Checks reference · WellTend Health Monitor docs

WellTend Health Monitor runs 47 checks in 10 groups. 30 are its own; the rest run WordPress's built-in Site Health tests in the background and keep the results, which WordPress itself does not. Each check ends in one of these states: pass, info, warn, fail, unknown (it could not be measured here) or skipped (it does not apply to this site).

How the score works#

Every site starts at 100. A failing check takes off 15 points and a warning 5, multiplied by the check's weight (high 1.5, medium 1, low 0.4). No group can take off more than 40 points, so one noisy area cannot flatten the score.

9 checks can be critical, such as fatal errors in the last 24 hours or an expired certificate. When one of them fails in that serious way, the score is capped at 69, so a high number can never sit next to a broken site. Checks that could not be measured on your server, or that do not apply, are left out, and no score is shown until at least five checks could be measured.

The bands are Healthy (85 to 100), Needs attention (70 to 84) and At risk (below 70). A band is always shown as a word and an icon, never by colour alone. A check you snooze stays on the list but stops counting.

Each check below has a stable address you can link to, for example #log_fatals. The plugin's "How to fix" links open allwpcare.com/fix/<check-id>/, which sends you to the best guide for that check.

Errors#

What your PHP error log says, and whether it is safe. 7 checks.

Check	What it looks at	Runs	Weight	Contacts
Error log availability `log_available`	Finds the PHP error log (WP_DEBUG_LOG, ini error_log, common paths) and says plainly when there is none to watch.	Hourly	Medium	None
Fatal errors `log_fatals` can be critical	Count of PHP fatal errors and uncaught exceptions in the last 24 hours / 7 days; critical if any in the last 24h.	Hourly	High	None
Warnings and notices `log_warnings`	Count of warnings and database errors in the last 24 hours; warns above 50 a day (you can change the number). Notices and deprecations are counted and shown, but do not trigger the warning.	Hourly	Low	None
Noisiest plugin or theme `log_top_offender`	Plugin, theme or WordPress core responsible for most errors, from the file path in each log line.	Hourly	Medium	None
Error log size `log_size`	Warn above 50 MB, fail above 500 MB (a runaway log fills the disk). Never reads the whole file.	Hourly	Medium	None
Error log exposure `log_public` can be critical	Asks your own site for the error log's web address (one request, first bytes only, one redirect followed) and compares what comes back with the start of the real log file. Critical only when they match, so a catch-all or maintenance page that answers 200 is not a leak. Skipped when the log is outside the public folders.	Daily	High	Your own site only
Error display to visitors `debug_display`	Reuses WordPress's debug-mode test. The message says whether errors are shown to visitors or only written to a log file.	Daily	High	None

Scheduled tasks#

Whether WordPress's timer is running and keeping up. Scheduled posts, update checks and many plugins depend on it. 7 checks.

Check	What it looks at	Runs	Weight	Contacts
Scheduled task timing `cron_overdue`	Events overdue by 6 hours or more = warn, 24 hours or more = fail (quiet sites run WP-Cron only when visited, so shorter delays are normal). Lists the hooks and the plugin that owns them.	Hourly	High	None
WordPress scheduler activity `cron_heartbeat` can be critical	Own hourly tick: warns if the last tick is older than 2.5 hours, fails after 24 hours (critical only when WP-Cron is switched off). Judged again every time a screen, the widget, the CLI or the report is opened, so a stopped scheduler shows up even though nothing runs to update it.	Hourly	High	None
WP-Cron configuration `cron_disabled`	Informational: DISABLE_WP_CRON, ALTERNATE_WP_CRON, and whether a server cron job seems to be driving wp-cron.php (inferred from tick regularity).	Daily	Low	None
Scheduled task queue size `cron_queue_size`	Warn above 500 scheduled events or 50 of the same hook (a plugin is scheduling in a loop).	Daily	Low	None
Task schedules in use `cron_unknown_schedule`	Events whose recurrence name is no longer registered (an uninstalled plugin left them behind); they never run again.	Daily	Low	None
Task failures `cron_failed`	Counts WordPress's own cron_reschedule_event_error and cron_unschedule_event_error reports over the last 24 hours; fails at 10 or more.	Hourly	Medium	None
Missed scheduled events (WordPress test) `core_scheduled_events`	Reuses core scheduled_events (missed cron) result; deduplicated against cron_overdue in the score (core one is shown, not scored twice).	Daily	Medium	None

Updates#

What is waiting to be updated, and whether WordPress can still look for updates. 5 checks.

Check	What it looks at	Runs	Weight	Contacts
WordPress updates `update_core` can be critical	Reads the update_core transient (never triggers an update check). A new release is a warning for its first 7 days. A minor (security) release waiting 7 days or more is critical; a major release waiting that long is a failure, not critical.	Daily	High	None
Plugin updates `update_plugins`	Counts pending plugin updates from the transient; warn at 1+, fail at 10+ or when any update has waited 60 days or more.	Daily	Medium	None
Theme updates `update_themes`	Pending theme updates from the transient.	Daily	Low	None
Update checks `update_checks_running`	Warns if the update transients' last_checked is older than 2 days, fails after 7 days (cron dead, wordpress.org blocked, or HTTP blocked).	Daily	Medium	None
Automatic updates `auto_updates`	Reuses core's background updates test. Shown as a note instead of a failure when updates are handled on purpose (AUTOMATIC_UPDATER_DISABLED, WP_AUTO_UPDATE_CORE false, DISALLOW_FILE_MODS, or a Git/SVN checkout).	Daily	Medium	None

Known vulnerabilities#

Off by default. When you switch it on, installed versions are matched against a public list of known security problems. 4 checks.

