320px Site Audit helps an administrator understand what needs attention, what\nis fine, and what could not be tested. It analyses WordPress, PHP, the database,\nscheduled tasks, installed components, selected source code, public pages,\ntechnical search signals, rendered-page evidence, privacy-process answers, and\noptional server evidence.<\/p>\n\n
The recommended Main audit contains 46 results: the 20-result Express local\nsubset, ten further local WordPress checks, and 16 analyses of one bounded\nsame-site crawl. Separate checks cover active custom code, 1\u201310 components\nchosen by the administrator, a controlled rendered home page, and local server\nevidence through WP-CLI.<\/p>\n\n
Reports lead with the observed fact and a concrete next action. Search findings\ngroup the exact problem and show safe same-site page paths when privacy rules\nallow them. Clean results stay available in a collapsed section. Method,\ncoverage, confidence, sources, and limitations remain available without\nobscuring the answer.<\/p>\n\n
The plugin analyses and explains. It does not repair, delete, optimize, update,\nor change audited content, users, settings, plugins, themes, server\nconfiguration, or databases. It writes only its own bounded run, task, result,\ndecision, and operation records.<\/p>\n\n
Static and automated findings are review signals, not proof of a vulnerability,\ncompatibility with every environment, search ranking, WCAG conformance, or\nlegal compliance. Missing or limited evidence is reported as not tested or\npartial, never converted to a pass.<\/p>\n\n
The complete base report works locally without an account, license, payment,\nemail gate, telemetry, or automatic report transfer. Opening the plugin,\nrunning local checks, viewing or exporting reports, cron, activation, and\nuninstall do not contact 320px or another external service.<\/p>\n\n
Stored evidence is bounded and masked. The plugin does not retain page HTML,\nvisible text, cookies, credentials, secret values, database content, or source\ncode. A crawl may retain a hostless, queryless page path only when its segments\ndo not resemble personal data, credentials, or opaque tokens. Reports and\nexports should still be treated as private technical documents.<\/p>\n\n
Every optional external operation is off by default. Before it runs, an\nauthorized administrator sees the receiver, purpose, data classes, and relevant\nterms, then confirms that one operation. No scheduled task starts an external\ntransfer.<\/p>\n\n
The services below are optional and are not required for the local report.<\/p>\n\n
Core integrity sends only the installed WordPress version and locale to\n https:\/\/api.wordpress.org\/core\/checksums\/1.0\/. Plugin integrity sends only one\nadministrator-selected public plugin slug and version to\n https:\/\/downloads.wordpress.org\/plugin-checksums\/{slug}\/{version}.json.\nOrdinary network metadata is also visible to the receiver. Neither operation\nsends the site URL, files, paths, component inventory, report, cookies, or\nauthorization. Each operation requires its own confirmation. Privacy policy:\nhttps:\/\/wordpress.org\/about\/privacy\/<\/p>\n\n
The optional owner-run WP-CLI continuation has a zero-request preview. Only\nafter An administrator may voluntarily send a review request to\n https:\/\/wp-content.ru\/wp-json\/wp-content-platform\/v1\/review-requests.\nContact-only is the default. The administrator may instead choose a short\nsummary, selected results, or the redacted full report. The exact payload and\nbyte size are previewed locally before separate consent and final confirmation.\nThe site URL, local identifiers, credentials, and private visual evidence are\nnever included. There is no retry or background submission. The response gives\nan opaque request ID, deletion link, and retention date of about 90 days.\nTerms: https:\/\/wp-content.ru\/terms\/\nPrivacy policy: https:\/\/wp-content.ru\/privacy\/\nConsent: https:\/\/wp-content.ru\/personal-data-consent\/<\/p>\n\n The browser companion is human-readable source included in Without Only administrators with No. It analyses and explains. It changes only its own removable operational\nrecords.<\/p><\/dd>\n No. The complete base report and local exports work without any of them. There\nis no telemetry. Optional network actions are separately disclosed and\nconfirmed.<\/p><\/dd>\n The required evidence was unavailable, restricted, stale, or outside the\nselected check. The result includes the exact reason and next step instead of\nguessing.<\/p><\/dd>\n No. It is bounded diagnostic evidence, not a guarantee, certification,\npenetration test, ranking forecast, manual accessibility audit, or legal advice.<\/p><\/dd>\n Read --confirm-network<\/code>, it sends the owner's bearer API key, the minimal Site\nAudit user agent, and ordinary network metadata to the fixed Wordfence Scanner\nFeed endpoint at\n https:\/\/www.wordfence.com\/api\/intelligence\/v3\/vulnerabilities\/scanner. It\ndoes not send the site URL, component inventory or versions, report, or personal\ndata. The complete feed is matched locally and deleted immediately. The key is\nread from PX320_WORDFENCE_TOKEN<\/code> and is never stored. Terms:\nhttps:\/\/www.wordfence.com\/wordfence-intelligence-terms-and-conditions\/\nPrivacy policy: https:\/\/www.wordfence.com\/privacy-policy\/<\/p>\n\nRequest a review from 320px<\/h4>\n\n
Optional browser CLI dependencies and page requests<\/h4>\n\n
cli\/browser<\/code>; PHP\nand wp-admin never install or execute it. The owner independently installs its\npinned packages. With default npm settings that contacts\n https:\/\/registry.npmjs.org\/; npm terms and privacy are at\nhttps:\/\/www.npmjs.com\/policies\/terms and\nhttps:\/\/www.npmjs.com\/policies\/privacy. The Playwright installer provides a\ndry run that lists its browser download URLs; documentation is at\nhttps:\/\/playwright.dev\/docs\/browsers and Microsoft privacy terms are at\nhttps:\/\/privacy.microsoft.com\/privacystatement.<\/p>\n\n--confirm-network<\/code>, the companion makes no page request. A confirmed\nrun loads only 1\u20135 explicit queryless pages in a fresh sandboxed Chromium\ncontext. The pages and their ordinary first- or third-party resources receive\nnormal browser\/network metadata and anything page scripts place in allowed GET\nrequest URLs or headers. Mutating HTTP methods, later document navigation,\nframes, popups, saved downloads, WebSockets, WebRTC, WebTransport, and workers\nare blocked within fixed request, byte, and time limits. Its ordinary JSON\ncontains aggregates and keyed references, not URLs, text, HTML, selectors,\nfield values, cookies, screenshots, or response bodies. There is no upload or\nWordPress callback.<\/p>\n\n\n\n
manage_options<\/code> can open reports or start actions.<\/p>\n\n\n\n
Does Site Audit fix or change my site?<\/h3><\/dt>\n
Is an account, email, license, or report upload required?<\/h3><\/dt>\n
Why can a result be \u201cnot tested\u201d?<\/h3><\/dt>\n
Does a clean report prove security, SEO results, accessibility, or compliance?<\/h3><\/dt>\n
How do I report a security issue or ask for support?<\/h3><\/dt>\n
SECURITY.md<\/code> and SUPPORT.txt<\/code> in the installed plugin. Never send a live\nsite archive, database dump, credentials, or an unreviewed report.<\/p><\/dd>\n\n<\/dl>\n\n\n0.1.1<\/h4>\n\n
\n
0.1.0<\/h4>\n\n
\n