for the plan and usage box. Each completed audit uses one unit of the monthly allowance of the connected account; polling a running audit uses nothing more. When the connected account does not include an audit kind or has used its monthly allowance, the audit is not started, no allowance is used and the results page says so.<\/p>\n\n
Ownership<\/strong><\/p>\n\nAudit only websites you own or are explicitly authorized to test. Every audit is performed by Sitelemetry against the live target and is recorded on the connected account. Protected checks (for example HTTP methods and exposed files, and on paid plans the WordPress checks) require ownership verification of the host in Sitelemetry; results list the checks that were left unmeasured for this reason.<\/p>\n\n
To verify from WordPress, save your API key and click Verify this site<\/strong> in Settings > Sitelemetry<\/strong>. The plugin asks Sitelemetry for a verification code for this site's exact host (www and non-www are different hosts), answers \/.well-known\/sitelemetry-verification.txt<\/code> on this host with that code and nothing else, tests the file and asks Sitelemetry to check it; the page then says \"Verification complete \u2713 valid until\" and the date, or which problem to fix. A verification lasts 30 days; the plugin renews it automatically in the background (WP-Cron) when it expires or when an audit reports that it must be renewed, never earlier, and shows a notice only if the renewal fails. Remove token<\/strong> stops publishing the file and the automatic renewal until you click Verify this site<\/strong> again or save a token. Where one-click verification is not available yet, the manual steps remain: in the Sitelemetry app open Verified Domains<\/strong>, enter the host and click Start verification<\/strong>, copy the verification code (the token) shown under HTTP verification file<\/strong>, paste it into Verify this site<\/strong>, click Test the file<\/strong>, then click Verify HTTP<\/strong> in the app (renew with Reverify<\/strong> in the app). Without a token the path answers 404. A DNS TXT record or Google Search Console work as alternatives. On a multisite network the web server behind a site's host serves the whole network, so only a network administrator can publish the file there.<\/p>\n\nThin client<\/strong><\/p>\n\nThe plugin bundles no libraries and runs no scanner on your server. It sends requests to sitelemetry.com with the WordPress HTTP API and renders the response. There is no tracking and no analytics.<\/p>\n\n
External service<\/strong><\/p>\n\nThis plugin relies on the hosted Sitelemetry service (https:\/\/sitelemetry.com) operated by Sitelemetry. It sends requests to the service only when you run an audit or after you have stored an API key, as described in the Privacy section below. The terms of service are published at https:\/\/sitelemetry.com\/terms and the privacy policy at https:\/\/sitelemetry.com\/privacy.<\/p>\n\n
Privacy<\/h3>\n\n
When you run an audit, the plugin sends to sitelemetry.com the target URL, the audit options you configured (the audit kind) and the report language (derived from your WordPress admin language), authenticated with your API key. Every request also identifies the client in its User-Agent header (sitelemetry-audit-wordpress\/<\/code> and the plugin version); no WordPress version, site name, user, plugin list or other data from your site or your server is sent. Sitelemetry then audits the live target from its own infrastructure and records the audit on the connected account, as described in the Sitelemetry terms (https:\/\/sitelemetry.com\/terms) and privacy policy (https:\/\/sitelemetry.com\/privacy).<\/p>\n\nOnce an API key is stored, the plugin also reads the public plan catalogue at sitelemetry.com\/api\/plans (no authentication, no data about your site beyond the same plugin User-Agent) to show the plan and usage box.<\/p>\n\n
For ownership verification the plugin uses the verification endpoints of sitelemetry.com (\/api\/v1\/verification\/status<\/code>, \/challenge<\/code> and \/verify<\/code>), authenticated with your API key, and sends only this site's address (scheme and host). It asks for the status when an administrator opens the settings page (the answer is kept for up to a week, or for an hour while the service offers no verification endpoints), and requests and checks a verification code when you click Verify this site and when the automatic renewal runs in WP-Cron (when the verification expires or an audit reports that it must be renewed). To check the code, Sitelemetry requests \/.well-known\/sitelemetry-verification.txt<\/code> from this site.<\/p>\n\nBefore a key is stored, the plugin makes no request to any external server.<\/p>\n\n
The plugin stores in your WordPress database: the settings (API key, target, audit kind, weekly schedule), the last result of each audit kind (score, findings, passing checks and coverage notes about the target), the verification token you paste or the plugin obtains (with the time and outcome of the last file test), the verification status Sitelemetry reported for this site's host and the outcome of the last verification or renewal, for each administrator which weekly-audit and renewal notices they dismissed and, while an audit runs, the job state. It stores no data about visitors or users and uses no cookies or tracking. Uninstalling the plugin removes all of it.<\/p>\n\n
