RecapWP is built by a small team who spent years keeping a roster of WordPress sites secure, fast, and healthy. This is the tool we wished we had: one audit engine that finds every issue and fixes them for you, on demand, entirely inside wp-admin.
Every agency we worked at had the same quiet ritual. Once a month someone would block out an afternoon, open each client site, and go looking for trouble: an out-of-date core, a plugin two versions behind, a form that started 404-ing after a migration, a readme file quietly announcing the exact WordPress version to anyone who asked. You clicked through, you took notes, you fixed what you could remember how to fix.
The checking was never the hard part. The hard part was that it never ended, and it never scaled. By the time you’d swept ten sites you’d lost the day. By the time you kept thirty, things slipped between the cracks: the broken links no one crawled for, the exposure no one thought to close, the fatal error that only showed up for logged-out visitors. The work that kept a site healthy was the most consistent value we delivered, and the easiest to let slide.
Keeping a site healthy was the most consistent value we delivered, and the easiest to let slide.From the team’s note
So we built RecapWP. The premise is unromantic: a deterministic audit engine, the best in the business, that runs dozens of checks across every area of a site on demand, surfaces every problem worst-first, and fixes them for you. It closes the exposures attackers probe for, patches insecure permissions, rewrites mixed-content URLs, and hands you a typed redirect for every dead internal link. Then you click it again next week and it does the same thing, exactly the same way.
No dashboard to babysit. No external service hosting your client’s data. Nothing scans until you ask it to, and nothing leaves the site. Just an honest picture of what’s wrong, and a button to put most of it right.
A patched core, closed exposures, and no dead links are the least glamorous features a site can have, and the ones that compound. Boring is what keeps a site standing.
We detect on-site, store on-site, and fix on-site. There’s no external SaaS, no telemetry, and no account to manage. WordPress is the platform; we are guests in your database.
Every check and every fix is deterministic: the same site returns the same findings, and a fix is an allowlisted config write, never a guess. The optional assistant only explains; it’s never on the fix path.
The Health Score is a real composite of real signals. If a site is at 64, the audit says 64. We’d rather be useful than reassuring.
The roadmap is short on purpose. The next twelve months are about making the audit engine deeper and the fixes sharper, not stacking new products beside them.
Across the areas people lean on most, security and performance first.
Health Score weighting that reflects real-world risk, not just count.
More of what a visitor actually hits, caught in context on the page.
For agencies who want to roll findings into their own tooling.
Install RecapWP, run your first audit, and see everything it finds before deciding on a single fix.