=== TopNotch Site Health ===
Contributors: topnotchagency
Tags: site health, diagnostics, maintenance, compatibility, performance
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.3.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Audit WordPress health, prioritize evidence, apply supported safe fixes, and verify the result without destructive “fix everything” behavior.

== Description ==

TopNotch Site Health is a diagnostic-first WordPress audit and safe-remediation plugin from Top Notch Agency LLP.

It is designed to answer practical maintenance questions:

* Are active plugins or the theme declaring requirements the server does not satisfy?
* Are several plugins trying to own the same SEO, cache, security, SMTP, backup or optimization responsibility?
* Are WP-Cron events overdue?
* Is autoloaded option data unusually large?
* Are revisions, expired transients or comment backlogs growing?
* Is HTTPS/debug/security configuration worth reviewing?
* Are there duplicate-content signals or possible orphan pages?
* Are internal links broken, trapped in redirect chains or looping?
* Does the homepage expose basic responsive/mobile and security-header signals?

TopNotch Site Health prioritizes findings as Critical, High, Medium, Low or Info. A 0-100 overall prioritization score is issued only after every required diagnostic module has been refreshed within the same audit window. Partial scans show an observed-module score and explicit coverage instead of presenting it as overall site health. The scoring model uses category weighting, confidence adjustment, diminishing penalties for repeated signals from the same rule, bounded occurrence influence, and severity guardrails. Informational findings do not reduce the score. The score is not a security certification, SEO ranking score, or proof that a plugin conflict exists.

= Site Audit Engine =

Introduced in 0.2.0 and retained in the current release, the bounded same-host Site Audit Engine provides:

* Batched crawl execution to reduce PHP/AJAX timeout risk
* Sitemap, navigation, published-content and rendered-link discovery
* Crawled Pages inventory with HTTP, indexing, title, H1, script and response context
* Thematic scores for Crawlability, HTTPS, Performance, Internal Linking, Markup, Mobile, Content and WordPress Health
* Statistics, Compare Audits, Progress and JS Impact workspace sections
* Compact completed-audit history snapshots
* Static JavaScript-surface analysis for script counts, external scripts and parser-blocking candidates
* Crawl findings for errors, redirects, sitemap/noindex mismatches, missing titles, mixed content and heavy script surfaces

JS Impact is intentionally described as static markup analysis. The plugin does not execute JavaScript in a browser and does not claim to measure Core Web Vitals from the WordPress server.

= Safe by default =

Version 0.3.3 retains the live-validated two-stage Preview -> Apply workflow for the small high-confidence safe-fix allowlist. The free plugin can manage X-Content-Type-Options, Referrer-Policy and file-editor hardening when those findings are currently detected. It also provides individual guarded controls for selected reversible maintenance actions.

It does not bulk-fix or silently:

* disable or delete plugins/themes;
* delete database/plugin residue;
* edit wp-config.php debug or memory definitions;
* rewrite post content or slugs;
* create redirects;
* purge caches;
* change SEO metadata;
* install updates;
* enable HSTS without explicit guarded confirmation.

Consequential actions remain guided or separately confirmed. Managed safe changes are verified by the relevant audit stage and recorded in a bounded local remediation log.

= Main diagnostic modules =

* WordPress/PHP/environment compatibility
* Cached core/plugin/theme update posture
* Plugin responsibility overlap signals
* HTTPS, debug-display and authentication-salt hardening signals
* WP-Cron overdue-event checks
* Autoloaded option size and database-size context
* Revision, transient and comment-maintenance signals
* WordPress, server/CDN page-cache signals and object-cache context
* Duplicate-content token similarity
* Possible orphan-content graph with navigation-menu awareness and aggregated review signals
* Duplicate published titles and empty stored pages
* Homepage loopback and viewport checks
* Selected security response headers
* Bounded same-host broken-link, redirect-chain and redirect-loop audit
* JSON and CSV report exports
* WordPress core Site Health test integration
* WordPress Site Health Info integration
* Optional weekly local-only snapshot

= Privacy =

TopNotch Site Health requires no TopNotch cloud account, analytics, telemetry, license heartbeat, tracking pixel or remote execution service.

The manual internal-link audit makes HTTP requests only to URLs on the site's own hostname. If a same-host URL redirects to another hostname, the plugin records that boundary and stops before requesting the external destination.

No website data is automatically transmitted to Top Notch Agency LLP.

