# WP HealthKit

> AI-powered WordPress plugin and theme security, quality, and accessibility audit platform with 62 verification layers, cross-validated security findings, Fix Plan remediation, and continuous site monitoring.

## About

WP HealthKit audits WordPress plugins and themes using 62 verification layers — 58 deterministic scanners and 4 AI engines. Upload a ZIP file, paste a WordPress.org URL, connect your GitHub repo (push + PR audits), use the GitHub Action, REST API, MCP server, WP-CLI, or the companion WordPress plugin for live site monitoring. Every audit produces a report card, a Fix Plan (structured remediation as Markdown + JSON for dev teams and AI coding agents), and optionally SARIF for GitHub code scanning, SBOM (CycloneDX/SPDX), and OpenVEX documents for CRA compliance.

## Verification Layers

### 58 Deterministic Scanners

**Vulnerabilities & supply chain:**
- **Wordfence CVE Database**: Cross-references plugins against known WordPress vulnerabilities
- **WPScan Vulnerability DB**: WPScan's CVE and advisory feed
- **WPVulnerability / Patchstack**: WP-plugin-specific vuln database
- **Composer Dependency Audit**: composer.lock against Packagist security advisories
- **Composer OSV Scanner**: OSV.dev (GitHub Security Advisories + FriendsOfPHP)
- **npm Dependency Audit**: package-lock.json against OSV.dev
- **Dependency Freshness Scanner**: Flags any bundled release published <48h before the audit — the highest-risk window for supply-chain attacks
- **Socket.dev Behavioural Risk**: Typosquatting, install-script abuse, hidden binaries, unverified authors (requires SOCKET_API_KEY)
- **Bundled-Asset CVE Scanner**: Detects vendored JS libraries by filename + version comment and cross-references OSV npm — catches lockfile-less CVE exposure
- **Update Channel Safety**: Cleartext update servers, SSL verification disabled, updates written without integrity checks, forced auto-updates, Zip Slip path traversal in update extraction

**Secrets, malware & integrity:**
- **Secret Detection**: 22+ credential patterns (AWS, Stripe, Google, Slack, private keys, database passwords)
- **Anti-Malware Detection**: Obfuscated code, backdoors, nulled/cracked plugins, data exfiltration. Risk levels: CLEAN, SUSPICIOUS, MALWARE, NULLED
- **Release-Hygiene / Build-Artifact Scanner**: Flags .env, .git/, node_modules/, source maps, log files shipped in production ZIPs
- **License Key Handling**: Hard-coded license keys, keys in URLs, keys rendered into admin output, plain-HTTP license verification

**Code & API security:**
- **AJAX / admin-post Nonce + Capability Scanner**: Resolves every wp_ajax_*/admin_post_* callback across files; CRITICAL on nopriv missing nonce/capability
- **REST API Authorization Scanner**: register_rest_route without real permission_callback
- **Dynamic REST Auth Probe**: Inside a live WordPress sandbox (WP Playground), fires unauthenticated write requests at every registered REST route — including param routes with substituted IDs. Dynamic proof an endpoint is open, not a static pattern match
- **Semgrep Static Analysis**: Custom WordPress security rules for taint tracking and injection patterns
- **Psalm Taint Analysis**: Dataflow taint for unescaped user input reaching sensitive sinks
- **AI Agent Scanner**: The 2026 attack class — prompt-injection sinks (user input into LLM prompts), provider keys leaked to browser, unbounded LLM calls (cost bombs), model output executed without validation, agent tool overreach
- **AI/LLM Safety Scanner**: LLM credential leaks, prompt injection, cost-bomb detection

**Compatibility:**
- **PHP Compatibility**: PHP 8.0–8.5 features and deprecated constructs (incl. 8.5 pipe operator, clone-with, array_first/last)
- **WordPress Compatibility**: Deprecated WP functions, version requirements, Tested-up-to validation against WordPress 7.0
- **WooCommerce Compatibility**: HPOS, Cart/Checkout Blocks, deprecated WC hooks
- **Backwards Compatibility**: Breaking changes vs declared minimum WP version
- **Host Compatibility**: WP Engine, Kinsta, Flywheel + 5 more managed hosts
- **Theme CSS Compat**: Broad selectors, specificity hijacks, admin/frontend leak
- **Interactivity API & Script Modules**: wp_interactivity_state taint, external ES module origins, nonce-free module writes — the 2026 front-end stack

