Sitelemetry Audit – Security, SEO & AI Readiness Scanner

Description

Sitelemetry Audit connects your site to the hosted Sitelemetry audit service. From Settings > Sitelemetry you run a security scan or a full site audit and read the result inside WordPress: a score and grade, every finding with its severity, location and fix, the checks that passed, a clear list of what was not measured and why, and a ready-made prompt for your AI assistant to fix the findings.

Audit kinds

• Security (included in every plan, including Free): DNS and email DNS, WHOIS/RDAP, TLS, HTTP security headers, HTTPS posture, technology fingerprint and, once the site is verified, exposed files, HTTP methods and API exposure. Paid plans add the WordPress checks, port scans and more modules; these need a verified site.
• Technical SEO, AI visibility (AI readiness), Integrations, Accessibility, Performance and Full (all pillars with one blended score) on paid plans.

What the plugin does

• Results in WordPress: a status banner, the score and grade, the findings with a severity filter and each finding’s evidence, impact and fix.
• Passing checks: the checks that passed, grouped by security module, each with its evidence.
• What was not measured: the checks that did not run, with readable module names and the likely cause when the site’s own answers explain it (a redirect, a rate limit, a server error, no answer in time, ports a firewall silently drops, the per-audit script limit), the pages a crawl found but could not assess (for example because robots.txt disallows them), the metrics that were not measured (such as the Core Web Vitals when PageSpeed Insights returns no data), and the individual checks that ended without a pass or fail result (an error, no result, a manual review, not applicable). Unmeasured checks are never counted as passes.
• Copy AI fix prompt: one click copies a prompt built from the result (the findings with evidence and fixes, and what was not measured) for ChatGPT, Claude or your coding assistant. The prompt is built in wp-admin and only copied to your clipboard; nothing is sent. The assistant is asked to answer in your WordPress admin language.
• Verify this site: some checks run only on sites whose ownership is verified. With one click the plugin gets a verification code from Sitelemetry, publishes the verification file for this site and has Sitelemetry check it, so you need no FTP access; it renews the verification automatically when it expires and tells you exactly what to fix when a check fails (for example a server that blocks /.well-known/ or a redirect between www and non-www). Where one-click verification is not available yet, paste the token from the Sitelemetry app instead; a “Test the file” button checks that the file is reachable. On a multisite network only a network administrator can publish the file.
• Dashboard widget with the last score, the findings by severity, a reminder when the site needs to be verified or its verification renewed, and a link to the results. After a weekly audit that needs verification, a notice on the Dashboard and Plugins screens says so until you dismiss it.
• Settings page with a Sign in or create an account button (the Sitelemetry sign-in page, where new users create an account on a free or paid plan) and a link to the page that shows your API key, your Sitelemetry MCP API key (stored in the WordPress options table, shown masked, removable), the target (defaults to your site address), the audit kind and an optional weekly audit through WP-Cron.
• Plan and usage box with the connected plan and what each paid plan includes, read from the public plan catalogue.

Languages

The plugin’s screens are available in English, Turkish, Spanish, German (informal and formal), French, Portuguese (Brazil), Italian, Japanese and Simplified Chinese. The audit itself is requested in your WordPress admin language when Sitelemetry supports it (English, Turkish, Spanish, German, French, Portuguese, Italian, Japanese, Simplified Chinese), so findings, evidence and fixes arrive in that language too; otherwise in English. Translations from translate.wordpress.org take precedence over the bundled ones, which the plugin uses when no language pack is installed.

Plans and allowance

Sitelemetry has free and paid plans. A Free Sitelemetry account includes the security audit with the public security modules and a monthly number of security scans; the public plan catalogue at sitelemetry.com/api/plans is the source of truth and the plugin reads it for the plan and usage box. Each completed audit uses one unit of the monthly allowance of the connected account; polling a running audit uses nothing more. When the connected account does not include an audit kind or has used its monthly allowance, the audit is not started, no allowance is used and the results page says so.

