=== WellTend Health Monitor ===
Contributors: allwpcare
Tags: site health, error log, cron, monitoring, security
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Plain-language site health: one score, error log by plugin, cron and update checks, history, optional weekly email. Nothing runs on page loads.

== Description ==

WellTend Health Monitor tells a site owner, in plain English, whether their WordPress site needs attention. It is a plugin from AllWPCare, a family of free plugins for taking care of WordPress sites, with accurate guides at allwpcare.com.

Within a minute of activation you see one **health score** and a short list: "Your site hit 3 fatal errors in the last 24 hours, most from Fancy Slider", "Scheduled tasks have not run for 6 hours", "Your SSL certificate expires in 9 days". Every item links to a guide on how to fix it.

* **Error log by culprit.** Reads the PHP error log safely (bounded, incremental, never the whole file), counts fatal errors, warnings and notices, and blames the plugin or theme from the file path. Stored samples are redacted.
* **Scheduled tasks (WP-Cron).** Late tasks, a heartbeat that proves WordPress's scheduler is running, `DISABLE_WP_CRON` awareness, queue pile-ups and tasks with a schedule nobody defines any more.
* **Updates, versions and end-of-life dates.** Pending plugin, theme and core updates, how long they have waited, PHP and database end-of-support dates.
* **Disk, uploads, database and autoloaded options**, with 30-day growth.
* **SSL certificate expiry**, from your own server to its own address. **Error log exposure**: tells you if anyone on the web could download your log.
* **Email test** with a confirmation link, and a count of failed emails.
* **WordPress's own Site Health tests**, run in the background and kept in history (core keeps none), plus the tests other plugins register.
* **History.** A score line over 30 days, 90 days or a year, and a history for every check.
* **Weekly email report and alerts (both opt-in).** Counts and names only, never raw log text.
* **Known vulnerabilities (opt-in).** Checks your WordPress.org plugins and themes against the free WPVulnerability list.
* **WP-CLI:** `wp awc health status` (exits 1 when a check fails), `run`, `checks`, `history`, `log`, `snooze`, `report send`, `email-test`, `prune`.

= What it does not do =

* **It cannot tell you if your site is down.** A plugin lives inside your site, so when your site is down, it is down too. The Overview says so, and points to uptime services. The "scheduled tasks" check means WordPress's timer is running, not that your site is up.
* It is not a backup, a malware scanner or a firewall.
* It never changes your site. It explains and links. The one exception is the "Clear the log file" button, which empties the error log after you confirm.

= Nothing runs on page loads =

An hourly background task (heartbeat, fast checks, log tail) and a daily pass do all the checking. Runs are time-limited, locked and resumable. Visiting your site makes no database query and loads none of this plugin's classes.

= Privacy =

A default install sends nothing to any third party. A few checks make web requests from your server to your own site, and nowhere else: the certificate check (a secure connection to your own address; you can switch it off), the error log exposure check (asks your site for the log file's address and reads only the first few bytes) and WordPress's own loopback, page cache, HTTPS and automatic updates tests. Email goes through your own site's mail setup, to addresses you enter. See "External services" below for the one optional service.

= The WellTend menu =

WellTend Health Monitor adds one "Health" screen (tabs: Overview, Checks, Error log, Reports & settings) under a shared "WellTend" menu. If WellTend Snapshots by AllWPCare is active, it includes this plugin's settings in snapshots and exports.

== External services ==

This plugin connects to one third-party service, only if you switch it on.

**WPVulnerability** (https://www.wpvulnerability.com/, API at https://www.wpvulnerability.net/) is a free, public database of known WordPress vulnerabilities. Its data is released into the public domain under CC0.

* **When:** only after you turn on "Look up known security problems" (off by default), at most once a day, at most 40 requests per run.
* **What is sent:** one request per item, whose address contains only the slug of a plugin or theme that is listed on WordPress.org (for example `/plugin/akismet/`) or your WordPress version (for example `/core/7.1/`). The request carries an explicit User-Agent `AllWPCare-SiteHealthMonitor/<version>`, no cookies and no site address, site name, email or other identifier. Plugins and themes that are not on WordPress.org are never looked up. As with any web request, the service can see the IP address of your server.
* **Terms and privacy:** https://www.wpvulnerability.com/ (see the license and privacy pages there).

WordPress itself contacts api.wordpress.org for update checks and for some Site Health tests. Those requests are made by WordPress, not by this plugin.

== Frequently Asked Questions ==

= Does it slow my site down? =

No. Checks run in the background, never on a page load. The only thing a visit loads is a few small hooks.

= Is this the same as Tools > Site Health? =

No, it complements it. WordPress's Site Health shows a snapshot and forgets it. This plugin runs those tests in the background, keeps history, adds an error log view, cron depth, updates, growth, SSL expiry and an optional weekly email, and explains each item in plain language. It never hides or changes the core screen.

= Can it monitor uptime? =

No, and it says so. A site cannot watch itself. Use an uptime service.

= Does it send my data anywhere? =

Not by default. The optional vulnerability lookup sends plugin and theme names (slugs) of WordPress.org plugins and your WordPress version; see "External services".

= Why does it say my error log is missing? =

Many hosts keep PHP errors where WordPress cannot read them. Turn on `WP_DEBUG_LOG` (see the linked guide) or enter the path of your log in "Reports & settings".

= What happens when I delete the plugin? =

Its tables, options and scheduled events are removed. Everything it stores can be created again.

== Screenshots ==

1. Overview: the score, the history line and "Fix these first".
2. Checks: every check in plain language, with what we saw and how to fix it.
3. Error log: errors grouped by the plugin or theme that wrote them.
4. Reports & settings: the weekly email, the email test and the exact list of what leaves your site.

== Changelog ==

= 0.1.0 =
* First release.
* New folder and text domain `welltend-health-monitor`, to match the name "WellTend Health Monitor". Your settings are kept: they use the same data, and the screen stays at `admin.php?page=site-health-monitor`. If an early copy in the `site-health-monitor` folder is still active, WellTend Health Monitor waits and offers a button to deactivate the old one. Deleting the old copy later keeps your settings and snoozed checks; the score history starts again.