== Installation ==

1. Upload the `topnotch-site-health` folder to `/wp-content/plugins/` or install the ZIP from Plugins > Add New > Upload Plugin.
2. Activate TopNotch Site Health.
3. Open TopNotch Health in wp-admin.
4. Run Complete Site Audit for a current overall score.
5. Use Local + Content Audit when you intentionally want to avoid the HTTP link crawler, or run the bounded Internal-Link Audit separately.

== Frequently Asked Questions ==

= Does TopNotch Site Health automatically fix problems? =

Only a small allowlist of reversible, high-confidence findings can be handled through Safe Fixes. Version 0.3.2 requires a real preview first, shows exactly what will change, and then requires a separate Apply action. Consequential configuration, SEO, HSTS and destructive database changes are never included in the safe bulk action.

= Is every overlap finding a real conflict? =

No. Multiple plugins can coexist safely when features are intentionally divided. The plugin surfaces overlap as a review signal.

= Does duplicate-content detection prove a Google penalty? =

No. Similarity is a local editorial signal. Search intent, canonicalization, usefulness and indexing behavior require human review.

= Does the link auditor crawl the whole internet? =

No. It is bounded by an administrator-configurable URL limit and only requests the site's own hostname. Off-site redirect destinations are not fetched.

= Why is the link audit separate from the local audit? =

HTTP requests take longer and can be affected by firewalls, rate limits and host loopback rules. Keeping the link audit as a separately bounded scan group reduces production load and lets administrators rerun it independently. The Complete Site Audit button includes this bounded stage automatically.

= Does the plugin replace WordPress Site Health? =

No. It complements WordPress core Site Health and also adds a few lightweight tests and an Info section to the core screen.

== Changelog ==

= 0.3.3 =
* Adds a prominent sticky WORK IN PROGRESS audit banner with live stage text and progress percentage.
* The complete audit now visibly advances through reset, local diagnostics, content/readiness, internal-link checks and the bounded site crawl.
* Crawl progress uses the actual processed/total page count when available.
* Complete and error states are visually explicit.
* No scanner, scoring, safe-fix, crawl-scope, remediation, database or SEO logic changed.

= 0.3.2 =
* Public Release Final after live production validation of the complete diagnose -> preview -> apply -> verify -> rescan workflow.
* Updates current admin/report wording so the unified Free product accurately reflects audit + safe remediation behavior.
* Removes stale v0.2.0 labels from current crawl inventory, comparison guidance, statistics and CSV export descriptions while preserving historical changelog context.
* Keeps the validated 17-module audit engine, safe-fix allowlist, preview token, remediation verification, SEO Link Planner, scoring and crawl behavior unchanged from v0.3.1.
* No destructive database cleanup, automatic content rewriting, redirect automation, wp-config edits, telemetry or cloud dependency added.

= 0.3.1 =
* Splits Safe Fixes into a true Preview -> Apply workflow; previewing never changes the site.
* Binds the apply request to a server-generated preview token so stale previews must be reviewed again.
* Shows each exact safe change before execution and keeps HSTS, wp-config, content, redirects and destructive cleanup outside the safe allowlist.
* Makes diagnostic evidence visible on remediation cards instead of relying only on collapsed details.
* Replaces blank evidence panels with a clear refresh message when an older snapshot did not store exact evidence.
* Removes outdated standalone-remediation wording from the public UI.
* Preserves the validated 17-module v0.2.0 audit/crawl foundation and v0.3.0 unified remediation architecture.


= 0.2.0 =
* Adds the Site Audit Engine as a fourth required full-audit stage, expanding complete coverage from 13 to 17 modules.
* Adds bounded batched same-host crawling with sitemap, navigation, published-content and rendered-link discovery.
* Adds Crawled Pages inventory, thematic scores, Statistics, Compare Audits, Progress and JS Impact workspace sections.
* Adds compact completed-audit history snapshots and current-vs-previous score comparison.
* Adds static JavaScript-surface diagnostics without claiming browser execution or Core Web Vitals measurements.
* Adds crawl-level signals for HTTP failures, blocking responses, redirects, sitemap/noindex mismatches, missing titles/H1s, mixed content and heavy script surfaces.
* Adds crawl/history data to JSON and CSV exports.
* Preserves the v0.1.4 scoring model, report-integrity checks, read-only defaults and non-destructive safety policy.