**Quality & standards:**
- **PHPCS WordPress Coding Standards**: 0-100 score
- **PHPStan Type Safety**: Level 5 static analysis with WordPress stubs
- **Hook Wiring Audit**: Dead callbacks, arg mismatches, timing, missing cron unhooks
- **Performance Anti-Patterns**: N+1 queries, autoload bloat, uncached requests, INP-era JS issues (sync XHR, hot intervals, speculation rules misuse)
- **i18n Readiness**: Hardcoded strings, wrong text domain, concatenation traps
- **Database Schema Audit**: dbDelta, charset/collation, indexes, unsafe DROP/TRUNCATE
- **Uninstall Verifier**: Cross-references data created vs deleted on uninstall — orphaned options, transients, custom tables, multisite loops (the #1 wp.org review failure)
- **WP-Cron Audit**: Orphaned events after deactivation, sub-5-minute intervals, duplicate scheduling without guards, heavy callbacks on frequent schedules
- **CPT/Taxonomy Collision**: Reserved slugs, length limits, wp_ prefix, rewrite collisions
- **Readme-vs-Reality Drift**: readme.txt contradictions — Requires PHP drift, documented shortcodes that don't exist, stale Tested-up-to
- **theme.json Validator**: Invalid JSON (silently drops all settings), bad version, typo'd keys, missing template references
- **block.json Taint**: Editor-controlled block attributes reaching render without escaping

**Privacy & compliance:**
- **GDPR Scanner**: External transmission without consent, missing erasure hooks
- **Consent Mode v2 Scanner**: Pre-consent tracker injection (gtag, Meta, TikTok, LinkedIn, Hotjar, Clarity), partial Consent Mode, front-end cookies before consent
- **Phone-Home Detector**: Undisclosed telemetry — site data to third-party hosts without opt-in, cron-scheduled reporting, hidden admin beacons
- **CRA Scanner**: EU Cyber Resilience Act preparedness (SECURITY.md, VDP contact, changelog tagging)

**Marketplace & ecosystem:**
- **Plugin Conflict Detection**: Unprefixed functions, handle collisions, namespace conflicts
- **Commercial Update Scanner**: EDD/Lemon Squeezy/PUC wiring, key-in-URL detection
- **Content Uniformity**: Version drift across header/readme/strings
- **Envato Scanner**: CodeCanyon pre-submission patterns
- **Multisite Scanner**: Multisite awareness checks
- **Admin UI Scanner**: Unescaped admin output, notice markup
- **Block Scanner**: Gutenberg render_callback escaping, block.json safety
- **Plugin Metadata Scanner**: Header completeness, readme.txt structure
- **Email Quality Scanner**: wp_mail() usage validation
- **License Deps Scanner**: GPL compatibility via Composer/npm dependency classification
- **License Files Scanner**: GPL compatibility via bundled-file walk
- **Theme Scanner**: style.css headers, FSE, customizer, WC overrides (themes)

**Accessibility:**
- **WCAG 2.2 Scanner**: Deterministic WCAG 2.2 criteria — SC 2.5.8 target size (24px), SC 3.3.8 accessible authentication (CAPTCHA-only gates), SC 2.5.7 dragging movements, SC 2.4.11 focus not obscured

### 4 AI Engines
- **AI Security Engine**: 6-phase security audit
- **AI Quality-of-Life Engine**: 9-dimension code quality and WordPress standards analysis
- **AI Accessibility Engine**: WCAG 2.1 Level AA + European Accessibility Act compliance
- **AI Theme Engine**: 7-phase template/hierarchy/FSE/customizer analysis (themes only)

### The WPHK Engine (one engine, every audit)
- Every audit runs the same versioned engine — no model choice, no token multipliers. Grades stay comparable across plugins and signed receipts stay reproducible.
- **Security is cross-validated**: two independent frontier models audit security separately; findings both models corroborate get HIGH confidence. The quality, accessibility and theme engines each run a pinned model. Model roster and benchmarks: /models
- The engine version is recorded on every audit. Benchmarks: /models

### Smart Scoring (what makes the grade trustworthy)
- **Cross-source confidence**: HIGH (2+ sources agree), MEDIUM (one trusted source), LOW (single AI-only). Two-model security cross-validation turns this into explicit corroboration.
- **Fuzzy dedupe**: same-bug-different-phrasing across engines/models collapses into one corroborated finding
- **Execution-context weighting**: an N+1 in a GDPR exporter costs 5% of the same bug on the frontend-hot path
- **Cross-file callback resolution**: nonces and permission_callbacks resolved across files before flagging
- **AI hallucination guard**: cited lines must exist, cited code tokens must appear near them, suggested fixes must parse
- **Engine-failure transparency**: failed dimensions report null, never a substituted clean number
- **Per-user false-positive suppression** with persistence across re-audits

## Fix Plan (remediation)

Every audit ends with a structured Fix Plan — every finding with why it matters, how to fix it, and what to test after:
- Markdown rendering designed to paste into AI coding agents (Cursor, Claude Code, Copilot)
- Versioned JSON schema for tooling
- Agent-safety flags: which fixes an agent can apply mechanically vs which need human judgement
- Paid plans: suggested unified diffs per finding, cross-validated by two independent models before they reach the report
- Test Generator: one-click PHPUnit + Brain Monkey test scaffold per finding (php -l validated) — the regression test that proves the fix worked
- SARIF 2.1.0 export for GitHub code scanning
- Available at /api/reports/[id]/fixplan, via MCP tool get_fix_plan, and in the results UI
- Note: the previous AutoFix product (patched ZIP downloads) has been retired — the Fix Plan replaces it

