csgaku

CSGaku Site State Check is a lightweight plugin for reviewing basic WordPress site status from the admin area.
The plugin is designed for administrators and developers who want to check important maintenance and security-related signals on demand. It does not automatically repair, delete, or change site settings. It presents the current state so the site administrator can decide what to review next.
CSGaku Site State Check does not use external API communication or external vulnerability database lookups for its checks. It uses information available within the WordPress site and server environment.
The plugin can run on PHP 7.4 or later, but PHP 8.2 or later is recommended.
Design principles:
<ul>
<li>No external API or external service communication for normal checks</li>
<li>No automatic repair</li>
<li>No automatic deletion</li>
<li>No automatic setting changes</li>
<li>No direct display of secret values or full file contents</li>
<li>Results organized by status and severity</li>
<li>Latest result, simple local history, and CSV export support</li>
</ul>
Main checks include:
<ul>
<li>PHP version</li>
<li>WordPress version</li>
<li>Site URL and home URL</li>
<li>SSL status</li>
<li>Sitemap</li>
<li>Debug settings</li>
<li>wp-config.php</li>
<li>.htaccess</li>
<li>index.php</li>
<li>wp-admin, wp-content, and wp-includes</li>
<li>Public access protection for debug.log</li>
<li>PHP execution prevention setting in uploads</li>
<li>wp-config.php structure and location</li>
<li>SALT constants</li>
<li>Administrator user count</li>
<li>Presence of the admin username</li>
<li>Older administrator accounts</li>
<li>Application passwords</li>
<li>Search engine visibility setting</li>
<li>XML-RPC status</li>
<li>Core, plugin, and theme update status</li>
<li>Inactive plugins</li>
<li>Unused theme candidates</li>
<li>444 and 555 permissions under wp-content</li>
<li>uploads/YYYY/.htaccess and uploads/YYYY/MM/.htaccess</li>
</ul>
About obfuscation-related checks:
CSGaku Site State Check can review index.php for patterns that are sometimes associated with obfuscation, such as base64, eval, gzinflate, long Base64-like strings, hex escapes, and chr concatenation. If such patterns are found, they are shown as items to review. They are not treated as final proof of malicious code by themselves.
About permissions:
The plugin checks 444 and 555 permissions under wp-content. These permissions may be intentional in some environments, but they can also affect updates, deletion, and maintenance work. When such items are found under themes, the plugin can note that they may be intentional depending on the environment.
About uploads security:
The plugin checks whether uploads/.htaccess contains PHP execution prevention rules, and it also checks for .htaccess files under uploads year/month folders. If relevant .htaccess files are found in those locations, they are shown for review without displaying file contents.
About CSV export:
The latest result can be exported as CSV with a UTF-8 BOM for compatibility with spreadsheet applications. To reduce CSV formula injection risk, values starting with dangerous leading characters are escaped before export.
Important limitations:
<ul>
<li>This plugin is a confirmation tool.</li>
<li>It does not provide malware cleanup.</li>
<li>It does not provide automatic remediation.</li>
<li>It does not provide complete vulnerability assessment.</li>
<li>It does not guarantee detection of all issues.</li>
<li>Final review and response should be handled by the site administrator.</li>
</ul>

CSGaku Site State Check

Checks key WordPress site status items from the admin area without external API communication or automatic changes.

npc01

NPC Maintenance Inspector performs 9-point health diagnostics on your WordPress site directly from the admin dashboard:
<ol>
<li>WordPress core updates — Detect missing core updates.</li>
<li>Plugin updates — List plugins with available updates.</li>
<li>Site Health issues — Extract critical issues from WP standard Site Health API.</li>
<li>PHP version — Warn on end-of-life PHP versions.</li>
<li>Error log analysis — Summarize debug.log entries and save a one-click backup to uploads/ for safe review.</li>
<li>File integrity — Detect suspicious code patterns in core files (eval / base64_decode / etc.) by comparing checksums against the WordPress.org Checksum API.</li>
<li>Suspicious files — Find unexpected PHP files in wp-content/uploads/, with built-in whitelist for known legitimate plugin files (Ajax Load More templates, WP STAGING index.php, AIOS firewall rules, etc.).</li>
<li>SSL certificate — Check days until expiration (warn under 30 days, critical at 0).</li>
<li>File permissions — Check critical files like wp-config.php, .htaccess, wp-content/.</li>
</ol>
Operational features:
<ul>
<li>History — Keep the last 10 diagnoses as a custom post type.</li>
<li>Scheduled auto-check — Run daily, weekly, or monthly via WP Cron.</li>
<li>Email notifications — Send alerts only on critical issues.</li>
<li>One-click debug.log clear — Truncate the log while preserving file permissions.</li>
<li>Optional AI report — Generate maintenance suggestions via Anthropic Claude API. Disabled by default; opt-in via a wp-config.php constant.</li>
</ul>
The plugin is locked to the user who activated it and to the original site URL, so it stays inert after backup restores to a different domain.
<h3>External services</h3>
This plugin can optionally connect to the Anthropic Claude API (<code>https://api.anthropic.com/v1/messages</code>) to generate AI-powered maintenance reports. This is the only external service the plugin ever contacts.
When is data sent?
<ul>
<li>When you manually click the “Generate AI Report” button in the admin.</li>
<li>When an automatic scheduled diagnosis detects a critical issue and notifications are enabled. In that case the AI report is generated once per critical run and attached to the notification email.</li>
</ul>
What data is sent?
<ul>
<li>The diagnosis result text only:
<ul>
<li>Site URL, site name, WordPress version, theme name</li>
<li>Counts of plugin updates / Site Health issues / error-log entries</li>
<li>PHP version, memory limit, max upload size</li>
<li>SSL expiration date and days remaining</li>
<li>File-permission status of critical files</li>
<li>Suspicious code patterns detected (function names like <code>eval</code>, <code>base64_decode</code>)</li>
</ul>
</li>
<li>No login data, no post content, no personal data of site visitors.</li>
</ul>
Is the data sent unconditionally?
No. The AI feature is completely disabled unless you define <code>NPCMI_API_KEY</code> in <code>wp-config.php</code>. Without that constant, no external connection to Anthropic is ever made.
Anthropic’s terms and privacy policy:
<ul>
<li>Consumer Terms of Service: https://www.anthropic.com/legal/consumer-terms</li>
<li>Privacy Policy: https://www.anthropic.com/legal/privacy</li>
<li>Commercial Terms of Service (if you use a paid API plan): https://www.anthropic.com/legal/commercial-terms</li>
</ul>
By enabling the AI report feature (i.e. by defining <code>NPCMI_API_KEY</code>), you agree to Anthropic’s applicable terms.

NPC Maintenance Inspector

WordPress maintenance health-check tool with 9-point diagnostics, history tracking, and optional AI-powered reports.

CSGaku Site State Check vs NPC Maintenance Inspector