Mehedi

<p>BoltAudit gives you a clear, actionable overview of what’s slowing down your WordPress site.<br />
It inspects:<br />
– Active plugins and their actual impact on performance<br />
– Unused, abandoned, or rarely-used plugins<br />
– Heavy scripts, enqueued styles, database queries, and metadata<br />
– Autoloaded options, transients, and custom DB tables<br />
– Post details page with orphaned metadata and orphaned post records<br />
– Server environment and PHP configuration</p>
<p>Whether you’re a developer, site owner, or agency, BoltAudit gives you visibility into bottlenecks with zero guesswork.</p>
<h3>Features</h3>
<ul>
<li>Detect unused, outdated, or abandoned plugins  </li>
<li>Full Plugin Audit section: inactive, outdated, abandoned detection  </li>
<li>Plugin-level metrics: action/filter hook counts, cron job schedules, database query counts  </li>
<li>Breaks down post types, metadata, revisions, and orphaned types  </li>
<li>Analyzes option tables, autoloaded data, transients, and more  </li>
<li>Database snapshot with table sizes, row counts, autoload bloat</li>
<li>Server environment checks: PHP, MySQL, memory limits, upload size</li>
<li>Lightweight, on-demand diagnostics—no front-end performance impact</li>
<li>Responsive, accessible UI with performance optimizations</li>
<li>WooCommerce Overview with product counts and performance insights (HPOS, cart fragments, and more)</li>
</ul>


BoltAudit – Plugin & Performance Analyzer


I recently started using this incredibly useful plugin—it clearly shows which plugins are affecting site performance. Super helpful and easy to understand. I really love it!


Excellent plugin for monitoring asset loading and optimizing performance.


BoltAudit made it so much easier to figure out which plugins were slowing down my site. The interface is simple, and the info it gives is super clear. If you're trying to speed up your WordPress site, this plugin is definitely worth a try!


A Must-Have for WordPress Optimization!


BoltAudit is hands down one of the most useful tools I’ve used for diagnosing performance issues on WordPress sites. The plugin gives a clear breakdown of what’s slowing down your website, from heavy plugins and unused add-ons to autoloaded options and database bloat.



I especially appreciate the detailed plugin-level metrics, database insights, and server environment checks—all presented in a clean and easy-to-understand interface. The fact that it runs diagnostics on-demand without affecting front-end performance is a huge plus.



If you’re serious about keeping your WordPress site fast and healthy, BoltAudit is a must-have. Kudos to the developer for creating such a thoughtful and comprehensive tool!


An Essential Tool for WordPress Performance Optimization!"

I’ve been running BoltAudit on my WordPress site for the past few days, and it has quickly become an indispensable diagnostic tool for plugin and performance health.

If you’re serious about site performance, BoltAudit is a smart and focused auditing tool that provides real insight without slowing things down. I was able to identify a bloated plugin, trim unused metadata, and spot environment misconfigurations - all within a couple of clicks.

It’s lightweight, developer-friendly, and incredibly transparent. Highly recommended for site owners and agencies looking to understand exactly what’s impacting performance—and how to fix it.

A Game Changer Plugin in WordPress Performance Auditing

BoltAudit helps you identify bloated, unused, abandoned, and performance-heavy plugins—plus database bloat, autoloaded options, and runtime impact.

David Perez

Close·technology

Javier Casares

Alex Lion (阿力獅)

