Skip to main content
WP HealthKit
Changelog

What's new in WP HealthKit

Recent updates to the audit engine, platform features, and marketing pages. Updated as work ships.

  1. September 2026

    One engine, three plans — the paywall moves to the trust layer

    The WPHK Engine — one engine, every audit

    • The Standard/Advanced/Premium model picker is gone. Every audit runs the same versioned WPHK Engine, so grades stay comparable across plugins and signed receipts stay reproducible
    • Security findings are cross-validated: Kimi K3 and DeepSeek v4 Flash audit independently — only findings both models corroborate get HIGH confidence
    • Claude Opus was removed from the roster: it cost ~$4/audit and missed the logic flaws Kimi K3 catches

    Simpler plans — Free, Platform, Enterprise

    • Free: unlimited scans + 1 full AI audit. Platform: £49/mo (50 AI audits). Enterprise: £299/mo (300 AI audits, BYOK for unlimited)
    • Signed provenance receipts are now a paid artifact — free audits still run, but only paid plans mint a receipt
    • Token multipliers are gone: one engine, one price per audit. Token packs were removed — the £4.99 single audit is the one-off top-up
    • Studio, hosted Agency and BYOK Agency are consolidated into Platform and Enterprise

  2. August 2026

    Agency goes BYOK-only + the profitability wave

    Agency is now BYOK — £149/mo

    • Hosted Agency (£299/mo) is retired for new sales. Agencies are sophisticated buyers — they have their own AI accounts, and running audits on them takes compute risk off the table entirely
    • Agency is now £149/mo (BYOK): unlimited audits on your own AI keys with the same standardized model roster — grades stay comparable with hosted results
    • Existing hosted Agency subscribers are unaffected; /upgrade?plan=agency transparently redirects to BYOK Agency
    • This makes Agency our first 100%-compute-margin tier

    CRA Readiness Bundle — £99

    • New one-off bundle ahead of the 11 September CRA deadline: full audit + Fix Plan, SBOM (CycloneDX), OpenVEX, signed provenance receipt, and SECURITY.md + VDP templates
    • Landing at /cra-readiness — bundle buyers get 50% off Pro or Agency for 3 months

    Pass wp.org review first time

    • The preflight offer gets its own home at /pass-wporg-review — a deterministic 0-10 readiness score against what reviewers actually reject on
    • Preflight audits now email results with 50% off your first month of Pro (WPORG50)

    Pricing page, decompressed

    • The tier ladder is now five plans with BYOK in the middle — responsive columns, no more cramped cards or wrapping prices
    • Annual is the default everywhere: 2 months free (monthly × 9) plus the launch-price lock

  3. July 2026

    Living Audits — audits that stay true

    Living Audits (powered by Reverify)

    • Every audit's claims of safety and currency — declared minimum PHP, tested-up-to WordPress, pinned Composer/npm dependencies — are now continuously re-verified against ground truth (OSV, endoflife.date, wp.org, library docs) by Reverify
    • When a claim breaks (a PHP version reaches end-of-life, a CVE lands in a bundled library), a signed challenge with quoted evidence attaches to the report — the original audit is never edited
    • New Living Audits section on every report lists each claim with its verdict; challenged claims show the challenge and evidence inline
    • Finding-level challenge banners, directory under-review markers, Agency fleet alerts, and a new claim.challenged outbound webhook event
    • Safety-positive claims only: the audit's own vulnerability findings are never submitted (findings don't rot — safety claims do), and dependencies already flagged are excluded

    The why layer

    • Every CRITICAL and HIGH finding now carries a structured rationale generated in the engine pass: the evidence that grounds it, why it earned its severity, what was assumed, and what would change the assessment
    • Premium triple-model audits merge rationales across models — when models cite conflicting severity drivers, the disagreement is surfaced, not silently resolved

    Fix-It — verified patches

    • Fix-It takes a finding all the way: a baseline exploit probe confirms the vulnerability in the sandbox, a patch is applied, then the same probe is re-fired
    • The patched ZIP only becomes downloadable when the probe is rejected AND the plugin still activates — a patch that can't prove itself is never handed to you

    Scoring & platform fixes

    • Audits list now shows the real overall audit score (was the PHPCS standards score — everything appeared to be 100)
    • PHPCS restored in production (a flag the bundled version didn't know was silently zeroing every scan); a failed scan now reports unknown instead of a perfect score
    • Scanner versions panel now covers the full roster — 57 deterministic scanners + 6 engines with proper names (was 45)
    • WPVulnerability intelligence restored after the upstream API moved — migrated to the new endpoint with version-range matching

  4. July 2026

    BYOK + full-ladder benchmarks

    BYOK (Bring Your Own Key)

    • BYOK Agency (£149/mo): unlimited audits on YOUR AI provider keys — DeepSeek, Anthropic, Moonshot, OpenAI, xAI, Google, OpenRouter. Your keys, your bill; we charge for the platform.
    • Standardized recommended model roster by default so directory grades stay comparable across hosted and BYOK audits
    • Enterprise adds per-engine model choice from the benchmark-validated list (security/QoL/a11y/theme/performance engines + Premium validator roster)
    • Keys are AES-256 encrypted at rest, validated against the provider before saving, and used only for audit calls

    Model attribution + expanded benchmark

    • Every audit records its AI engine roster; provenance receipts now sign WHICH models produced the grade — public on /receipts, directory pages, and the verify API
    • Open benchmark expanded to 14 frontier models (GPT-5.2/mini, Gemini 3, Grok 4.5, Qwen3, GLM-4.6, MiniMax M2, Opus 5, Fable 5) + a real-world suite across five production plugins — live at /models