The verification token is public by design: once you save it, the plugin serves it at \/.well-known\/sitelemetry-verification.txt<\/code> so Sitelemetry can confirm you control the site. \"Test the file\" requests that address from your own server; it makes no request to any other host. The AI fix prompt is only copied to your clipboard.<\/p>\n\n\n\n- Upload the
sitelemetry-audit<\/code> folder to \/wp-content\/plugins\/<\/code> or install it from the Plugins screen.<\/li>\n- Activate the plugin.<\/li>\n
- Sign in at sitelemetry.com\/app<\/a> (the settings page's Sign in or create an account<\/strong> button opens it). New to Sitelemetry? Switch to Create account<\/strong> on the same page and choose a plan: Sitelemetry has free and paid plans, and the Free plan includes the security audit. Then open My account<\/strong>, expand Manual connection and API key<\/strong> and copy the API key (the settings page's Get your API key<\/strong> link opens that page).<\/li>\n
- Go to Settings > Sitelemetry<\/strong>, paste the key, check the target and save.<\/li>\n
- Click Run audit<\/strong>. The results tab updates while the audit runs.<\/li>\n
- Optional: click Verify this site<\/strong> on the same page to include the protected checks.<\/li>\n<\/ol>\n\n
The site must be able to make outgoing HTTPS requests to sitelemetry.com.<\/p>\n\n\n
\nDoes the plugin scan my site itself?<\/h3><\/dt>\nNo. Sitelemetry audits the live target from its own infrastructure. The plugin only starts the audit, polls its progress and shows the result.<\/p><\/dd>\n
What does an audit cost?<\/h3><\/dt>\nA completed audit uses one unit of the monthly allowance of the connected Sitelemetry account. Polling a running audit uses nothing more. Audits that are not started (plan not included, allowance exhausted, verification required) use nothing.<\/p><\/dd>\n
What data does the plugin send, and where?<\/h3><\/dt>\nOnly to sitelemetry.com, and only after you store an API key: the target URL, the audit kind and the report language (from your WordPress admin language), authenticated with your API key, plus the plugin's User-Agent. For ownership verification the plugin sends this site's address (scheme and host). No site content, users, visitors, plugin list or WordPress version are sent. \"Test the file\" requests this site's own verification file from your server and contacts no other host. The Privacy section below lists every request.<\/p><\/dd>\n
Why does the result say \"partial\" or list checks that were not measured?<\/h3><\/dt>\nSome checks need ownership verification of the target or a plan that includes them, or a measurement was unavailable for the target. The results page lists each of them under \"What was not measured\", with the likely cause when the site's own answers explain it. Use Verify this site<\/strong> in the plugin settings, a DNS record or Google Search Console to include the protected checks.<\/p><\/dd>\nHow does \"Verify this site\" work?<\/h3><\/dt>\nSitelemetry proves that you control a host by fetching https:\/\/<host>\/.well-known\/sitelemetry-verification.txt<\/code> and comparing it with a token it generated for your account. With one click the plugin requests that token with your API key, serves the file for this site's own host (only for exactly this host and path) and asks Sitelemetry to check it, so no FTP upload is needed; it renews the verification in WP-Cron when it expires and never replaces a verification that is still valid. When a check fails, the page names the cause and the fix: a web server that keeps \/.well-known\/ for itself, a firewall or password, a redirect between www and non-www, a cached or other file at that path, no answer in time, DNS or TLS problems, too many attempts or a key Sitelemetry did not accept. Where one-click verification is not available yet, paste the token from the app; \"Test the file\" fetches the file the way Sitelemetry will and reports redirects to another host, 404 answers from the web server, firewall or maintenance pages and wrong content. Local and private sites cannot be verified this way, and subdirectory installs usually cannot; use the DNS record instead. Sitelemetry fetches the default port of the host (443 or 80), so a site that runs on another port must also answer there. On a multisite network only a network administrator (the manage_network_options<\/code> capability, filterable with sitelemetry_audit_verification_capability<\/code>) can publish the file, because the server behind the host is shared by the whole network.<\/p><\/dd>\nDoes the AI fix prompt send my data anywhere?<\/h3><\/dt>\nNo. The prompt is built by WordPress from the stored result and the button only copies it to your clipboard. It contains the audited address and the findings, never your API key. You decide where to paste it.<\/p><\/dd>\n
Where is the full report?<\/h3><\/dt>\nThe results page in WordPress is the result: Sitelemetry does not keep a separate report of audits run through the plugin. Run the audit again to refresh it.<\/p><\/dd>\n
Which languages does the plugin support?<\/h3><\/dt>\nThe screens are translated into Turkish, Spanish, German (informal and formal), French, Portuguese (Brazil), Italian, Japanese and Simplified Chinese, and audit results arrive in your admin language when Sitelemetry supports it. The bundled translations work from WordPress 6.0; a language pack from translate.wordpress.org replaces them completely, so strings a pack does not translate yet appear in English. You can improve or add translations at translate.wordpress.org.<\/p><\/dd>\n
