Docs.

Getting started.

Install the plugin, open the Audit tab, and run your first on-demand scan. RecapWP scans nothing until you click; most first runs finish in a few seconds.

RecapWP is a WordPress site auditor and fixer. On demand it runs dozens of deterministic checks across every area (security, performance, broken links, users, WooCommerce and more), surfaces every problem worst-first, and fixes them for you. There's no dashboard to host, no account to manage, and no scheduled job emailing you reports. The plugin runs entirely in your WordPress admin and stores everything in your existing database.

Before you start, make sure you have:

• A WordPress site on 6.2 or higher, running PHP 8.0+.
• A MySQL or MariaDB database (RecapWP creates four custom tables).
• An administrator account on that site: RecapWP requires the manage_options capability.

01Install RecapWP

Open Plugins → Add New in your WordPress admin, search for RecapWP, click Install Now, then Activate. You'll find the plugin under RecapWP in the admin sidebar, listed just after Tools. Prefer to grab the build directly? The Free .zip is on the RecapWP Free page; upload it under Plugins → Add New → Upload Plugin.

Activation creates four database tables (findings, fix history, scan runs, and the activity log), schedules a single daily license-check cron event, and does not contact any external service. Nothing is scanned on activation.

02Open the Audit tab

The plugin opens on the Dashboard tab: a Site Health hero, recent activity, and a score trend that fills in once you've run a scan or two. To run an audit, switch to the Audit tab. On a fresh install every area reads "Not scanned" until you trigger the first scan.

03Run your first scan

Click Scan now in the Audit hero. RecapWP runs every check across all areas in seconds and patches the page in place: the hero score, the coverage count, and the findings list all update with no page reload. Findings group by area and sort worst-first, each with plain-English context.

04Read the findings

Each area renders as a collapsed accordion with a count pill and a worst-severity accent stripe: the signal that findings landed there. Expand an area to read its rows. A finding is either an automatic fix (a Fix button), a Create redirect (broken internal links, Pro), or detect-only advice ("How to fix" / "Edit this page").

05Apply the fixes

Click Fix on a fixable finding to preview the change, confirm, and apply it. Every fix is a deterministic, audited config change, recorded row by row in the activity log. From here, most users branch one of three ways: learn how the areas and severities work, dig into what each fix actually changes, or add a Pro license for the link crawl and redirects.

Running a scan.

Scan now is the core loop. Run all areas or a subset, watch the Pro link crawl stream in, and let captured PHP errors surface on their own.

Scan now

The audit is on-demand. Click Scan now in the Audit hero and RecapWP runs each in-scope area's checks, upserts the findings, records the run, and returns a fresh snapshot. Detection is 100% deterministic: the same site returns the same findings every time, so a scan is safe to re-run as often as you like. The hero and findings list update in place; there is no reload and nothing leaves your site.

Choosing which areas to scan

Open the "Choose areas" picker next to Scan now to scan a subset instead of everything. Check the areas you care about (each one expands to the underlying domains under the hood) and the scan runs only those. The picker also lets you choose which public post types the crawl walks (each shown with its published count, including WooCommerce Products) and a crawl order: Most engaged first (the default, ranked by comments and sales, newest-first tiebreak) or By content type (each selected type walked in order). The whole picker locks while a scan is running.

The async link crawl PRO

On Pro, the Links crawl is the one asynchronous part of a scan. It runs server-side on a self-rescheduling background job in roughly twelve-second chunks, so a scan finishes even if you background or close the tab. Findings stream into the list as the crawler verifies them: broken links appear in a "Found so far" region during the crawl and settle into their grouped area on completion. A persistent dock in the bottom-right shows live progress, an elapsed timer that survives reloads, and Pause / Resume / Cancel. The crawl runs only when Links is in your scan scope; the dedicated Broken Links tool (under the Audit menu) can also run a links-only crawl on its own. Free runs the same scan without the crawl.