  5. July 2026

    The trust layer

    Provenance receipts

    • Every completed audit mints an HMAC-SHA256-signed provenance receipt attesting that a specific artifact (ZIP sha256) passed — public verification page at /receipts/[id], machine check at /api/v1/receipts/[id]/verify
    • Newer audits of the same plugin supersede older receipts so verification always tells the truth over time

    Open benchmark

    • Monthly frontier-model evaluation against a fixed known-flaw corpus, published live at /models and /api/v1/benchmark
    • Current ladder: DeepSeek v4 Flash, Kimi K3, Claude Sonnet 4.6, Claude Opus 4.7 — recall, false positives, latency and cost per model

    Playground exploit probes

    • AJAX exploit probe: every wp_ajax_nopriv_* handler executed unauthenticated in the sandbox — executed probes report HIGH with a live proof-of-concept
    • Dynamic REST auth probe: unauthenticated rest_do_request against every non-core write route — proof, not patterns

    Premium refactor plans

    • Premium engine tier clusters related findings into systemic refactor plans — one root-cause fix that eliminates a whole class of bug
    • Refactor plans ship in the Fix Plan API, Markdown export, dashboard, and MCP get_fix_plan tool

    AI agent skill

    • wphk-audit skill for Claude Code, Cursor and other agents — audit your own WordPress code before shipping (/features/agents)

  6. June 2026

    Pricing restructure + model tiers

    Pricing

    • GBP pricing restructure: Studio tier added (£69/mo, 30 audits + 3 sites), Agency repriced £149 → £299/mo
    • Free tier split: unlimited deterministic scans + 1 AI audit/month
    • Non-expiring token packs (25/100) — draw after your monthly allotment, FIFO

    Model tiers

    • Standard (DeepSeek v4 Flash, ×1 token), Advanced (Kimi K3, ×2), Premium (triple-validated security: K3 + Claude Opus 4.7 + DeepSeek v4 Flash, ×5)
    • Tier membership gated on the open benchmark — models earn their multiplier

  7. May 2026

    WordPress 7 ready

    WordPress 7 support

    • Activation matrix now benchmarks against WordPress 7.0 (released 2026-05-20) and 6.8 — every audit reflects the latest stable
    • WP compatibility scanner emits a dedicated WordPress 7 clarification finding so reports state exactly which version they were tested against
    • wp_specialchars() flagged as removed in WP 7.0 (after a decade of deprecation) — replace with esc_html() for escaping
    • Context7 doc-cache integration — AI engines pull current WordPress 7 deprecation notes live rather than relying on training-cutoff knowledge
    • Tested up to validation now compares against 7.0 by default; set LATEST_WP_VERSION env var to override per environment

  8. April 2026

    Major Update

    Scan engine (62 verification layers)

    • REST API authorization scanner — detects missing permission_callback (the #1 exploited WordPress vulnerability class)
    • GDPR compliance scanner — flags external data transmission without consent, missing data erasure hooks
    • npm/JS dependency scanner — OSV.dev batch CVE check on bundled JavaScript packages
    • Gutenberg block scanner — render_callback escaping, block.json attribute type safety
    • Host compatibility scanner — WP Engine, Kinsta, Flywheel compatibility scoring with affiliate disclosure
    • CRA compliance scanner — SECURITY.md presence, VDP contact, changelog security tagging (EU Cyber Resilience Act)
    • Multisite compatibility scanner — manage_options vs manage_network_options, $wpdb->prefix in multi-blog loops
    • GPL/license compatibility scanner — Composer + npm production deps against GPL compatibility list
    • CodeCanyon/Envato submission scanner — inline JS, debug code, hardcoded URLs, missing docs, compressed PHP
    • Theme scanner (themes only) — style.css headers, FSE/block readiness, customizer sanitization, WooCommerce template overrides
    • WordPress Playground activation matrix — optional engine testing WP 7.0/6.8 × PHP 8.1/8.2/8.3 + WooCommerce conflict check
    • SBOM generation — CycloneDX 1.6 and SPDX 2.3 from Composer + npm dependencies

    Token pricing (superseded — see June 2026)

    • This token model was retired in the June 2026 restructure: Free is now unlimited deterministic + 1 AI audit/mo, Agency £299/mo, and token packs never expire. Studio was retired July 2026.

    New features

    • wp.org pre-flight mode — frames audit for WordPress.org submission review, always private
    • Supply chain ownership monitoring — alerts when a monitored plugin changes author on WordPress.org
    • Email drip series — CRA countdown (4 emails) and AI plugin security (3 emails) sequences
    • Performance regression tracking — Playground engine tracks memory/query deltas across plugin versions
    • Monthly findings log — aggregate findings analytics powering the /reports infographic dashboard
    • MCP v0.5.2 — generate_sbom and get_telemetry_stats tools; 6 reference resources; 3 prompt templates

    New marketing pages

    • /features/playground, /features/sbom, /features/supply-chain, /features/host-compatibility
    • /cra-compliance — CRA September 2026 deadline guide
    • /for/ai-plugin-development, /for/ai-generated-plugins, /for/envato-authors

Want to see what shipped before this?

Browse community updates from verified plugin developers, or read the latest from the WP HealthKit blog.

Community updatesVisit the blog