csgaku

CSGaku Site State Check is a lightweight plugin for reviewing basic WordPress site status from the admin area.
The plugin is designed for administrators and developers who want to check important maintenance and security-related signals on demand. It does not automatically repair, delete, or change site settings. It presents the current state so the site administrator can decide what to review next.
CSGaku Site State Check does not use external API communication or external vulnerability database lookups for its checks. It uses information available within the WordPress site and server environment.
The plugin can run on PHP 7.4 or later, but PHP 8.2 or later is recommended.
Design principles:
<ul>
<li>No external API or external service communication for normal checks</li>
<li>No automatic repair</li>
<li>No automatic deletion</li>
<li>No automatic setting changes</li>
<li>No direct display of secret values or full file contents</li>
<li>Results organized by status and severity</li>
<li>Latest result, simple local history, and CSV export support</li>
</ul>
Main checks include:
<ul>
<li>PHP version</li>
<li>WordPress version</li>
<li>Site URL and home URL</li>
<li>SSL status</li>
<li>Sitemap</li>
<li>Debug settings</li>
<li>wp-config.php</li>
<li>.htaccess</li>
<li>index.php</li>
<li>wp-admin, wp-content, and wp-includes</li>
<li>Public access protection for debug.log</li>
<li>PHP execution prevention setting in uploads</li>
<li>wp-config.php structure and location</li>
<li>SALT constants</li>
<li>Administrator user count</li>
<li>Presence of the admin username</li>
<li>Older administrator accounts</li>
<li>Application passwords</li>
<li>Search engine visibility setting</li>
<li>XML-RPC status</li>
<li>Core, plugin, and theme update status</li>
<li>Inactive plugins</li>
<li>Unused theme candidates</li>
<li>444 and 555 permissions under wp-content</li>
<li>uploads/YYYY/.htaccess and uploads/YYYY/MM/.htaccess</li>
</ul>
About obfuscation-related checks:
CSGaku Site State Check can review index.php for patterns that are sometimes associated with obfuscation, such as base64, eval, gzinflate, long Base64-like strings, hex escapes, and chr concatenation. If such patterns are found, they are shown as items to review. They are not treated as final proof of malicious code by themselves.
About permissions:
The plugin checks 444 and 555 permissions under wp-content. These permissions may be intentional in some environments, but they can also affect updates, deletion, and maintenance work. When such items are found under themes, the plugin can note that they may be intentional depending on the environment.
About uploads security:
The plugin checks whether uploads/.htaccess contains PHP execution prevention rules, and it also checks for .htaccess files under uploads year/month folders. If relevant .htaccess files are found in those locations, they are shown for review without displaying file contents.
About CSV export:
The latest result can be exported as CSV with a UTF-8 BOM for compatibility with spreadsheet applications. To reduce CSV formula injection risk, values starting with dangerous leading characters are escaped before export.
Important limitations:
<ul>
<li>This plugin is a confirmation tool.</li>
<li>It does not provide malware cleanup.</li>
<li>It does not provide automatic remediation.</li>
<li>It does not provide complete vulnerability assessment.</li>
<li>It does not guarantee detection of all issues.</li>
<li>Final review and response should be handled by the site administrator.</li>
</ul>

CSGaku Site State Check

Checks key WordPress site status items from the admin area without external API communication or automatic changes.

erravi

Quantely Activity is a lightweight, first-party plugin for WordPress that records pageviews and events.
Quantely Activity is built to capture activity reliably under imperfect conditions through server-side recording and optional client-side signals, while supporting filtering for bots, unwanted pages, IP sources and selectable WordPress logged-in roles.
Quantely Activity can be used for:
<ul>
<li>Monitoring site behavior</li>
<li>Reviewing traffic patterns</li>
<li>Security and bot analysis</li>
<li>Feeding downstream analytics layers</li>
</ul>
Quantely Activity is turn-key: install it, and pageviews and events should begin appearing shortly after. Raw activity data is retained for a configurable short period, helping keep the plugin lightweight and privacy-conscious.
<h3>What Quantely Activity is</h3>
Quantely Activity is a capture and monitoring layer. It is designed to record activity on your site in a structured and reliable way, with a strong focus on signal capture and data integrity.
Unlike many analytics tools, it does not focus on marketing analytics, attribution modelling, or behavioral profiling. It also does not rely solely on browser JavaScript. A server-side baseline helps ensure pageviews are still captured when scripts or beacons fail.
<h3>Hybrid capture engine</h3>
The plugin combines server-side pageview capture with optional browser-side signals.
Typical flow:
Browser request 
↓ 
Server pageview baseline 
↓ 
Browser attach (Beacon) 
– engagement pings 
– interaction events 
↓ 
Correlation via pageview identifiers 
↓ 
Bot classification and exclusions 
↓ 
Deduplication and storage
This architecture helps keep capture reliable under real-world conditions where browser-only tracking can miss signals.
<h3>Event correlation and deduplication</h3>
Quantely Activity links browser-side signals back to the pageview where they occurred.
Engagement pings, clicks, form submissions, and similar events can be correlated to their originating pageview. Built-in deduplication helps avoid duplicate records when similar signals are captured from both browser and server-side sources.
This keeps the activity stream more accurate and easier to interpret.
<h3>Fully on-site</h3>
All captured activity is stored in your own WordPress database.
Quantely Activity does not send captured activity data to external services. IP addresses are never stored in plain form, and the plugin does not perform cross-site tracking.
<h3>Privacy-aware design</h3>
The plugin is designed with privacy-conscious principles in mind:
<ul>
<li>No plain IP addresses stored</li>
<li>Short configurable retention window</li>
<li>Optional honoring of GPC / DNT signals</li>
<li>No external tracking services</li>
<li>Data remains on your own site</li>
</ul>
This gives site owners visibility into activity while keeping capture local and controlled.
<h3>Hooks</h3>
Quantely Activity exposes a small developer API for integrations and downstream processing.
<ul>
<li><code>qmon_hit_before_insert</code> — Filter a normalized hit array before it is stored.</li>
<li><code>qmon_hit_recorded</code> — Action fired after a hit has been stored. This is the main integration point for forwarding or persisting captured records.</li>
<li><code>qmon_event_normalize</code> — Filter a normalized event payload before it is finalized.</li>
<li><code>qmon_event_db_dedupe_window_sec</code> — Filter the database deduplication window for events.</li>
<li><code>qmon_bot_verdict</code> — Filter the bot-classification verdict before it is finalized.</li>
</ul>

Quantely Activity

Quantely Activity is a lightweight, first-party plugin for WordPress that records pageviews and events.

CSGaku Site State Check vs Quantely Activity