A self-tuning crawl PRO

There is no speed knob to manage. The crawler measures your server's response time as it goes, ramping up to parallel fetches on a snappy host and throttling back the moment latency rises. External links that time out get one longer-timeout re-check before any verdict sticks, so the broken count stays consistent between runs.

Real-time error monitoring

Captured PHP fatal errors don't need a manual scan. RecapWP records fatals thrown on real visitor requests and surfaces them as findings in the Errors area automatically, on your next admin pageload, kept in step with the captured log. Clearing one is a one-way Resolve (nothing on the site changed); if the fatal recurs, the finding reappears on its own. That's the "did my fix hold?" signal.

Findings & areas.

Every check belongs to one of several customer-facing areas, and every finding carries a severity. Areas group worst-first, and a clean check can report itself "in place."

The scan areas

The checks are presented as a set of curated areas, in a fixed scan-sweep order:

• Security: hardening exposures, login protection, HTTPS and mixed content, file security.
• Platform: pending core, plugin, theme and PHP updates; inactive plugins.
• Errors: captured PHP fatal errors from real visitor requests.
• Performance: page and object caching, autoload bloat, revision pile-up, emoji/embed scripts.
• Links PRO: broken internal/external links, broken redirects, orphan pages, dead ends and under-linked posts.
• Content: stale, aging posts.
• Users: the default admin username, too many administrators, display name matching the login.
• WooCommerce PRO: products with no price, no image, or published while out of stock (requires WooCommerce active).
• Environment: search engines blocked, debug mode in production, the built-in file editor enabled.

The Links area appears only on Pro (the crawl is Pro-gated), and the WooCommerce area appears only on an active Pro license with WooCommerce installed. The picker, the area cards, and the coverage count (how many areas were scanned) all read from one shared definition, so they never drift.

On-page SEO is no longer one of the scan areas. Missing meta descriptions, missing image alt text, and thin content are now flagged per page by the Frontend Auditor (Pro) as you browse, where you can see and fix them in context.

Severities

Every finding carries a severity, worst to mildest: Critical → High → Medium → Low → Info. Areas and rows sort by it. The severity also decides whether a finding moves your Health Score, and not every one does.

Worst-first grouping

Open findings group into per-area accordions, each with a count pill and a worst-severity accent stripe. The hero's middle column is a Severity / Status / Coverage switcher: Severity shows the Critical/High/Medium/Low shape, Status shows Open / Fixed / Marked OK / In place counts, and Coverage shows areas scanned and checks run. Every area renders collapsed by default; expand the ones you want to read and the audit never opens or closes an area for you.

"In place" and secure states

Many hardening and config checks are binary protections. When one is already correct, RecapWP reports it as a read-only "in place / secure" state in the Fixed & in place group rather than a problem, so you can see at a glance that XML-RPC is closed, the directory listing is off, or emoji scripts are dequeued. Volume checks (broken links, thin content, out-of-stock products) have no single "done" state and stay blank there.

Mark OK

For an advisory you've reviewed and accepted (an optional hardening step, a stale post you're keeping), use Mark OK. The finding moves to the Marked OK group and stops counting against you, but it isn't deleted: if the underlying issue is later genuinely resolved it drops out, and you can restore it any time. (Captured PHP errors carry no Mark OK; they're resolved or they reappear.)

How fixes work.

Fixable findings carry a Fix button that writes a deterministic config change. Every fix passes through one audited choke-point and is recorded in a ledger, so nothing about a fix is guesswork.

Automatic fix vs. detect-only

Findings fall into three remediation kinds:

• Automatic fix: a registered fixer applies it: a deterministic option or rule write. Examples: closing XML-RPC, blocking user enumeration, adding security headers, dequeuing emoji/embed scripts, allowing search engines.
• Create redirect PRO: every broken internal link gets a 301 (see Links & redirects).
• Detect-only: advisory findings surfaced with context-aware guidance ("How to fix" / "Edit this page"), with no automatic fix. Updating WordPress core, switching to HTTPS, or renaming the admin user are things you do yourself.