## Pricing (GBP)

- Free: £0 — unlimited deterministic scans (all 58 checks) + 1 full AI audit (one-off). Public results only.
- Platform: £49/month (£441/year) — 50 AI audits/month, private results, signed provenance receipts, SBOM, monitoring (3 sites), REST API + CLI + GitHub Action, PDF reports, Fix Plan.
- Enterprise: £199/month (£1,791/year) — 50 AI audits/month, fleet dashboard, 100 monitored sites, 5 team seats, white-label reports, CRA/GDPR/WCAG/EAA reports, and BYOK (bring your own AI provider keys) for unlimited audits.
- Single Audit: £4.99 one-off (no subscription) — also the overage unit beyond a plan's monthly allowance.
- CRA Readiness Bundle: £99 one-off — full audit + SBOM (CycloneDX/SPDX) + OpenVEX + VDP document + signed provenance receipt, packaged for the EU Cyber Resilience Act. Landing: /cra-readiness
- Annual billing: 25% discount (monthly × 9) on Platform and Enterprise.

Note: Free-tier audits are always public. Private results, signed receipts, monitoring and API access require a paid plan.

## GitHub Integration

- **GitHub App**: connect a repo → full 62-layer audit on every push to the watched branch, Check Runs with annotations, completion email + notification
- **PR audits**: audits the PR head and posts a comment with new-findings-only delta vs the base branch; Check Run gates only on NEW critical/high findings — pre-existing issues never block a PR
- **Scheduled re-scans**: weekly re-audit of connected repos (dependencies rot between pushes)
- **GitHub Action**: wp-healthkit/audit-action — CI audits with severity gating, SARIF artifact for GitHub code scanning

## Site Monitoring & Companion Plugin

Install the lightweight WordPress companion plugin (v1.2.0):
- Automatic plugin inventory sync via heartbeat
- Auto re-audit when plugins update, with "should I update?" narratives (version-to-version security briefings)
- Site health score, critical finding and CVE email alerts
- WP admin dashboard widget with security grade
- Multi-site monitoring (3 sites on Platform, 100 on Enterprise)
- Weekly digest emails and monthly white-label client reports (Enterprise)

## Public Directory & Leaderboard

WP HealthKit continuously audits the top WordPress.org plugins and themes:
- Daily version checks against WordPress.org API
- Full audit on every new version
- Public leaderboard ranked by security and quality grade
- Developer profiles and developer leaderboard
- Plugin/theme claiming with verified-developer badges
- Free plugin health checker at /tools/check
- Public update-safety ratings at /safety/[slug] — deterministic safe/caution/risky verdict per audited version pair, with embeddable SVG badge (/api/safety-badge/[slug].svg) and JSON API (/api/v1/safety/[slug])

## AI Coding Agents

WP HealthKit ships an agent skill (wphk-audit) that makes auditing a natural step in an AI coding agent's loop — the agent audits its own WordPress code before shipping, applies Fix Plans, and checks update safety. Skill file: https://wphealthkit.com/skills/wphk-audit/SKILL.md — install guide: /features/agents. MCP server (npx @wphealthkit/mcp-server) works with Claude Code, Cursor, and any MCP client (paid plan + API key required). No account? A free anonymous deterministic scan is available at /upload (2/day, public results).

## Integrations

- GitHub Actions: wp-healthkit/audit-action (CI audits + SARIF code scanning)
- WP-CLI: wp healthkit audit command
- Public REST API (Platform+): /docs/api — audits, reports, Fix Plans, SBOM, VEX, SARIF, webhooks
- MCP Server: tools include audit_plugin, audit_plugins_bulk, get_fix_plan, get_fix_prompt, generate_sbom, check_plugin, list_usage, flag_finding — /docs/mcp
- CLI: npx @wphealthkit/cli — /docs/cli
- Outbound webhooks: audit.completed / audit.failed with HMAC signatures — /docs/webhooks
- Partner/Whitelabel API: full audit pipeline for integration partners
- Embeddable badges and security widgets — /features/embed

## Compliance artifacts

- **SBOM**: CycloneDX 1.6 and SPDX 2.3 generation per audit (/api/v1/reports/[id]/sbom)
- **OpenVEX**: per-CVE exploitability statements with corroboration evidence (/api/v1/reports/[id]/vex)
- **CRA Compliance**: EU Declaration of Conformity rendering, CRA scanner, /cra-compliance (September 2026 deadline)
- **Provenance receipts**: every completed audit mints an HMAC-SHA256-signed receipt attesting that a specific artifact (ZIP sha256) passed. Public verification page at /receipts/[id], machine check at /api/v1/receipts/[id]/verify (no auth), explainer at /receipts. Newer audits of the same slug supersede older receipts.

