Your WordPress, audited without being touched

What it does, in one sentence

It reads your installation, tells you what is wrong and what to do, and keeps the result so you can see what changed since last time.

WordPress already ships Site Health, and it does twenty-five things well. This plugin does not repeat them: it looks at the twelve it does not, explains each one and touches nothing. It is safe to run on a live site because it neither writes nor blocks.

The twelve checks

1. Security headers: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, one by one.
2. Content-Security-Policy: whether it exists and whether it blocks or only reports.
3. Abandoned plugins and themes: more than two years without an update, or removed from the directory.
4. Forgotten files in the root: .git/config, .env, wp-config.php.bak, debug.log, backup.sql, backup.zip and readme.html.
5. PHP inside uploads: with file and time limits, so a big library does not hang the panel.
6. XML-RPC: whether it answers and whether anything closes it.
7. Users and administrators: a login called «admin», how many administrators there are, free email addresses.
8. Built-in file editor: on or off.
9. Default database prefix: wp_, with an honest note: it is convenience, not a hole.
10. Cookie flags: Secure, HttpOnly and SameSite, on the home page and the login.
11. security.txt: present or not, with a generator that gives you the file ready to upload.
12. File permissions: of wp-config.php and the root.

Three states, not two

Every check says one of three things: OK, to fix or to check. The third one is the important one. Many sites answer 200 to every address (a page builder, a proxy, an access screen): the plugin then says «I could not check it» instead of inventing a critical finding.

A false alarm in the first five minutes is the fastest way to lose a user.

History: what changed

Every audit is stored and compared with the previous one: «this was fine and stopped being fine», with dates. You see the differences per check and how the number of problems moves. No other free plugin does that.

Reports

The report downloads as JSON or as a printable HTML page (print to PDF from the browser). It includes what was found, why it matters, what to do and the date of every data point.

What it looks like

What it does not do

• It is not a firewall or a WAF, and it does not block anything.
• It does not detect malware or modified files.
• It does not scan ports or services from outside.
• It is not a certified audit and does not replace a pentest.
• It cannot know whether a plugin is safe: only whether it is maintained.

Privacy: it sends no data anywhere. The only external requests go to api.wordpress.org, once per installed plugin and theme, to ask for the last update date: the same request WordPress already makes when it checks for updates.

Download

Faro Auditoría 0.1.0 (free, GPL)

Install it from Plugins → Add New → Upload Plugin. It is also in the WordPress.org directory.

Requirements

• WordPress 6.5 or higher (tested up to 7.1).
• PHP 8.1 or higher.
• Administrator permissions to see the panel.
• Nothing else: no account, no key, no connection to farowp.com.