Documentation

Requirements

Installing from WordPress.org

The plugin is listed in the WordPress.org plugin directory at wordpress.org/plugins/klydexa-website-audit. This is the recommended route - WordPress then handles updates for you.

1. In WordPress go to Plugins → Add New.
2. Search for Klydexa Website Audit.
3. Press Install Now, then Activate.
4. Go to Klydexa Website Audit → Audit Report and press Run full audit.

Installing from the ZIP

Use this if you prefer to install manually, or need a specific version.

Version 1.0.0 · ZIP, 122 KB

1. Download the ZIP above.
2. In WordPress go to Plugins → Add New → Upload Plugin, choose the ZIP and press Install Now. Alternatively, unzip it and upload the klydexa-website-audit folder to /wp-content/plugins/ over SFTP.
3. Activate the plugin.
4. Go to Klydexa Website Audit → Audit Report and press Run full audit.
5. Read Klydexa Website Audit → Documentation for what each check means and which fixes to approach carefully.

The plugin needs to be able to make HTTP requests to its own front end. If loopback requests are blocked, most markup-based checks cannot run. See Troubleshooting.

Severity levels

Every category starts at 100 points. Each finding subtracts the number of points shown below, so a lower score means more was found. Nothing ever adds points - a clean category simply keeps its 100.

Filtering and searching

The severity tiles on the dashboard double as filters - click Critical to show only critical findings. You can also search the whole report by keyword. Each category panel carries its own score and grade, and links to the findings inside it.

Expanding a finding

Every finding opens to show an explanation of what was detected, why it matters, and the recommended remedy. Where a one-click fix exists, it appears at the bottom of the finding with a note stating whether it is a reversible switch or a one-off action.

Each category starts at 100 and loses the points listed above for every finding, and can never fall below 0. The overall score is the plain average of the category scores that ran.

Grades

A worked example

A category with one critical and two notice findings scores 100 − 22 − 3 − 3 = 72.

The number is a progress tracker, not a verdict. A site scoring 78 with no critical findings is in better shape than one scoring 85 with an exposed checkout. Read the findings, not just the total.

There are 28 reversible switches and 13 one-off actions. You can apply them from the finding in the report, or from the One-Click Fixes screen where they are grouped by category.

Reversible switches

These do not edit your theme, your plugins or wp-config.php. The plugin stores which switches are on and reapplies the behaviour through WordPress hooks on every request. Turn one off and the behaviour disappears completely - nothing is left behind. Deactivating the plugin has the same effect.

One-off actions

These change data or settings directly: deleting revisions, purging transients, updating a WordPress option, removing readme.html. Actions labelled “Review before applying” delete data or alter how the site behaves for visitors. Read the description, confirm you have a backup, then run it.

Batching

Fixes that delete comments or write alt text work in batches so they cannot exhaust the request on a large site. The result message tells you when more remain - run the fix again to continue.

After applying a fix

Load your homepage, a post and - on a store - a product, the cart and the checkout, in a logged-out browser window. Then re-run the audit; the cached copy of your markup is discarded automatically whenever a fix is applied, so the next run measures the real result.

See the complete fix reference →

Under Settings you can have the full audit run daily, weekly or monthly, and email a summary each time it finishes. Scheduling is off by default.

Scheduled runs use WP-Cron, which is triggered by site traffic rather than by a real clock. A site with few visitors may see the audit fire hours late. If timing matters, disable WP_CRON in wp-config.php and call wp-cron.php from a server cron job instead:

/* wp-config.php */
define( 'DISABLE_WP_CRON', true );

# crontab -e  - every 15 minutes
*/15 * * * * curl -s https://example.com/wp-cron.php?doing_wp_cron >/dev/null 2>&1

A scheduled audit never applies a fix. Every change to your site is something you press a button for.

• The audit runs entirely on your own server. It requests your own URLs and reads your own database.
• The single exception is the PageSpeed Insights lookup, which is off by default. Enabling it sends your homepage URL - and nothing else - to Google.
• No telemetry, no analytics, no phone-home, no account required.
• Reports are stored in the wp_options table as a single non-autoloaded row, so they cost nothing on a normal page load.
• Every screen and every AJAX action requires the manage_options capability and a valid nonce.

External service: Google PageSpeed Insights

Used only when you tick “Fetch real-user Core Web Vitals from Google” under Settings. It retrieves Chrome UX Report field data - real-user Largest Contentful Paint, Interaction to Next Paint and Cumulative Layout Shift - for your site's origin.

No other external service is contacted. The plugin makes loopback HTTP requests to your own site's front end in order to read its rendered HTML; those requests never leave your server's network.

Filters

Adding your own check

add_filter( 'kwaudit_audit_categories', function ( $categories ) {
	$categories['my_area'] = 'My_Custom_Check';
	return $categories;
} );

class My_Custom_Check extends KWAUDIT_Check {
	public function get_id()    { return 'my_area'; }
	public function get_label() { return 'My Area'; }
	public function get_icon()  { return 'dashicons-admin-generic'; }

	protected function evaluate() {
		$this->add(
			'my_check',
			'Something needs attention',
			KWAUDIT_Issue::SEVERITY_WARNING,
			array(
				'description'    => 'What is wrong and why it matters.',
				'recommendation' => 'What to do about it.',
			)
		);
	}
}

Inside evaluate(), $this->context is a KWAUDIT_Site_Context holding the already-fetched markup. Use $this->context->count( $xpath ), ->first_attr( $xpath, $attribute ) and ->header( $name ) rather than issuing your own HTTP requests.

Running an audit in code

$runner = new KWAUDIT_Audit_Runner();
$report = $runner->run_all();             // Everything.
$seo    = $runner->run_category( 'seo' ); // One category.

$stored = KWAUDIT_Report::get();
$totals = KWAUDIT_Report::totals();

Changing who may run audits

add_filter( 'kwaudit_required_capability', function () {
	return 'edit_theme_options';
} );

Keeping WooCommerce assets on a specific page

add_filter( 'kwaudit_needs_woocommerce_assets', function ( $needed ) {
	return is_page( 'gift-finder' ) ? true : $needed;
} );

Nothing is deleted unless you opt in. Tick Delete all plugin data on uninstall under Settings before deleting the plugin if you want its options, reports and fix history removed.

• Deactivating stops every reversible switch immediately and clears the scheduled audit. Your data is kept.
• Deleting removes the plugin files. Stored data is removed only if you ticked the uninstall option first.
• One-off actions are not reversed by either. Restore from a backup if you need to undo one.