CordonAI Site Health Doctor

CordonAI Site Health Doctor finds what is wrong with your site, explains it in plain language, and hands you the fix. It is a diagnostic tool: it never edits, deletes or blocks anything. It measures, explains and recommends — the decision always stays with you.

Everything described below works in this version. Three things usually scattered across different tools, now in one dashboard:

1. Performance & health diagnostics — which plugins and hooks are slow, which SQL queries are heavy or repeated, what is happening to your database and disk, and which PHP errors keep occurring.
2. Access-log analysis — traffic, bots and signs of attack, read straight from your server’s own access logs inside wp-admin. Nothing is sent to any external service.
3. Recommendations & warnings — every finding is explained on two levels: a plain “what it means and what to do” for everyone, and the technical detail (stack traces, SQL, commands) for developers.

What it does, out of the box

• Health dashboard — an overall Health Score built from four sub-scores (errors, performance, database, security), each with a transparent breakdown of every penalty, plus a live environment summary: WordPress, PHP, database, web server, HTTPS, memory and more.
• Errors & warnings — an early error handler that starts catching PHP errors the moment WordPress loads — even while other plugins are still loading — de-duplicates them into groups, and attributes each one to the plugin, theme or core file that really caused it. Optional debug.log parsing.
• Performance — always-on light sampling of page-generation time, memory and query counts, plus on-demand deep-profiling sessions that measure each active plugin, your most expensive hooks, and your slowest SQL queries (with EXPLAIN).
• Database — per-table data and index sizes, autoload weight, overhead and bloat counters, growth tracking over time, and safe, copy-ready clean-up recipes.
• Disk & files — a resumable scanner for large files, junk, leftover plugin and theme folders, and web-exposed backups, plus a core-file integrity check against the official WordPress.org checksums.
• Logs & traffic — incremental parsing of Apache, Nginx and LiteSpeed access logs (including rotated and .gz files) into compact hourly aggregates: traffic, top URLs, bots versus humans, and status codes.
• Security — heuristics over those same logs that surface brute-force, scanning and injection attempts as ranked events, each with the evidence behind it and safe, copy-ready hardening advice.
• Recommendations — one prioritised to-do list distilled from every module. It also watches for change-over-time problems: an error rate or a page that suddenly runs far above your site’s own normal range, and the slowest front-end pages.
• Notifications — opt-in alerts the moment a new fatal error happens, plus a weekly digest that shows what changed since last time. Delivered by e-mail and, if you want, to Slack, Telegram or Discord.
• Updates & vulnerabilities — flags out-of-date core, plugins and themes, and (optionally, with your own free WPScan token) checks the installed versions against the WPScan vulnerability database so you hear about a published CVE quickly.
• Uptime & SSL — an optional hourly check of your home page (catching front-end errors and slow responses) and a warning before your TLS certificate expires.
• Client reports — an optional, white-label monthly HTML report (health, performance, errors, security and recommendations) e-mailed to you or your client. Download it any time.
• For developers — WP-CLI commands (wp site-doctor health|recommendations|scan|report) and an optional token-gated metrics endpoint for Prometheus / Grafana.

Built for real hosting

• Shared hosting is the baseline. No root, no exec(), no special PHP extensions required. Anything that genuinely needs a VPS is clearly labelled.
• Do no harm. A diagnostics tool must not slow your site down or bloat your database. Light always-on sampling plus deep, time-boxed profiling on demand; compact aggregates instead of raw data; automatic clean-up after a retention window you control.
• Privacy first. There is no telemetry and no tracking, ever. By default nothing leaves your site. A few clearly-labelled features are opt-in and only contact a service after you switch them on — vulnerability lookups, chat notifications and GeoIP — each listed in the Privacy section below. An optional IP-anonymisation setting helps with GDPR.

Privacy

CordonAI Site Health Doctor stores all of its data in your own WordPress database and your own uploads directory. It does not phone home and contains no analytics or tracking.

Every external connection is optional, off by default, and clearly documented:

• WordPress.org checksums (api.wordpress.org) — used by the Disk module’s core-integrity check to compare your core files against the official checksums for your version. This is the same mechanism WordPress itself uses.
• MaxMind GeoLite2 (download.maxmind.com) — only if you enter your own free MaxMind licence key to enable offline GeoIP. The country database is downloaded to your server and lookups then happen locally, with nothing sent out.
• WPScan (wpscan.com) — only if you enter your own free WPScan API token. The plugin sends the slugs and versions of your installed plugins, themes and core to look up published vulnerabilities. Without a token, no vulnerability lookup happens.
• Chat notifications (Slack, Telegram or Discord) — only if you paste a webhook URL or bot token. The alert text you would otherwise receive by e-mail is then also posted to that service.
• Uptime check — requests your own site’s home page on a schedule. This is your own server, not a third party.

The optional metrics endpoint is inbound only (a monitoring system pulls from it) and is disabled until you set a token; it exposes aggregate gauges with no personal data.

The Logs module can optionally anonymise IP addresses (zeroing the last octet of IPv4 / the last 80 bits of IPv6) before storing aggregates, to help with GDPR. This option is explained in the settings.