csgaku

<p>CSGaku Site State Check is a lightweight plugin for reviewing basic WordPress site status from the admin area.</p>
<p>The plugin is designed for administrators and developers who want to check important maintenance and security-related signals on demand. It does not automatically repair, delete, or change site settings. It presents the current state so the site administrator can decide what to review next.</p>
<p>CSGaku Site State Check does not use external API communication or external vulnerability database lookups for its checks. It uses information available within the WordPress site and server environment.</p>
<p>The plugin can run on PHP 7.4 or later, but PHP 8.2 or later is recommended.</p>
<p>Design principles:</p>
<ul>
<li>No external API or external service communication for normal checks</li>
<li>No automatic repair</li>
<li>No automatic deletion</li>
<li>No automatic setting changes</li>
<li>No direct display of secret values or full file contents</li>
<li>Results organized by status and severity</li>
<li>Latest result, simple local history, and CSV export support</li>
</ul>
<p>Main checks include:</p>
<ul>
<li>PHP version</li>
<li>WordPress version</li>
<li>Site URL and home URL</li>
<li>SSL status</li>
<li>Sitemap</li>
<li>Debug settings</li>
<li>wp-config.php</li>
<li>.htaccess</li>
<li>index.php</li>
<li>wp-admin, wp-content, and wp-includes</li>
<li>Public access protection for debug.log</li>
<li>PHP execution prevention setting in uploads</li>
<li>wp-config.php structure and location</li>
<li>SALT constants</li>
<li>Administrator user count</li>
<li>Presence of the admin username</li>
<li>Older administrator accounts</li>
<li>Application passwords</li>
<li>Search engine visibility setting</li>
<li>XML-RPC status</li>
<li>Core, plugin, and theme update status</li>
<li>Inactive plugins</li>
<li>Unused theme candidates</li>
<li>444 and 555 permissions under wp-content</li>
<li>uploads/YYYY/.htaccess and uploads/YYYY/MM/.htaccess</li>
</ul>
<p>About obfuscation-related checks:</p>
<p>CSGaku Site State Check can review index.php for patterns that are sometimes associated with obfuscation, such as base64, eval, gzinflate, long Base64-like strings, hex escapes, and chr concatenation. If such patterns are found, they are shown as items to review. They are not treated as final proof of malicious code by themselves.</p>
<p>About permissions:</p>
<p>The plugin checks 444 and 555 permissions under wp-content. These permissions may be intentional in some environments, but they can also affect updates, deletion, and maintenance work. When such items are found under themes, the plugin can note that they may be intentional depending on the environment.</p>
<p>About uploads security:</p>
<p>The plugin checks whether uploads/.htaccess contains PHP execution prevention rules, and it also checks for .htaccess files under uploads year/month folders. If relevant .htaccess files are found in those locations, they are shown for review without displaying file contents.</p>
<p>About CSV export:</p>
<p>The latest result can be exported as CSV with a UTF-8 BOM for compatibility with spreadsheet applications. To reduce CSV formula injection risk, values starting with dangerous leading characters are escaped before export.</p>
<p>Important limitations:</p>
<ul>
<li>This plugin is a confirmation tool.</li>
<li>It does not provide malware cleanup.</li>
<li>It does not provide automatic remediation.</li>
<li>It does not provide complete vulnerability assessment.</li>
<li>It does not guarantee detection of all issues.</li>
<li>Final review and response should be handled by the site administrator.</li>
</ul>


CSGaku Site State Check

Checks key WordPress site status items from the admin area without external API communication or automatic changes.

Alan Fuller

<p>Fullworks Support Diagnostics makes it easier for plugin developers to troubleshoot issues by automatically collecting diagnostic information and providing powerful debugging tools. It discovers installed plugins and provides a framework for plugin-specific diagnostic data collection.</p>
<p>This plugin should only be activated when instructed by plugin support personnel for diagnostic purposes.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Automatic plugin discovery</strong> – Detects compatible plugins with support-config.json files</li>
<li><strong>System information collection</strong> – Gathers essential WordPress environment data</li>
<li><strong>wp-config.php debug management</strong> – Safely modify debug constants with automatic backups</li>
<li><strong>Shortcode scanning</strong> – Identifies shortcodes used across your site</li>
<li><strong>Freemius integration</strong> – Collects license status and Freemius state for premium plugins</li>
<li><strong>REST API endpoints</strong> – Allows secure remote diagnostics with temporary access links</li>
<li><strong>Sensitive data protection</strong> – Masks API keys and other confidential information</li>
<li><strong>Debug log monitoring</strong> – Checks and displays the most recent log entries</li>
</ul>
<h4>Debug Management</h4>
<p>The plugin can safely manage debug constants in wp-config.php:</p>
<ul>
<li>Enable/disable WordPress debugging with a single click</li>
<li>Automatically creates backups of wp-config.php before any modifications</li>
<li>Clearly marks all changes with comment blocks for easy identification</li>
<li>Safely removes all modifications when the feature is disabled</li>
<li>Monitors debug log files for recent entries</li>
</ul>
<h4>Security Considerations</h4>
<ul>
<li>All wp-config.php modifications require explicit admin confirmation</li>
<li>Access keys can be regenerated at any time</li>
<li>Temporary access links expire after 24 hours</li>
<li>API keys and sensitive data are masked in diagnostic reports</li>
<li>REST API endpoint can be disabled if not needed</li>
</ul>
<h3>Usage Instructions</h3>
<h4>For Site Owners</h4>
<ol>
<li><strong>Only install when directed by support personnel</strong></li>
<li>Go to Tools <span aria-hidden="true" class="wp-exclude-emoji">→</span> Plugin Support Diagnostics in your WordPress admin</li>
<li>If instructed, enable debug management and select appropriate debug constants</li>
<li>Click “Generate Diagnostic Data”</li>
<li>Share the diagnostic information with support using one of these methods:
<ul>
<li>Copy to clipboard</li>
<li>Download as JSON</li>
<li>Use the temporary direct access link (valid for 24 hours)</li>
</ul>
</li>
<li>When troubleshooting is complete, disable any debug options and consider deactivating the plugin</li>
</ol>
<h4>For Plugin Developers</h4>
<p>To make your plugin compatible with Support Diagnostics, create a <code>support-config.json</code> file in your plugin’s root directory. See the example-support-config.json file included in the plugin for reference.</p>


Fullworks Support Diagnostics

A diagnostic tool that helps plugin developers provide better support by collecting relevant system information and managing debug constants.

CSGaku Site State Check vs Fullworks Support Diagnostics