=== Carticy SiteVitals – Security, Speed, Performance & Database Optimization ===
Contributors: carticy, alikhallad
Tags: security, performance, optimization, database, woocommerce
Requires at least: 6.6
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

WordPress security and performance in one plugin. See which plugin is slowing your site down, and harden your site in one click. No account needed.

== Description ==

SiteVitals is a WordPress security and performance plugin that answers "why", not just "what".

Security plugins hand you a log. Speed plugins hand you a score. SiteVitals measures real visits to your site and names the plugin, the file and the setting behind each slow page. When a page takes 1.2 seconds, you find out what spent it.

On the security side it is WordPress hardening you can switch on immediately: limit login attempts to stop brute force guessing, require strong passwords, close the settings attackers probe first, and get told the moment a new administrator account appears.

The site check goes further and compares your plugin files against the official releases, so a file that no longer matches is named rather than left to find later.

Running a store? It blocks card testing attacks, also called carding, where bots run stolen card numbers through your WooCommerce checkout until one is approved. That runs entirely on your own site.

Every switch explains what it does before you turn it on, and every one can be turned back off.

= Free, no account needed =

Twenty-four switches. None of them send anything to us.

**Security**

* Turn off XML-RPC, an old WordPress feature attackers use to guess passwords. You can also keep it and remove only the risky parts.
* Turn off the file editor, so nobody can change your theme or plugin code from inside WordPress.
* Stop people scanning your site to collect your usernames.
* Keep your username off your posts, so only your display name is shown.
* Remove the "Remember Me" box from the login form.
* Limit login attempts. If someone is locked out, the message tells them how long it lasts and who to contact.
* Require strong passwords, and block the common ones attackers try first.
* Get warned when a new administrator account is created.
* Hide the file list in your uploads folder.
* Turn off application passwords. These let apps sign in without using your login page.
* Close new sign-ups if your site does not need them.
* Slow down repeated password reset requests.

**Speed**

* Stop your site notifying itself every time you link to your own posts.
* Remove the emoji script that loads on every page.
* Remove tags from your page code that most sites never use.
* Slow down the admin auto-refresh that runs while you work.
* Stop loading the Dashicons icon font for visitors who are not signed in.
* Save the results of database queries your admin screens repeat.

**Database**

* Limit how many old copies of each post WordPress keeps.
* Keep the background task log shorter so it stops growing.
* Delete temporary data that has expired.

**WooCommerce**

* Stop card testing attacks on your WooCommerce checkout, where bots try stolen card numbers one after another. Runs on your site and sends nothing to us.
* Hide the WooCommerce status box on your dashboard.
* Turn off WooCommerce marketplace adverts.

**Always running**

* A small counter records how long your pages take, how much memory they use, how many database queries they run, and any errors. It adds up the totals every hour. None of it leaves your site.
* A record of what changed and when, so you can match "the site got slow this week" against "that plugin updated on Tuesday".

= What a free Carticy account adds =

Connect a free account and you get a full check of your site: a health score, a score for each area, and a list of fixes in the order they are worth doing. You also find out if any of your plugins or themes have known security problems. A free account covers one check on one site.

= What paid plans add =

Fourteen more switches, plus monitoring and reports.

**Security**

* Two-step sign-in. Before it turns on, it checks that the code really reached you. It shows your backup codes once, and there is a command to switch it off if you are ever locked out.
* Security headers for your pages, tested on your live site first and only kept if everything still works.
* Automatic updates for plugins with known security problems. If one cannot be updated safely, it is switched off instead.
* A log of security events on your site, with the time each one happened.
* File permission checks that tell you what changed since your last check.
* Stop PHP files running from your uploads folder.
* Stop file lists showing in your uploads folder and every folder inside it.
* Shorter sign-in sessions for accounts that can change the site.

**Speed and database**

* Faster versions of some common slow database queries.
* Autoload optimizer, for the settings WordPress loads on every single page.
* Index manager, which adds the database indexes your queries are missing.
* Delete leftover data from posts, users and comments that were removed.
* WooCommerce: load product options in the background instead of all at once.
* WooCommerce: skip a slow scan on the product edit screen.

