=== Clearyvo Site Toolkit ===
Contributors: kishollo001
Tags: site health, security, performance, seo, cleanup
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.12.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

22 site checks in one plugin: images, SEO, links, security, backups, speed, privacy, database and more. Report first, switch on only what you need.

== Description ==

Site Toolkit brings 22 focused checkers together under one menu and one Site health score. Each checker is a module: switch it on and it appears in the Site Toolkit menu; switch it off and its code is not loaded at all. Every checker shows a report first and changes only what you choose.

**Site health**

One dial combines the score of every checker that has run, with the headline of each one, where to start, and how each score is calculated.

**Checkers, by group**

Media

* **Media Cleanup**: exact copies, old resized versions, verified look-alikes, backup folders and full-size originals, moved to a restorable quarantine; heavy and oversized images (above 300 KB, larger than 2560 px, PNG photos).
* **PDF Cleanup**: every PDF, where it is used, exact duplicates and files nobody links to, with a cleanup that can be undone for 30 days.
* **Video Checker**: YouTube, Vimeo and self-hosted videos that were removed, made private or cannot be embedded; pages with many players.

Speed

* **Speed Audit**: server build time per page with and without cache, JS/CSS weight per plugin, an optional plugin load-time profiler, Core Web Vitals.
* **Font Checker**: fonts the pages download, their weight and formats, font-display and preloading, fonts from Google or a CDN.
* **Admin Speed**: load time of key admin screens, plugins that load scripts everywhere, dashboard widgets, the Heartbeat API.

Security and backup

* **Plugin Health**: outdated, abandoned, closed and known-vulnerable plugins, themes and core.
* **Security Checker**: risky accounts and settings, the file editor, visible PHP errors, exposed files and folders, security headers.
* **SSL Checker**: certificate expiry and trust, HTTPS redirects, mixed content.
* **Site Backup**: backups in small, resumable steps with a size report and a standalone restorer.

SEO and content

* **Clearyvo SEO**: complete SEO without keyword stuffing. Titles and meta descriptions, canonical and robots, social tags, schema, XML sitemap, redirects and 404 log, one-click import from Yoast SEO and Rank Math, a live SEO score in the block editor, and a site audit: image ALT texts with drafts to approve, headings, focus keywords, titles and descriptions, pages nobody links to.
* **Broken Links**: broken links, redirects and missing images on every page, menus and footers included, fixed where they are written.
* **Indexing Checker**: the sitemap against the real pages, robots.txt, stray noindex.
* **Schema Checker**: structured data with missing required fields, wrong types and broken JSON.
* **Content Checker**: thin, outdated and near-duplicate content, old drafts, and what removed plugins left: shortcodes, unused terms, orphaned custom fields.
* **Translation Checker**: missing and outdated translations (WPML, Polylang), plugins without your language.

Cleanup

* **Database Cleanup**: leftovers of removed plugins, autoload bloat, orphaned data, revisions and transients, every table with its owner.
* **Disk Space**: what takes up the hosting space: folders, logs, forgotten archives and thumbnails. Read-only.

Server

* **Hosting Checker**: PHP version and limits, extensions, OPcache and object cache, database server, disk space, with a ready message for your host.
* **Error Log**: PHP errors grouped and explained in plain words, with the plugin behind each one.
* **Cron Jobs**: overdue, duplicated and orphaned WP-Cron events.

Privacy

* **Privacy Audit**: third parties the pages contact before consent, the cookies the site sets, consent tools and Google Consent Mode, the privacy policy page, and quick fixes.

Each finding has one home: broken links are Broken Links's, autoload is Database Cleanup's, the server set-up is Hosting Checker's, HTTPS is SSL Checker's, privacy is Privacy Audit's. Other checkers point there instead of repeating it.

**Free and Pro**

Every checker is free. Clearyvo Pro is one add-on for the Pro features of every checker:

* Media Cleanup: previews and picture families, the KEEP suggestion, bulk removal, WebP and AVIF copies, JPEG/PNG compression, automatic and background optimisation, reports.
* Clearyvo SEO: AI ALT texts, internal link ideas, structured data for your business, Search Console import, image loading fixes, scheduled audits and a white-label SEO report.
* Plugin Health, SSL Checker, Error Log: email alerts (new vulnerability, closed plugin, certificate expiring within 14 days, new fatal error).
* A printable white-label site report.

**Separate checker plugins**

Media Cleanup, PDF Cleanup, Speed Audit, Plugin Health, Site Backup, Clearyvo SEO, Broken Links, Database Cleanup, Disk Space and Privacy Audit also come as separate plugins. They share their code, settings and results with Site Toolkit: when Site Toolkit runs a checker, its separate plugin stays idle and can be removed. An older separate plugin keeps its checker to itself until you update or deactivate it; Site Toolkit tells you which ones.

== External services ==

Modules connect to outside services only for the features listed here, and only when you use them.