Lucas Bonomo

<p>This plugin integrates with the WPVulnerability API to provide real-time vulnerability assessments for your WordPress core, plugins, themes, PHP version, Apache HTTPD, nginx, MariaDB, MySQL, ImageMagick, curl, memcached, Redis, and SQLite.</p>
<p>It delivers detailed reports directly within your WordPress dashboard, helping you stay aware of potential security risks. Configure the plugin to send periodic notifications about your site’s security status, ensuring you remain informed without being overwhelmed. Designed for ease of use, it supports proactive security measures without storing or retrieving any personal data from your site.</p>
<h4>Data reliability</h4>
<p>The information provided by the information database comes from different sources that have been reviewed by third parties. There is no liability of any kind for the information. Act at your own risk.</p>
<h3>Using the plugin</h3>
<h4>WP-CLI</h4>
<p>You can use the following WP-CLI commands to manage and check vulnerabilities:</p>
<ul>
<li>Core: <code>wp wpvulnerability core</code></li>
<li>Plugins: <code>wp wpvulnerability plugins</code></li>
<li>Themes: <code>wp wpvulnerability themes</code></li>
<li>PHP: <code>wp wpvulnerability php</code></li>
<li>Apache HTTPD: <code>wp wpvulnerability apache</code></li>
<li>nginx: <code>wp wpvulnerability nginx</code></li>
<li>MariaDB: <code>wp wpvulnerability mariadb</code></li>
<li>MySQL: <code>wp wpvulnerability mysql</code></li>
<li>ImageMagick: <code>wp wpvulnerability imagemagick</code></li>
<li>curl: <code>wp wpvulnerability curl</code></li>
<li>memcached: <code>wp wpvulnerability memcached</code></li>
<li>Redis: <code>wp wpvulnerability redis</code></li>
<li>SQLite: <code>wp wpvulnerability sqlite</code></li>
</ul>
<p>To configure the plugin you can use:</p>
<ul>
<li>Hide component: <code>wp wpvulnerability config hide <component> [on|off]</code></li>
<li>Notification email: <code>wp wpvulnerability config email <emails></code> (comma separatted)</li>
<li>Notification period: <code>wp wpvulnerability config period <never|daily|weekly></code></li>
<li>Log retention: <code>wp wpvulnerability config log-retention <0|1|7|14|28></code> (in days)</li>
<li>Cache duration: <code>wp wpvulnerability config cache <1|6|12|24></code> (in hours)</li>
</ul>
<p>All commands support the <code>--format</code> option to specify the output format:</p>
<ul>
<li><code>--format=table</code>: Displays the results in a table format (default).</li>
<li><code>--format=json</code>: Displays the results in JSON format.</li>
</ul>
<p>Need help?</p>
<ul>
<li><code>wp wpvulnerability --help</code>: Displays help information for WPVulnerability commands.</li>
<li><code>wp wpvulnerability [command] --help</code>: Displays help information for a WPVulnerability command.</li>
</ul>
<h4>REST API</h4>
<p>The WPVulnerability plugin provides several <strong>REST API endpoints</strong> to fetch vulnerability information for different components of your WordPress site.</p>
<ul>
<li>Core: <code>/wpvulnerability/v1/core</code></li>
<li>Plugins: <code>/wpvulnerability/v1/plugins</code></li>
<li>Themes: <code>/wpvulnerability/v1/themes</code></li>
<li>PHP: <code>/wpvulnerability/v1/php</code></li>
<li>Apache HTTPD: <code>/wpvulnerability/v1/apache</code></li>
<li>nginx: <code>/wpvulnerability/v1/nginx</code></li>
<li>MariaDB: <code>/wpvulnerability/v1/mariadb</code></li>
<li>MySQL: <code>/wpvulnerability/v1/mysql</code></li>
<li>ImageMagick: <code>/wpvulnerability/v1/imagemagick</code></li>
<li>curl: <code>/wpvulnerability/v1/curl</code></li>
<li>memcached: <code>/wpvulnerability/v1/memcached</code></li>
<li>Redis: <code>/wpvulnerability/v1/redis</code></li>
<li>SQLite: <code>/wpvulnerability/v1/sqlite</code></li>
</ul>
<p>The WPVulnerability REST API uses <strong>Application Passwords</strong> for authentication. You need to include a valid Application Password in the Authorization header of your requests.</p>