How does polling work?<\/h3><\/dt>\nLong audits return a job id. While the results page is open, the browser asks WordPress every few seconds (as Sitelemetry suggests) for one progress step; each step is one request from your server to Sitelemetry with the job arguments unchanged. If you leave the page, a WP-Cron event finishes the job in the background. A total time budget of 20 minutes applies; when a job exceeds it, run the audit again later to get a result.<\/p><\/dd>\n
Where is the API key stored?<\/h3><\/dt>\nIn the WordPress options table, like other plugin settings. The settings page shows it masked, it is never written to logs and it is sent only to sitelemetry.com as a Bearer token.<\/p><\/dd>\n
Can I audit a site other than this one?<\/h3><\/dt>\nThe target defaults to this site's address and can be changed to any URL you own or are authorized to test. Do not audit sites you are not authorized to test. The verification helper publishes the file only for this site's own host; verify other hosts in the Sitelemetry app.<\/p><\/dd>\n
Does the weekly audit work on a low-traffic site?<\/h3><\/dt>\nWP-Cron runs when the site receives visits. If your host runs a system cron for WordPress (recommended), the weekly audit runs on time regardless of traffic.<\/p><\/dd>\n\n<\/dl>\n\n\n
0.1.3<\/h4>\n\n\n- Passing checks: the results page lists the checks that passed, grouped by security module, each with its evidence (full audits included).<\/li>\n
- What was not measured: readable module names and the likely cause (redirects, rate limits, server errors, no answer in time, silently dropped ports, the per-audit script limit), with the service's own reason underneath, the pages a crawl could not assess and the metrics that were not measured, and the individual checks without a pass or fail result, grouped by status. Both sections are collapsible.<\/li>\n
- Copy AI fix prompt: builds a prompt from the result in wp-admin and copies it to the clipboard; nothing is sent.<\/li>\n
- Verify this site with one click: the plugin gets the verification code from Sitelemetry with your API key, publishes the verification file for this site's host, tests it and has Sitelemetry check it, then shows \"Verification complete \u2713 valid until\" the date, or the exact cause and fix of a failure. It renews the verification automatically in WP-Cron when it expires or an audit reports that it must be renewed, and shows a notice only if the renewal fails. Where the service does not offer one-click verification yet, the manual helper (paste the token from the app, Test the file) stays as before. On multisite, only network administrators can publish the file.<\/li>\n
- Settings: a \"Sign in or create an account\" button (the Sitelemetry sign-in page; new users create an account there on a free or paid plan) and a \"Get your API key\" link for a first setup.<\/li>\n
- The running-audit status line is the plugin's own; it no longer shows the service's instructions for AI clients.<\/li>\n
- Translations: Turkish, Spanish, German (informal and formal), French, Portuguese (Brazil), Italian, Japanese and Simplified Chinese ship with the plugin (WordPress 6.0 and later); translate.wordpress.org language packs take precedence.<\/li>\n
- Audits are requested in your WordPress admin language when Sitelemetry supports it.<\/li>\n
- Removed the \"Open the full report\" link and the remaining-scans lines: the service returns neither to the plugin, and no text promises a report in the app anymore.<\/li>\n
- New directory name: Sitelemetry Audit \u2013 Security, SEO & AI Readiness Scanner. The slug and settings are unchanged.<\/li>\n<\/ul>\n\n
0.1.2<\/h4>\n\n\n- Plugin URI now points at the plugin repository; the author URI stays sitelemetry.com (WordPress.org requires the two to differ).<\/li>\n<\/ul>\n\n
0.1.1<\/h4>\n\n\n- Tested with WordPress 7.1. Plugin Check (all categories) passes without errors or warnings.<\/li>\n
- Description and Privacy sections link to the exact terms and privacy policy pages.<\/li>\n<\/ul>\n\n
0.1.0<\/h4>\n\n\n- First release: settings page, manual audits with progress polling, results page with severity filter and coverage notes, dashboard widget, optional weekly audit, plan and usage box.<\/li>\n<\/ul>","raw_excerpt":"Audit your site for security (free plan), SEO and AI readiness: a score, every finding with its fix, passing checks and an AI fix prompt.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ast.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/373566","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ast.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/ast.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/ast.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=373566"}],"author":[{"embeddable":true,"href":"https:\/\/ast.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/ozandikici"}],"wp:attachment":[{"href":"https:\/\/ast.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=373566"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/ast.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=373566"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/ast.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=373566"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/ast.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=373566"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/ast.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=373566"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/ast.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=373566"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}