* **WordPress.org Plugin Directory API** (`https://api.wordpress.org/plugins/info/1.2/`), Plugin Health: when you click "Check plugins", the slug of each installed plugin is sent to read its public directory information. [Privacy](https://wordpress.org/about/privacy/)
* **Wordfence Intelligence Vulnerability Data Feed** (`https://www.wordfence.com/api/intelligence/v3/vulnerabilities/scanner`), Plugin Health: only after you enter your own free API key. The public feed is downloaded (at most every 12 hours) and matched on your server; only the API key is sent. [Terms](https://www.wordfence.com/wti-community-edition-terms-and-conditions/) · [Privacy](https://www.wordfence.com/privacy-policy/). Vulnerability data provided by Wordfence Intelligence. Copyright Defiant Inc.
* **Google PageSpeed Insights API** (`https://www.googleapis.com/pagespeedonline/v5/runPagespeed`), Speed Audit: when you click "Web Vitals", the tested page URL, the device type and your optional Google API key are sent. [Terms](https://developers.google.com/terms) · [Privacy](https://policies.google.com/privacy)
* **Chrome UX Report API** (`https://chromeuxreport.googleapis.com/v1/records:queryRecord`), Speed Audit: only with your Google API key and when PageSpeed Insights has no real-user data; the page URL or site origin, the device type and the key are sent. [Terms](https://developers.google.com/terms) · [Privacy](https://policies.google.com/privacy)

* **Links to other sites**, Broken Links: when you run a link scan, your server sends a HEAD request (and, if needed, a short GET request) to each linked address on another site. Only that address is requested; no data about your site or visitors is sent. Addresses that point into a private network are not requested.
* **YouTube and Vimeo oEmbed** (`https://www.youtube.com/oembed`, `https://vimeo.com/api/oembed.json`), Video Checker: when you click "Check videos", the address of each video found in your content is sent to check whether it still exists. [YouTube Terms](https://www.youtube.com/t/terms) · [Google Privacy](https://policies.google.com/privacy) · [Vimeo Terms](https://vimeo.com/terms) · [Vimeo Privacy](https://vimeo.com/privacy)

Security Checker, SSL Checker, Indexing Checker, Schema Checker, Font Checker, Privacy Audit, Translation Checker, Content Checker and Speed Audit also request your own site anonymously from your server (like a visitor would) to see what the public sees. The site audit of Clearyvo SEO and Broken Links load your pages in your own browser.

Admin Speed loads a few admin screens of your own site from your server, using your own login, to time them. No visitor data is sent anywhere.

== Installation ==

1. Upload the plugin and activate it.
2. Open Site Toolkit → Site health. All checkers are on at first; turn off what you do not need under Site Toolkit → Modules.

== Frequently Asked Questions ==

= What is the /wp-json/clearyvo/v1/app/ address? =
A read-only REST route for the Clearyvo Site Inspector Mac app. It shows the Site health score of the Clearyvo plugins to a signed-in administrator (for example with a WordPress Application Password) and changes nothing. It sends nothing anywhere: the app asks, the site answers.

= Does a switched-off module slow down my site? =

No. Switched-off modules are not loaded at all.

= What happens to a module's data when I switch it off? =

Its settings and results stay, so switching it on again continues where you left off. Server changes a module made (scheduled events, the image rules in uploads/.htaccess) are removed when it is switched off.

= I deleted Site Toolkit. Is everything cleaned up? =

Yes, except data shared with a separate checker plugin that is still installed; that plugin keeps using it.

== Changelog ==
= 0.12.2 =
* Shared Clearyvo framework 2.3.2: SEO and content come first in Site Toolkit, the menu and Site health, then Media and the rest.

= 0.12.1 =
* Shared Clearyvo framework 2.3.1: the SEO checker is listed as Clearyvo SEO (formerly Image Alt & SEO) everywhere, whichever Clearyvo plugin loads the framework.

= 0.12.0 =
* The SEO module is now the complete Clearyvo SEO (it replaces Image Alt & SEO): titles and meta descriptions, canonical and robots, Open Graph and X cards, schema, XML sitemap, breadcrumbs, redirects and 404 log, import from Yoast SEO and Rank Math, the SEO sidebar with a live score in the block editor, and the site audit. Audit results, ALT drafts and decorative-image notes are kept.
* While Yoast SEO, Rank Math or another SEO plugin prints the tags, Clearyvo SEO prints nothing on the front end and offers the import.
* The separate Clearyvo SEO plugin (0.4.7 or newer) shares code, settings and data with Site Toolkit: one copy runs. The old separate Image Alt & SEO Audit plugin is switched off automatically.
* Shared Clearyvo framework 2.3.0.

= 0.11.2 =
* Database: every query goes through $wpdb->prepare(), with %i placeholders for table names.
* Every request handler checks its nonce and the user's permission itself.

= 0.11.1 =
* New icons: one design for the whole Clearyvo family, with a colour per group of checkers.

= 0.11.0 =
* Renamed: the checkers called "… Check" are now "… Checker" (SSL Checker, Security Checker, Indexing Checker, Schema Checker, Content Checker, Translation Checker, Hosting Checker, Font Checker, Video Checker). Settings and results are kept.

= 0.10.1 =
* The plugin links point to wp-sitechecker.com again, until the site has moved to clearyvo.com.

= 0.10.0 =
* New: read-only connection for the Clearyvo Site Inspector Mac app (Site health as data, for administrators with an Application Password).

= 0.9.1 =
* Links to the new home of the Clearyvo WordPress plugins: clearyvo.com/wordpress.

= 0.9.0 =
* First release under the Clearyvo name (folder and text domain: clearyvo-site-toolkit). Settings and results of the earlier versions are kept; activating this plugin switches the earlier copy off.