**Monitoring and reports**

* The full report: slow queries traced back to the exact file and line, slow code traced back to the plugin that added it, autoload size split up per plugin, and a written summary of what to fix first.
* Reports covering speed, security, SEO and WooCommerce.
* Checks on a schedule, compared against the last one, so you can see what got worse.
* Uptime monitoring and email summaries.
* Checkout reports for WooCommerce stores.

Plans start with Protect: one site, unlimited checks whenever you want, uptime monitoring, and all the switches. Growth adds checkout reports, scheduled deep checks and up to five sites. Agency plans cover ten sites and more. Current prices are at https://carticy.com/sitevitals

== Installation ==

1. Upload the plugin ZIP under Plugins, Add New, Upload. Or install it from the WordPress.org directory.
2. Activate the plugin.
3. Open **SiteVitals** in the admin menu. On the first run you can either connect a Carticy account for a full health report, or skip that and go straight to the Toolkit.
4. Optional: create a free Carticy account at https://carticy.com/sitevitals

== Frequently Asked Questions ==

= Does the plugin work without a Carticy account? =

Yes. Twenty-four switches are yours with no account: the security ones, the speed ones, the database cleanups, WooCommerce checkout bot blocking, the performance counter and the change record. All of it runs on your own site and contacts nobody.

An account adds the full site check and the vulnerability lookups. A paid plan adds fourteen more switches, monitoring and reports.

= Which features need a paid plan? =

The fourteen switches listed under paid plans, plus scheduled checks, uptime monitoring, email summaries, checkout reports and the full report. In the Toolkit each one shows which plan it belongs to, so you can see what is available without being pushed to buy.

= What information is sent to Carticy? =

Nothing until you connect your site. After you connect and run a check, we receive your site address, the names and versions of your plugins and themes, your WordPress, PHP and MySQL versions, and some database numbers such as how many settings and posts you have.

Your content never leaves your site. No posts, no user details, no customer records.

= Is my data private? =

Yes. Your results belong to your Carticy account and we never share them. The plugin can export or delete anything it has saved on your site, which covers GDPR requests, and removing the plugin removes every setting, table and scheduled task it created. The privacy text it adds to your privacy page lists every place data is kept.

= How do I remove the plugin? =

Deactivate and delete it under Plugins, Installed Plugins. The plugin always clears its scheduled tasks, saved results, any upload in progress, and any temporary accounts it created.

Deleting your stored settings and tables is your choice, under Settings, Advanced, "Remove all data on uninstall". This is off to begin with, so that deleting the plugin by mistake during an update cannot erase your history. Turn it on first if you want everything removed. If your site is connected, removing the plugin also tells us to disconnect it. On a multisite network, every site is cleaned the same way.

= Does the plugin contact your servers before I agree? =

No. On a new install with no account connected, activating contacts nobody, opening any screen contacts nobody, and turning on a switch contacts nobody. The first contact happens when you click "Connect to Carticy" or "Run audit". We test this before every release.

= Does the plugin slow down my site? =

The performance counter takes well under 1ms per page, and it runs after your visitor already has the page. Our admin files load only on SiteVitals screens, so every other admin page and your whole public site load none of our JavaScript or CSS.

= Is this a replacement for a security plugin? =

No, and we are not trying to be one. There is no malware scanner here and no firewall. What we do is check the places a scanner does not look, close the settings most sites leave open, and tell you when something changes. Use SiteVitals alongside your security plugin.

== Screenshots ==

1. A finished check. Scores for each area, the actions that would help most, a security list, and real Core Web Vitals. Checks need a connected Carticy account.
2. The dashboard: your health score and how it changed, the fixes worth doing first, uptime, and security warnings for the plugins you have installed.
3. The speed switches, free and with no account. Each one explains what it changes and what it saves, and every switch can be reversed.
4. The security switches, from turning off XML-RPC to watching administrator accounts. Anything WordPress already handles is marked, so you do not do the same job twice.
5. The first run offers two paths: connect a free account for a full health report, or go straight to the Toolkit with no sign-up.
6. Privacy settings. Sharing is off until you turn it on, anonymising is on by default, and every place your data could go is named on the page.
7. Choosing what a check covers. Areas can run together or on their own.