How a fix runs

Click Fix and RecapWP shows a preview of the exact change, then a confirm. Every fix passes through a single choke-point that checks your capability, confirms the fixer is on the allowlist, refuses anything on the never-touch blacklist, captures the prior state, guards against double-applying, and writes an audit-log row. The UI patches in place: the row moves to Fixed & in place the instant the server confirms, with no reload.

The fix ledger

Each fix is recorded in a ledger backed by its own database table, which stores the prior state captured at apply time. Every change is exact and accountable: the ledger knows precisely what was written, when, and what was there before. Nothing about a fix is guesswork, and the Logs tab shows the full history row by row.

Rolling back a session

Because the ledger captures prior state, RecapWP can reverse an applied fix exactly if you ever need it to, individually or for a whole session (the confirm-gated bulk action in the Audit foot row and under Settings → Revert changes). Marked-OK acknowledgements are never touched by a rollback.

Resolving captured errors

The Errors area works differently. Clearing a captured PHP fatal is a one-way Resolve: RecapWP never changed your site to surface the error, so there's nothing to reverse. It removes the monitoring record, and if the same fatal happens again, the finding reappears on its own.

Security & hardening.

The Security area is the deepest in the auditor: exposure checks, login protection, HTTPS and mixed content, and file security, many with an automatic fix.

Hardening exposures

These checks find the default WordPress exposures attackers probe for. Most carry an automatic fix:

• XML-RPC is open (Medium): closes the xmlrpc.php attack surface. FIX
• Usernames can be enumerated (Medium): blocks the REST and author-archive username leak. FIX
• WordPress version is exposed (Low): removes the version meta/generator tag. FIX
• Security headers are missing (Low): adds the standard hardening response headers. FIX
• Uploads folder may be browsable (Low): drops a directory-index guard. FIX
• Exposed install file (Low): readme.html / license.txt / wp-config-sample.php left readable — flagged with steps to remove them yourself (detect-only).
• Core REST / RSS feeds (Info): optional, penalty-free hardening you can opt into.

A few exposures are detect-only because a plugin can't safely change them for you: placeholder security salts, the default wp_ table prefix, a modified core file, and a publicly reachable staging site.

Login protection

RecapWP tracks failed logins and flags a failed-login spike. On Pro, the Failed-login limiting check carries a fix that enables the built-in login guard, a brute-force limiter that caps repeated failures (it's detect-only on Free). The guard is never enabled silently; you turn it on from the finding.

HTTPS and mixed content

Two related checks: Site not using HTTPS (High, detect-only; moving a site to HTTPS is an infrastructure change) and insecure http:// resources in a post (Medium). The latter is an automatic fix that rewrites the flagged same-site asset URLs to https in the content. RecapWP also probes your SSL certificate and escalates the warning as expiry nears.

File permissions FIX

Insecure file permissions (High) flags files and folders that are world-writable or otherwise too permissive, with a chmod fix. On Windows hosts the check no-ops: POSIX modes are synthetic there, so it returns nothing rather than false-positive.

The Logs / Audit Log

The Logs tab is a standing, dated record of RecapWP’s own activity: every scan, fix, undo, revert, mark-OK, cron event, log clear and settings save. Each entry carries an Actor column (who did it) and a typed Action column, both filterable, on every tier. On Pro the log also captures security events, sign-ins and user, role, plugin and theme changes, each attributed to the actor, so it reads as a full who-did-what Audit Log. Retention is configurable on both tiers under Settings → Logging.

Links & redirects.

The Pro crawl finds broken links, orphan pages and dead ends; every internal break gets a redirect with a choice of type, and the Redirects tab manages every rule.

The broken-link crawl

On Pro, a background crawler walks your site and verifies the links it finds. It surfaces several kinds of finding in the Links area: broken links (internal and external, including dead external hosts), broken redirects (a rule you set up whose target has since died), orphan pages (published but linked from nowhere), and dead-end and under-linked pages, each with deterministically-computed related posts you could link from. The crawl is the one asynchronous part of a scan and runs server-side, so it finishes even if you close the tab; findings stream in as they're verified.

