=== Clearyvo Plugin Health ===
Contributors: kishollo001
Tags: security, vulnerability, plugins, outdated plugins, abandoned plugins
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.5.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Find outdated, abandoned, closed and vulnerable plugins, and tidy up Hello Dolly, sample content and unused default themes.

== Description ==

Most hacked WordPress sites are hacked through a plugin. Plugin Health shows which of yours need attention, most urgent first.

**For every installed plugin**

* Known vulnerabilities in the installed version, with severity, the version that fixes it and a link to the advisory (Wordfence Intelligence data)
* Available updates
* Closed on WordPress.org, including the closure date and reason (for example "Security Issue")
* Possibly abandoned: no release for 2 years (adjustable)
* Not tested with the last three major WordPress versions
* Latest version needs a newer PHP than your server has
* Premium or custom plugins that WordPress.org cannot track
* Inactive plugins that are still on the server
* Whether auto-updates are on

**Themes and core**: known vulnerabilities in installed themes and in your WordPress version.

**Fresh-install leftovers**: "Can I delete Hello Dolly?" Yes, and Plugin Health tells you why for each item before one Tidy up button removes the ticked ones:

* The "Hello world!" post, the sample comment and the "Sample Page", only while nobody has edited them (they go to the trash, so you can restore them)
* Hello Dolly, and Akismet when it is inactive and has no API key
* Default themes (Twenty Twenty-…) that are not in use; the newest one is kept as the fallback theme WordPress needs if the active theme breaks
* Other inactive themes are listed, not ticked
* Settings still at their defaults are shown with a link, never changed: the "Just another WordPress site" tagline, the "Uncategorized" category, a user named "admin", plain ?p=123 links

Inactive plugins get a Delete link that opens WordPress's own confirmation screen.

Plugin Health never updates or deactivates anything, and it deletes only what you confirm.

Part of the Clearyvo plugin family: focused plugins that each check one part of your site and share one "Site Toolkit" menu with a Site health score. The Site Toolkit plugin has every checker in one plugin, switched on one by one; when it is installed, this plugin's settings and results are shared with it. More at wp-sitechecker.com.

== External services ==

* **WordPress.org Plugin Directory API** (`https://api.wordpress.org/plugins/info/1.2/`): when you click "Check plugins", the slug (folder name) of each installed plugin is sent to read its public directory information. Plugins with a custom Update URI are skipped. [Terms](https://wordpress.org/about/privacy/)
* **Wordfence Intelligence Vulnerability Data Feed** (`https://www.wordfence.com/api/intelligence/v3/vulnerabilities/scanner`): only after you enter your own free API key. The complete public feed is downloaded (at most every 12 hours, daily by WP-Cron if enabled) and matched on your server; no information about your site or plugins is sent, only the API key for authentication. Use is subject to the [Wordfence Intelligence Terms and Conditions](https://www.wordfence.com/wti-community-edition-terms-and-conditions/) and [Privacy Policy](https://www.wordfence.com/privacy-policy/).

Update information comes from WordPress' own update check.

Vulnerability data provided by Wordfence Intelligence. Copyright Defiant Inc.

== Installation ==

1. Upload the plugin and activate it.
2. Open Site Toolkit → Plugin Health and click "Check plugins".
3. For vulnerability checks, create a free API key on wordfence.com (Account → Integrations), paste it in Settings and click "Update now".

== Frequently Asked Questions ==

= What is the /wp-json/clearyvo/v1/app/ address? =
A read-only REST route for the Clearyvo Site Inspector Mac app. It shows the Site health score of the Clearyvo plugins to a signed-in administrator (for example with a WordPress Application Password) and changes nothing. It sends nothing anywhere: the app asks, the site answers.

= Why do I need a Wordfence key? =

Wordfence offers its vulnerability database for free, also commercially, but since 2026 only with a personal API key. The key stays on your site and is sent only to wordfence.com.

= The feed download failed with "usage limit" =

Wordfence limits how often a key may download the feed. Wait until the next day; the plugin never downloads more than every 12 hours.

= A plugin I just installed shows no vulnerability data =

The feed is matched against the plugins installed at download time. The page shows which plugins are not covered yet; they are included in the next update.

== Free and Pro ==
* Free: everything on this page.
* Clearyvo Pro adds: an email when a new vulnerability affects an installed plugin or theme, or a plugin is closed on WordPress.org.

== Changelog ==
= 0.5.4 =
* Shared Clearyvo framework 2.3.1: the SEO checker is listed as Clearyvo SEO (formerly Image Alt & SEO) everywhere, whichever Clearyvo plugin loads the framework.

= 0.5.3 =
* New icons: one design for the whole Clearyvo family, with a colour per group of checkers.

= 0.5.2 =
* The other checkers in the shared menu have their new names (SSL Checker, Security Checker, Indexing Checker and the rest).

= 0.5.1 =
* The plugin links point to wp-sitechecker.com again, until the site has moved to clearyvo.com.

= 0.5.0 =
* New: read-only connection for the Clearyvo Site Inspector Mac app (Site health as data, for administrators with an Application Password).

= 0.4.1 =
* Links to the new home of the Clearyvo WordPress plugins: clearyvo.com/wordpress.

= 0.4.0 =
* First release under the Clearyvo name (folder and text domain: clearyvo-plugin-health). Settings and results of the earlier versions are kept; activating this plugin switches the earlier copy off.