== Changelog ==

= 1.0.3 =
* Fixed: a fresh install read four settings from the database on every page view until each was saved for the first time; they are now in place from install and load with the page.
* Fixed: a part of the site the audit could not read was shown as if it had been measured, with an empty checkout and no orders. It is now named at the top of Insights instead, and is never scored.
* Improved: order history is counted with a few database queries instead of loading thousands of orders, so large stores no longer run the audit out of time.
* Fixed: PHP files in the uploads folder are reported as one entry per folder instead of one per file, and are only flagged as a possible web shell when the code actually behaves like one.

= 1.0.2 =
* Added: database cleanups now run from the Performance Optimizer, with a button on every finding instead of a query to copy.
* Added: remove the tables and custom fields left behind by plugins you no longer have installed.
* Added: the Optimizer is organised into Indexes, Cleanups, Autoload and Tweaks, each showing what is still outstanding.
* Improved: audit results open faster on sites with a lot of findings.
* Fixed: orphaned term assignments counted review and user tags as leftovers, so the figure was far too high and cleaning it up would have removed live data.
* Fixed: the size reported for leftover WooCommerce line items was an estimate, and the item metadata that goes with them was not counted at all.
* Fixed: cleaning old post revisions now keeps the most recent ones for each post, as it always said it did.
* Fixed: every cleanup asks for confirmation before it runs, and says whether it can be undone.
* Fixed: performance monitoring now shows the full chart and history on every site, with or without a Carticy account.
* Fixed: backend health explains what your OPcache hit rate and memory limits mean, instead of calling a healthy cache degraded.
* Fixed: profiler and slow-request figures report what was actually captured.
* Fixed: the connected-sites count no longer shows a stale number after a site is removed.

= 1.0.1 =
* Improved: audit results are easier to scan, with clearer grouping and labels.
* Improved: one-click fixes open where you need them.
* Improved: Toolkit and Settings save from a single bar, with fewer notices.
* Improved: account, connection and plan details are more accurate.
* Added: clear cached results from the Privacy screen.
* Fixed: removing a spare copy of the plugin no longer fails, and leaves the copy you keep untouched.

= 1.0.0 =
* First public release.

== External Services ==

This plugin connects to one outside service, api.carticy.com, which is our own.

* **What it does:** runs the site check (speed, security, SEO, WooCommerce and page loading), looks up known security problems for your plugins and themes, returns suggested fixes, schedules checks and email summaries, and runs uptime monitoring on paid plans.
* **What we receive:** your site address, the names and versions of your plugins and themes, your WordPress, PHP and MySQL versions, database numbers such as autoload size, setting counts, temporary data counts and post detail counts, and the collected check data listed in the plugin's privacy policy. No content is sent: no posts, no customer records, no comments. The only email address we ever receive is one you type into the optional marketing box below. The site check itself sends no email addresses at all.
* **When it is called:** only after you connect your site to a Carticy account through the first-run screens or the Settings page, and then either run a check, switch on a service such as email summaries, uptime or scheduled checks, or the once-a-day background call runs for a connected site. A new install with no connection makes no calls at all, apart from the box below.
* **Optional marketing box:** the first-run screens offer an unticked box for occasional product tips by email. Only if you tick it and enter an address does that address reach us. Leave it alone and nothing is sent. This is the one call an unconnected install can make, and only because you asked for it.
* **Terms of service:** https://carticy.com/terms
* **Privacy policy:** https://carticy.com/privacy

Nothing else contacts an outside server. Every Toolkit switch, checkout bot blocking, temporary data cleanup, admin caching, the change record and the performance counter all run on your own site.