The crawler is bounded for large sites (caps on pages and URLs, both filterable), with an indexed ID query and adaptive concurrency, so a full scan stays fast and memory-flat even on tens of thousands of posts.

Create redirect

Every broken internal link gets a Create redirect fix, with a choice of type: Permanent (301), Temporary (302), or a no-target Gone (410) / Not found (404) for a page that's gone for good. A 301/302 requires a live target before it can be created, so a redirect can never lead into another dead end. Broken external links stay detect-only: you can't redirect someone else's URL, so the guidance is to edit or remove the link.

The Redirects tab

The Redirects tab (Pro only) manages every rule: add a manual redirect with its type, edit a target or re-type a rule inline, or delete one, with each row showing a hit count and last-hit time and rules grouped by origin ("Added manually" vs "From your Audit"). All edits validate same-site and no-loop, patch the table live with no reload, and write an audit-log row.

The Broken Links tool

The crawl also has its own home under the Audit menu: Broken Links. Choose what to crawl, run it, and watch broken links stream in live, each row expandable to every page the dead link appears on, with Create redirect and Mark as OK right on the row. Settled items move into collapsed "Redirected & fixed" and "Marked OK" groups, shared with the Audit.

The Internal Links report

Every full crawl also refreshes the Internal Links report: inbound, outbound and external link counts for every page the crawl saw, with orphan pages and dead ends flagged, searchable and sortable, each row linking to the editor. It's read-only; RecapWP never edits your content.

Bot-probe noise is filtered

Automated scanners hammer every public site with recon probes (.env, wp-config.php, /.git/ and the like). Those aren't broken links on your site, so they never appear in the Audit or the Broken Links tool: both list only links actually found on your pages, and a verdict is recorded only when a real request confirms a genuine error.

Frontend Auditor.

A live, per-page, admin-only inspector that scans the rendered front-end in context and pins each issue to the element on the page that caused it.

What it is

The Frontend Auditor complements the admin Site Audit by inspecting a page where a visitor actually hits it. When an administrator views any page on the front end, a floating launcher runs a real in-browser scan of the rendered DOM and surfaces what's wrong on that specific page, with on-page pins anchored to the offending elements. It's Pro-only, admin-only (never exposed to logged-out visitors), and 100% client-side. No AI is involved.

What it audits

Because it reads the live rendered page, it catches things only visible in a real browser at render time:

• WCAG colour contrast (measured from live computed styles).
• Broken images and mixed-content http:// images.
• JavaScript errors captured during page render.
• Heading-order skips and unlabeled form inputs.
• A missing meta description or missing html[lang].
• Broken links anywhere on the page (nav, header, footer, sidebar and content), each grouped and verified once.

Fixes in context

Some findings are fixable right there. A mixed-content image can be upgraded to https, and a broken internal link gets the same Create redirect flow as the admin audit: a modal target editor that validates before it writes the 301. After a fix, the auditor re-verifies that one item and files it under a collapsed Fixed group. External links and other advisories stay detect-only with inline "How to fix" guidance.

Scan once, restore silently

The auditor scans a page automatically only on your first visit. On a return visit it restores the last result silently (no "Scanning…" chrome and no server round-trip), re-placing the pins from a per-page cache. Re-scan page wipes that cache and runs a fresh full scan. Marked-OK dismissals and fixed items persist per page across reloads, and the panel remembers your light/dark choice.

Ask RecapWP.

An optional in-admin assistant that explains and prioritizes your findings in plain English. It runs on your own API key and it never applies a fix.

Bring your own key

RecapWP never bundles or runs a model; you connect your own provider. It speaks the OpenAI-compatible standard, so it works with OpenRouter, Groq, Together, OpenAI, or a self-hosted Ollama / LiteLLM endpoint. On WordPress 7.0+ you can instead route through core's built-in AI Client (provider wp_core) with no key at all. Because you supply the key and pick the model, RecapWP carries no token cost. See Settings → AI to connect and test it.