<p>Example Request with Authentication</p>
<pre><code>curl -X GET https://example.com/wp-json/wpvulnerability/v1/plugins -u username:application_password
</code></pre>
<p>Replace username with your WordPress <code>username</code> and <code>application_password</code> with your <a href="https://make.wordpress.org/core/2020/11/05/application-passwords-integration-guide/" rel="nofollow ugc">Application Password</a>.</p>
<h3>Extra Configurations</h3>
<h4>“From:” mail (since: 3.2.2)</h4>
<p>If, for some reason, you need the emails sent by the plugin to have a From different from the site administrator, you can change it from the <code>wp-config.php</code> by adding a constant:</p>
<pre><code>define( 'WPVULNERABILITY_MAIL', 'sender@example.com' );
</code></pre>
<p>If the constant is active, it will be visible in the configuration screen.</p>
<h4>Force hiding checks (since: 4.1.0)</h4>
<p>If you want to always hide a specific component, you can define a constant in <code>wp-config.php</code>. When set to <code>true</code>, the option will be checked automatically in the settings screen and the related analysis will be skipped.</p>
<p>Example:</p>
<pre><code>define( 'WPVULNERABILITY_HIDE_APACHE', true );
</code></pre>
<p>Available constants: <code>WPVULNERABILITY_HIDE_CORE</code>, <code>WPVULNERABILITY_HIDE_PLUGINS</code>, <code>WPVULNERABILITY_HIDE_THEMES</code>, <code>WPVULNERABILITY_HIDE_PHP</code>, <code>WPVULNERABILITY_HIDE_APACHE</code>, <code>WPVULNERABILITY_HIDE_NGINX</code>, <code>WPVULNERABILITY_HIDE_MARIADB</code>, <code>WPVULNERABILITY_HIDE_MYSQL</code>, <code>WPVULNERABILITY_HIDE_IMAGEMAGICK</code>, <code>WPVULNERABILITY_HIDE_CURL</code>, <code>WPVULNERABILITY_HIDE_MEMCACHED</code>, <code>WPVULNERABILITY_HIDE_REDIS</code>, <code>WPVULNERABILITY_HIDE_SQLITE</code>.</p>
<h4>Cache duration (since: 4.1.0)</h4>
<p>By default, data from the API is cached for 12 hours. To change this, define <code>WPVULNERABILITY_CACHE_HOURS</code> in <code>wp-config.php</code> with one of <code>1</code>, <code>6</code>, <code>12</code> or <code>24</code>. This value overrides the setting screen and WP-CLI command.</p>
<pre><code>define( 'WPVULNERABILITY_CACHE_HOURS', 24 );
</code></pre>
<h4>Log rotation (since: 4.2.0)</h4>
<p>WPVulnerability stores the most recent API responses so you can review recent calls from the new log tab. Define <code>WPVULNERABILITY_LOG_RETENTION_DAYS</code> in <code>wp-config.php</code> to control how many days of entries are preserved. Supported values are <code>0</code>, <code>1</code>, <code>7</code>, <code>14</code> or <code>28</code>; using <code>0</code> disables logging entirely.</p>
<pre><code>define( 'WPVULNERABILITY_LOG_RETENTION_DAYS', 14 );
</code></pre>
<p>When the constant is present its value is enforced in the settings UI and through WP-CLI, ensuring consistent log rotation across environments.</p>
<h4>Security configuration (since: 4.3.0)</h4>
<p>WPVulnerability uses a hybrid detection approach for server software (ImageMagick, Redis, Memcached, SQLite): PHP extensions first (most secure), then shell commands as fallback (most accurate). You can control this behavior using security configuration constants in <code>wp-config.php</code>.</p>
<p><strong>Global disable of shell commands:</strong></p>
<pre><code>define( 'WPVULNERABILITY_DISABLE_SHELL_EXEC', true );
</code></pre>
<p>Completely disables shell command usage. Falls back to PHP extensions only. Use for maximum security when accuracy loss is acceptable.</p>
<p><strong>Security mode (standard/strict/disabled):</strong></p>
<pre><code>define( 'WPVULNERABILITY_SECURITY_MODE', 'strict' );
</code></pre>
<ul>
<li><code>standard</code> – Hybrid detection: PHP extensions first, shell commands fallback (default, best accuracy)</li>
<li><code>strict</code> – PHP extensions only, no shell commands (high security, lower accuracy)</li>