## Living Audits (continuous verification)

Every audit's claims of safety and currency — declared minimum PHP, tested-up-to WordPress, pinned Composer/npm dependencies — are extracted at audit time and continuously re-verified by Reverify (https://reverify.co.uk) against ground truth (OSV, endoflife.date, wp.org, library documentation). When a claim breaks (a PHP version reaches EOL, a CVE lands in a bundled library), a signed challenge with quoted evidence attaches to the report; the original audit is never mutated. Every CRITICAL/HIGH finding also carries a structured rationale (evidence, severity drivers, assumptions, contest conditions) generated in the engine pass. Surfaces: Living Audits section on every report, finding-level challenge banners, directory under-review markers, Enterprise fleet alerts, and a claim.challenged outbound webhook event. Safety-positive claims only — vulnerability findings are never submitted (findings don't rot; safety claims do), and dependencies already flagged by the audit are excluded. Feature page: /features/living-audits.

## Executed proof (witnesses)

Every audit that runs the Playground engine persists signed witness packets (reverify/witness/v1) from the sandbox AJAX/REST exploit probes — executed proof, not pattern-matching. Packets are bound to the artifact sha256, signed at generation with the WPHK producer key (ed25519), and publicly verifiable against the Reverify key registry (https://reverify.co.uk/.well-known/reverify-keys.json). Fix-It runs persist before/after pairs (leaked on the original artifact, rejected on the patched one — machine-checkable proof of fix). Surfaces: 'Executed proof' card on reports, public verification endpoint GET /api/v1/witnesses/[uid]/verify (no auth), human page /verify/witness/[uid]. Witnesses on private audits stay owner-only.

## Public Pages

- / -- Homepage
- /upload -- Upload and audit a plugin or theme
- /models -- WPHK Engine benchmarks (real evaluation data)
- /receipts -- Provenance receipts: signed, publicly verifiable proof an artifact passed audit
- /directory -- Browse security-audited WordPress plugins and themes
- /leaderboard -- Plugin leaderboard ranked by security and quality
- /vulnerabilities -- Live WordPress vulnerability tracker and CVE feed
- /ecosystem -- WordPress ecosystem health report
- /stats -- WordPress plugin security statistics
- /cra-compliance -- EU Cyber Resilience Act landing page
- /cra-readiness -- CRA Readiness Bundle (£99 one-off): audit + SBOM + OpenVEX + VDP + signed receipt
- /pass-wporg-review -- wp.org pre-submission checks ("Pass wp.org review first time")
- /pricing -- Plans and pricing with comparison table
- /about -- About WP HealthKit and BuiltByGo
- /changelog -- Platform changelog (new scanners, engines, features)
- /community -- Community showcase (user-submitted plugins)
- /directory/developers -- Developer profiles (plugins grouped by author)
- /stats/trends -- Prevalence trends across the last 500 public audits
- /features -- Full feature breakdown (including "The Bleeding Edge" 2026 scanner categories)
- /features/autofix -- Fix Plan feature page
- /features/agents -- AI coding agent skill install (Claude Code, Cursor)
- /features/playground -- WordPress Playground activation matrix + dynamic REST auth probe
- /features/sbom -- SBOM generation (CycloneDX/SPDX)
- /features/living-audits -- Living Audits: claims continuously re-verified by Reverify, signed challenges on drift
- /verify/witness/[uid] -- Public witness verification (signed sandbox probe proofs)
- /api/v1/witnesses/[uid]/verify -- Machine witness verification endpoint (no auth)
- /features/supply-chain -- Supply chain security scanners
- /features/api, /features/mcp, /features/cli, /features/embed, /features/directory, /features/host-compatibility
- /docs, /docs/api, /docs/mcp, /docs/cli, /docs/webhooks
- /for/developers, /for/agencies, /for/freelancers, /for/wp-org-submissions, /for/woocommerce-developers, /for/theme-developers, /for/ai-generated-plugins, /for/ai-plugin-development, /for/envato-authors
- /open-source -- Free audits for qualifying OSS plugins (8/month + badge)
- /blog, /learn, /compare -- Content marketing and comparisons
- /tools/check, /tools/security-quiz, /tools/security-cost-calculator

## Multilingual

Available in 6 languages: English, Spanish, German, French, Portuguese, Japanese. URL structure: /es/pricing, /de/features, etc. English is the default locale without prefix.

## Company

Built by: BuiltByGo LTD, registered in England and Wales.
Website: https://wphealthkit.com
Contact: https://wphealthkit.com/contact
Email: support@wphealthkit.com