What it can answer

The assistant is grounded in your site's live data (your audit findings, health score, redirects, recent activity, and settings), not generic WordPress trivia. It can cite specific findings and lead with the highest-severity ones, so questions like "what should I fix first?", "explain this finding", or "show my open issues" get a real, sourced answer. It can also display your logs, findings, or redirects inline in the chat.

Propose, then confirm

Beyond answering, it can propose a small set of actions and never acts silently. It offers an inline Apply / Cancel card, and only on Apply does anything happen. The one runnable action today is "Run a site audit scan" (which triggers the real Audit-tab scan), and the one writable setting is the AI master toggle. Every Apply re-validates server-side and writes an audit-log row.

What it will never touch

Enforced server-side, the assistant can never write your API keys, your license, or any provider infrastructure, and it can't clear logs or run the connection test. The most sensitive surfaces are simply off-limits to it. Your API key is stored masked and is never logged in full.

Settings reference.

The Settings tab is slimmed to the auditor essentials: AI connection, log retention, and site maintenance. Every option, its key, default, and what it does.

All settings live under RecapWP → Settings, organized into four sections in this order.

AI PRO

The connection for the Ask RecapWP assistant. The entire section is Pro-only and omitted from the Free build (not shown locked). After entering a key, click Test connection: RecapWP runs a tiny one-token check and locks the provider in on success.

Logging

Audit-log retention, a general setting enabled on both Free and Pro.

Revert changes

A standalone maintenance path that bulk-reverses every applied fix, the same action as the Audit foot row, available here so a full rollback never requires uninstalling. It's confirm-gated, shows a live count (disabled when there's nothing to roll back), and leaves your Marked-OK acknowledgements untouched.

Uninstall

There is no setting to remember: deleting the plugin is always a clean uninstall. It returns the site to its pre-fix state, wipes the four tables, every recap_* option and transients, and releases the license seat. Deactivating never touches your data.

Billing & plans.

Free versus Pro, the four per-site license tiers, how activation works, the grace period, and what happens when you downgrade.

Free vs Pro

Free covers the hardening essentials: core security hardening (including the one-time insecure-file-permissions fix) plus the Platform, Users and Environment areas, every fix it detects, the Protection page's core security toggles, your health score and score history, the activity log with its Actor and Action columns and filters, audit-log retention, and the Dashboard / Audit / Protection / Logs / Settings surfaces. It has no License tab.

Pro adds the agency-grade layer: the deeper detection (performance, captured PHP errors, stale content) and the full Security set, the broken-link crawl and Links area, the Broken Links and Internal Links tools, the Redirects tab, the Frontend Auditor (per-page on-page SEO and accessibility included), the login guard and the full Protection toggle set, the audit-log enrichment that captures attributed security events (sign-ins, user, role, plugin and theme changes), the WooCommerce checks, auto-updates, and the Ask RecapWP assistant.

The four tiers

Every paid tier is the full Pro feature set; they differ only by how many sites you can activate. Licensing is per site, via Lemon Squeezy.

Activating Pro

Open the License tab (Pro builds only), enter your key, and activate. Pro features unlock immediately. Gating reads from a local cache; the plugin never calls the licensing API on a page load. A daily cron job revalidates in the background.

The grace period and downgrading

RecapWP is tolerant of intermittent connectivity. If the licensing API is unreachable, rate-limited, or returns a server error, those transient failures preserve Pro (your grace period); only after three consecutive failed checks does the site revert to Free, and any single successful check resets the counter; recovery is automatic: the next successful check reactivates Pro. (A definitive "invalid" or "cancelled" verdict reverts right away, with no grace.) You can also deactivate from the License tab, which hides the Pro-only surfaces (Links, Redirects, Frontend Auditor, the AI section) but never deletes data.