WebOsmotic Diagnostics Dashboard Documentation

Deeper WordPress diagnostics with actionable recommendations and selected one-click fixes.

Version 1.6.0 · by WebOsmotic

Overview

WebOsmotic Diagnostics Dashboard extends the built-in WordPress Site Health screen with 15 in-depth checks across compatibility, security, performance, maintenance and diagnostics. It grades your site with a single health score, explains every finding in plain language, and turns many of them into a one-click fix. It also records a history of scans so you can see trends and export reports.

Every check is read-only. The plugin never changes your site on its own; fixes run only when you click them.

Installation

Requirements

• WordPress 6.2 or newer
• PHP 7.4 or newer

Install

1. In your WordPress admin, go to Plugins → Add New → Upload Plugin and choose the plugin ZIP, or search for it in the directory.
2. Click Activate.
3. Open WebOsmotic Diagnostics Dashboard in the admin menu.

Quick start

1. Open WebOsmotic Diagnostics Dashboard → Dashboard.
2. Click Run scan now. The scan runs in small batches, so it will not time out on large sites.
3. Read your health score and work down the findings, starting with anything marked Critical.
4. Where you see a fix button, click it to resolve the issue; for configuration findings, copy the provided snippet.

The dashboard

The dashboard is the home of the plugin. It shows:

• Health score (0-100) - a weighted summary where critical issues cost more than recommendations.
• Summary counts of Critical, Recommended and Passing checks.
• Finding cards, sorted so criticals appear first. Each has a summary, an explanation, a recommendation, and - where available - a fix button, snippet, or deep link.

Results are cached so the dashboard can load the latest saved scan without immediately starting a new full scan. Background scans run according to the selected schedule (daily by default), and the admin bar can show the number of critical issues.

The checks

WebOsmotic Diagnostics Dashboard runs the following 15 checks. Each returns Passing, Recommended, or Critical.

You can turn any check on or off from the Settings page.

One-click fixes

Where the plugin has an available remediation action, a button appears on the finding card. Available fixes include:

• Clear expired transients
• Flush the object cache
• Regenerate rewrite rules (permalinks)
• Delete unused themes
• Delete inactive plugins

For findings that need a configuration change, the card shows a ready-to-paste snippet with a copy button and a deep link to the relevant screen.

History & reports

Open WebOsmotic Diagnostics Dashboard → History & Reports. Every scan is stored, giving you:

• A score trend chart over time.
• A "what changed" diff between the two most recent scans - new criticals, resolved issues, and per-check regressions or improvements.
• A table of recent scans, each with its own export links.

Exporting a report

Reports export for the latest or any past scan, in three formats:

• Markdown - for pasting into a ticket or email.
• JSON - the full structured data.
• Printable HTML - opens in a new tab; use your browser's "Save as PDF".

Settings

Open WebOsmotic Diagnostics Dashboard → Settings to configure:

Alerts

When a scan finds a critical issue the previous scan did not have, WebOsmotic Diagnostics Dashboard can notify you by email and/or a Slack-compatible webhook. Because it compares each scan to the one before it, a standing problem is reported once - not on every scan. A one-hour throttle prevents bursts, and the very first scan never alerts (there is no baseline to compare against).

Configure the targets on the Settings page, or via constants. If neither an email nor a webhook is set, alerts are off.

Vulnerability scanning

The optional Known vulnerabilities check matches your installed plugins, themes and WordPress core against the WPScan vulnerability database.

1. Get a free API token at wpscan.com/api.
2. Paste it into Settings → WPScan API token, or define SHP_VULN_API_KEY in wp-config.php.
3. Run a scan. The check reports any component whose installed version has a published, unpatched vulnerability.

Results are cached for 12 hours and the number of live API calls per scan is capped, so the free tier's daily limit is respected. Without a token, the check simply shows a setup prompt.

Constants & filters

Constants (wp-config.php)

These take precedence over the Settings page and are ideal for version-controlled or locked-down environments.

define( 'SHP_VULN_API_KEY', 'your-wpscan-token' );
define( 'SHP_ALERT_EMAIL',   'ops@example.com' );
define( 'SHP_ALERT_WEBHOOK', 'https://hooks.slack.com/services/XXX' );

Filters

Adding a custom check

The plugin is built to be extended. Create a class that extends SHP_Check and register it with the shp_registered_checks filter.

add_filter( 'shp_registered_checks', function ( $checks ) {
    $checks[] = 'My_Custom_Check';
    return $checks;
} );

Your class implements get_id(), get_label(), get_category() and run(), returning a result via the built-in good(), recommend() or critical() helpers. The new check then appears on the dashboard, in reports, and in the native Site Health screen automatically.

Privacy & data

By default, WebOsmotic Diagnostics Dashboard runs on your own server. The following features can contact external services, and only when you use them:

• Known vulnerabilities sends the slugs and versions of your installed plugins, themes and core to the WPScan API - only after you add a token. The request contains the component slugs and version numbers needed for the vulnerability lookup.
• Core file integrity downloads official checksums from WordPress.org, sending only your WordPress version and locale.
• Alerts, if configured, post a short message to the webhook URL you provide.

The plugin stores its scan history in a database table of its own; uninstalling removes it along with all settings.

FAQ & troubleshooting

The scan seems slow or times out.

It shouldn't - scans run in small batches for exactly this reason. If a scan stalls, reload and run it again; partial results are kept. On very large sites, the Core file integrity and Known vulnerabilities checks take longest on their first run, then use cached data.

Can I run it on many client sites?

Yes. The checks are read-only and the tool is designed for agency use across multiple installs. Reports make handover and record-keeping easy.

Does disabling a check hide it everywhere?

Yes. A disabled check is skipped by the plugin's scans and native Site Health integration until you re-enable it in Settings.

Is anything changed automatically?

No. All checks are read-only and every fix is opt-in. Destructive fixes are confirmed twice before they run.

WebOsmotic Diagnostics Dashboard - a WebOsmotic project - webosmotic.com/webosmotic-diagnostics-dashboard/