= 0.1.4 =
* Reconciles orphan-content finding counts with the authoritative local-graph metric so the dashboard, JSON and CSV cannot disagree about affected items.
* Stores complete orphan/repeated-rule evidence in the report and keeps it inside a collapsed, scrollable admin evidence panel.
* Adds one-click evidence copying and exposes stable rule IDs beside evidence.
* Adds explicit metric labels and explanations, including separate WP_CACHE, advanced-cache.php, server/CDN cache and persistent object-cache runtime states.
* Removes duplicate legacy cache metric aliases during report normalization and adds a combined page-cache summary.
* Adds report-integrity checks and displays PASS/Review alongside coverage metadata.
* Expands CSV exports with integrity, category scores, metrics and full evidence, with spreadsheet-formula injection protection.
* Adds automatic non-destructive report-schema migration when the plugin is replaced in place.
* Preserves category-weighted scoring, complete-audit coverage gates and read-only-by-default operation.

= 0.1.3 =
* Replaces flat per-finding deductions with category-weighted scoring.
* Adds Technical Health and Content Architecture scores plus per-category score breakdowns.
* Adds Confirmed, Context-dependent, Review signal and Informational confidence labels.
* Informational findings no longer reduce the score.
* Adds diminishing score impact for repeated findings from the same diagnostic rule.
* Adds bounded occurrence influence so one repeated rule cannot dominate an entire category.
* Adds severity guardrails so actionable High/Critical findings remain visible in the overall score.
* Aggregates repeated orphan-content warnings into one review finding with an affected-item count and expandable evidence.
* Includes registered WordPress navigation menus in the local orphan-content graph.
* Expands bounded link discovery with navigation-menu and rendered-homepage links while retaining same-host limits.
* Improves page-cache awareness by recognizing common server/CDN response signals before reporting no cache signal.
* Adds stable rule IDs to findings to prepare for a future opt-in remediation add-on.
* Adds confidence, occurrences, rule IDs and scoring-model details to exports.
* Preserves read-only-by-default behavior and all existing scan-coverage safeguards.

= 0.1.2 =
* Adds explicit scan coverage across 13 required diagnostic modules.
* Withholds the overall health score until local, content/readiness and bounded link-audit groups are all refreshed within the same 24-hour audit window.
* Partial scans now show an observed-module score labelled as partial rather than a green overall score.
* Adds per-scan-group last-run time, observed score and module count.
* Adds a one-click Complete Site Audit sequence plus a separate Local + Content Audit option.
* Upgrades stored v0.1.0/v0.1.1 reports into the new coverage schema without discarding findings.
* Adds coverage/status metadata to JSON and CSV exports.
* Weekly local snapshots are explicitly stored as partial unless other groups are refreshed.
* Preserves the v0.1.1 notice-contrast fix and existing diagnostic/crawler logic.

= 0.1.1 =
* Fixes low-contrast admin notices when another plugin injects notices into the dark dashboard hero.
* Adds scoped success, warning, error and info notice colors without changing scanner behavior.
* No diagnostic, database, crawler, maintenance or report logic changed.

= 0.1.0 =
* Initial diagnostic foundation.
* Added weighted health score and severity-ranked findings.
* Added compatibility, maintenance, database, cron, performance and security checks.
* Added known plugin responsibility-overlap detection.
* Added duplicate-content, orphan-content, duplicate-title and basic mobile-readiness checks.
* Added bounded same-host broken-link, redirect-chain and redirect-loop audit.
* Added JSON/CSV export and printable reports.
* Added WordPress Site Health test and debug-information integration.
* Added optional weekly local-only lightweight snapshot.
* No telemetry, TopNotch cloud dependency or destructive automated cleanup.


== Unified Safe Fix Engine ==

v0.3.2 combines the validated Site Audit Engine with a live-validated safe remediation layer in one plugin. Supported reversible fixes are evidence-linked, capability/nonce protected, previewed before application, verified by the owning audit stage, and logged locally. High-impact changes remain guarded or guided.

== Upgrade Notice ==

= 0.3.3 =
Adds a prominent live WORK IN PROGRESS progress bar while audits run. Audit and remediation logic are unchanged.

= 0.3.2 =
Public Release Final. Current-version wording is polished and version-neutral where appropriate; diagnostic, crawler, scoring and safe-remediation behavior is unchanged from the live-validated v0.3.1 release candidate.