Ownership

Audit only websites you own or are explicitly authorized to test. Every audit is performed by Sitelemetry against the live target and is recorded on the connected account. Protected checks (for example HTTP methods and exposed files, and on paid plans the WordPress checks) require ownership verification of the host in Sitelemetry; results list the checks that were left unmeasured for this reason.

To verify from WordPress, save your API key and click Verify this site in Settings > Sitelemetry. The plugin asks Sitelemetry for a verification code for this site’s exact host (www and non-www are different hosts), answers /.well-known/sitelemetry-verification.txt on this host with that code and nothing else, tests the file and asks Sitelemetry to check it; the page then says “Verification complete ✓ valid until” and the date, or which problem to fix. A verification lasts 30 days; the plugin renews it automatically in the background (WP-Cron) when it expires or when an audit reports that it must be renewed, never earlier, and shows a notice only if the renewal fails. Remove token stops publishing the file and the automatic renewal until you click Verify this site again or save a token. Where one-click verification is not available yet, the manual steps remain: in the Sitelemetry app open Verified Domains, enter the host and click Start verification, copy the verification code (the token) shown under HTTP verification file, paste it into Verify this site, click Test the file, then click Verify HTTP in the app (renew with Reverify in the app). Without a token the path answers 404. A DNS TXT record or Google Search Console work as alternatives. On a multisite network the web server behind a site’s host serves the whole network, so only a network administrator can publish the file there.

Thin client

The plugin bundles no libraries and runs no scanner on your server. It sends requests to sitelemetry.com with the WordPress HTTP API and renders the response. There is no tracking and no analytics.

External service

This plugin relies on the hosted Sitelemetry service (https://sitelemetry.com) operated by Sitelemetry. It sends requests to the service only when you run an audit or after you have stored an API key, as described in the Privacy section below. The terms of service are published at https://sitelemetry.com/terms and the privacy policy at https://sitelemetry.com/privacy.

Privacy

When you run an audit, the plugin sends to sitelemetry.com the target URL, the audit options you configured (the audit kind) and the report language (derived from your WordPress admin language), authenticated with your API key. Every request also identifies the client in its User-Agent header (sitelemetry-audit-wordpress/ and the plugin version); no WordPress version, site name, user, plugin list or other data from your site or your server is sent. Sitelemetry then audits the live target from its own infrastructure and records the audit on the connected account, as described in the Sitelemetry terms (https://sitelemetry.com/terms) and privacy policy (https://sitelemetry.com/privacy).

Once an API key is stored, the plugin also reads the public plan catalogue at sitelemetry.com/api/plans (no authentication, no data about your site beyond the same plugin User-Agent) to show the plan and usage box.

For ownership verification the plugin uses the verification endpoints of sitelemetry.com (/api/v1/verification/status, /challenge and /verify), authenticated with your API key, and sends only this site’s address (scheme and host). It asks for the status when an administrator opens the settings page (the answer is kept for up to a week, or for an hour while the service offers no verification endpoints), and requests and checks a verification code when you click Verify this site and when the automatic renewal runs in WP-Cron (when the verification expires or an audit reports that it must be renewed). To check the code, Sitelemetry requests /.well-known/sitelemetry-verification.txt from this site.

Before a key is stored, the plugin makes no request to any external server.

The plugin stores in your WordPress database: the settings (API key, target, audit kind, weekly schedule), the last result of each audit kind (score, findings, passing checks and coverage notes about the target), the verification token you paste or the plugin obtains (with the time and outcome of the last file test), the verification status Sitelemetry reported for this site’s host and the outcome of the last verification or renewal, for each administrator which weekly-audit and renewal notices they dismissed and, while an audit runs, the job state. It stores no data about visitors or users and uses no cookies or tracking. Uninstalling the plugin removes all of it.

The verification token is public by design: once you save it, the plugin serves it at /.well-known/sitelemetry-verification.txt so Sitelemetry can confirm you control the site. “Test the file” requests that address from your own server; it makes no request to any other host. The AI fix prompt is only copied to your clipboard.

Technical details