<li><code>disabled</code> – No software detection at all (maximum security)</li>
</ul>
<p><strong>Component whitelist:</strong></p>
<pre><code>define( 'WPVULNERABILITY_SHELL_EXEC_WHITELIST', 'imagemagick,redis' );
</code></pre>
<p>Allows shell commands only for specified components. Available components: <code>imagemagick</code>, <code>redis</code>, <code>memcached</code>, <code>sqlite</code>. Use for granular control.</p>
<p><strong>Examples:</strong></p>
<p>Maximum security (no shell commands):</p>
<pre><code>define( 'WPVULNERABILITY_SECURITY_MODE', 'strict' );
</code></pre>
<p>Only allow ImageMagick shell detection:</p>
<pre><code>define( 'WPVULNERABILITY_SHELL_EXEC_WHITELIST', 'imagemagick' );
</code></pre>
<p>Complete disable:</p>
<pre><code>define( 'WPVULNERABILITY_DISABLE_SHELL_EXEC', true );
</code></pre>
<p>All shell commands are hardcoded and validated – no user input is involved. Commands are logged for security auditing.</p>
<h3>Compatibility</h3>
<ul>
<li>WordPress: 4.7 – 6.9</li>
<li>PHP: 5.6 – 8.5</li>
<li>WP-CLI: 2.3.0 – 2.11.0</li>
</ul>
<h3>Security</h3>
<p>This plugin adheres to the following security measures and review protocols for each version:</p>
<ul>
<li><a href="https://developer.wordpress.org/plugins/" rel="nofollow ugc">WordPress Plugin Handbook</a></li>
<li><a href="https://developer.wordpress.org/plugins/wordpress-org/plugin-security/" rel="nofollow ugc">WordPress Plugin Security</a></li>
<li><a href="https://developer.wordpress.org/apis/security/" rel="nofollow ugc">WordPress APIs Security</a></li>
<li><a href="https://github.com/WordPress/WordPress-Coding-Standards" rel="nofollow ugc">WordPress Coding Standards</a></li>
<li><a href="https://wordpress.org/plugins/plugin-check/" rel="ugc">Plugin Check (PCP)</a></li>
</ul>
<h3>Privacy</h3>
<ul>
<li>This plugin or the WordPress Vulnerability Database API does not collect any information about your site, your identity, the plugins, themes or content the site has.</li>
</ul>
<h3>Vulnerabilities</h3>
<ul>
<li>A security vulnerability was found and fixed in version 4.2.2.1. All previous versions (3.3.0 – 4.2.1) are affected. Please update to version 4.2.2.1 or later.</li>
</ul>
<p>Found a security vulnerability? Please report it to us privately at the <a href="https://github.com/javiercasares/wpvulnerability/security/advisories/new" rel="nofollow ugc">WPVulnerability GitHub repository</a>.</p>
<h3>Contributors</h3>
<p>You can contribute to this plugin at the <a href="https://github.com/javiercasares/wpvulnerability" rel="nofollow ugc">WPVulnerability GitHub repository</a>.</p>


WPVulnerability

Without sending data, as other plugins does, the best way to detect vulnerabilities without privacy concerns.

The best way to detect vulnerabilities, and free!

Fácil de instalar y configurar y de gran utilidad para detectar vulnerabilidades en nuestro WordPress. Totalmente recomendable. 

Imprescindible para toda web

Gracias por el plugin. 

Ya puedo estar informado fácilmente de las vulnerabilidades de mi web.

Lo mejor para estar informado de las vulnerabilidades de tu WordPress

This plugin uses an API to check if the version of your core, themes and/or plugins present on your WordPress installation has any known vulnerability.

It cares about efficiency so it can be always active, it won't have any noticeable affection to the load time of the public website (it only connects to the api when an administrator installs/updates something and also via cron each several hours).

I can recommend to have this plugin active to help you spot possible vulnerabilities when forgot or delayed the update of plugin/theme/core. 

A great aid for detecting vulnerabilities.


Without a doubt, the most important plugin to install on your WordPress instance.


Essential plugin

Get WordPress vulnerability alerts from the WPVulnerability Database API.

BoltAudit – Plugin & Performance Analyzer vs WPVulnerability