Check	What it looks at	Runs	Weight	Contacts
Known vulnerabilities: WordPress `vuln_core` can be critical, off by default	Looks the installed core version up in the opt-in vulnerability source.	Daily	High	WPVulnerability, only if you switch it on
Known vulnerabilities: plugins `vuln_plugins` can be critical, off by default	Installed plugin slugs and versions checked against the opt-in source; critical if an active plugin has a high or critical flaw for which a fixed version exists. Unknown when nothing could be looked up.	Daily	High	WPVulnerability, only if you switch it on
Known vulnerabilities: themes `vuln_themes` can be critical, off by default	Same, for installed themes.	Daily	High	WPVulnerability, only if you switch it on
Vulnerability data freshness `vuln_source_fresh` off by default	Warns if the lookup has failed for more than 2 days.	Daily	Low	None

Versions and server#

PHP, database and WordPress versions, with end-of-support dates. 7 checks.

Check	What it looks at	Runs	Weight	Contacts
PHP version `php_version` can be critical	Reuses core's PHP version verdict (is it new enough for WordPress). End-of-support dates are in the PHP support end date check.	Daily	High	None
PHP support end date `php_eol`	Warn within 6 months of the end of security support, and after it. Never critical: many hosts patch an older PHP themselves, and the message says so.	Daily	High	None
Database server version `db_version`	Core sql_server verdict plus the end-of-support date for MySQL/MariaDB from data/eol.json. A version past its end date needs attention but is not critical (hosts often backport fixes).	Daily	Medium	None
WordPress release age `wp_branch_age`	Warn when two or more major releases behind (from the update_core transient, no hardcoded list). Unknown when WordPress has not looked for updates yet.	Daily	Medium	None
PHP extensions `php_extensions`	Reuses core php_extensions.	Daily	Low	None
Opcode cache `opcode_cache`	Reuses core opcode_cache.	Daily	Low	None
PHP memory limit `wp_memory_limit`	Warn under 128M, fail under 64M (the limit PHP gives each request).	Daily	Low	None

Storage and growth#

Disk space, uploads, the database and autoloaded options, with growth over time. 5 checks.

Check	What it looks at	Runs	Weight	Contacts
Free disk space `disk_free`	disk_free_space() on the WordPress root: warn under 10%, and a stronger warning under 5% or 200 MB free. Never critical, because on shared hosting this is the whole server disk. Unknown when the function is disabled.	Daily	High	None
Uploads size and growth `uploads_size`	Chunked directory walk (time-sliced, resumes next run, never follows links). Warn on growth above 40% in 30 days with more than 500 MB added.	Daily	Low	None
Database size and growth `db_size`	One information_schema query. Top 5 tables; warn on rapid growth (50% and 200 MB in 30 days).	Daily	Low	None
Autoloaded options `autoload_size`	Core autoloaded_options verdict (800 KB limit, filterable) plus the 10 biggest autoloaded options with their likely plugin.	Daily	Medium	None
Expired temporary entries `transients_bloat`	Count of expired transients left in the options table; warns above 1,000. Advice only, the plugin never deletes anything.	Daily	Low	None

Performance#

Caching, and whether the site can call itself. 3 checks.

Check	What it looks at	Runs	Weight	Contacts
Persistent object cache `object_cache`	Reuses core persistent_object_cache. The message says plainly when your site does not need one.	Daily	Low	None
Page cache `page_cache`	Reuses core page_cache (request to the site itself).	Daily	Low	Your own site only
Site calling itself `loopback`	Reuses core loopback_requests (needed for cron spawn, scheduled posts, plugin editor).	Daily	Medium	Your own site only

Security basics#

HTTPS, certificate expiry, search visibility and open registration. 4 checks.

Check	What it looks at	Runs	Weight	Contacts
HTTPS `https`	Reuses core's HTTPS test (request to the site itself).	Daily	High	Your own site only
SSL certificate expiry `ssl_expiry` can be critical	Opens a TLS connection to the site's own host and reads the certificate's notAfter: warn at 21 days, critical at 7 days or less or when expired. The handshake has its own time limit. Skipped for http, localhost and private IPs.	Daily	High	Your own site only
Search engine visibility `search_visibility`	Reuses core search_engine_visibility.	Daily	Medium	None
New user registration `insecure_registration`	Reuses core insecure_registration.	Daily	Medium	None

Email#

Whether the mail your site sends actually leaves. 3 checks.

Check	What it looks at	Runs	Weight	Contacts
Email delivery test `email_test`	Owner-triggered test message with a confirm link (proves delivery, not just wp_mail() true). An unconfirmed test warns after 7 days and goes quiet (a note) after 90 days; a confirmed one is a note again after 90 days.	When you ask	Medium	None
Email send failures `email_failures`	Counts wp_mail_failed events over the last 7 days (tally only, no addresses or bodies stored); warns at 1, fails at 5.	Hourly	Medium	None
Email sending method `email_smtp`	Advice only: detects whether a known SMTP or mail-service plugin is active (on this site, network-wide or must-use), or something takes over wp_mail(); PHP mail() often lands in spam.	Daily	Low	None

Connectivity#

Whether the site can reach WordPress.org and make outgoing requests. 2 checks.

Check	What it looks at	Runs	Weight	Contacts
Connection to WordPress.org `wporg_comm`	Reuses core dotorg_communication.	Daily	Medium	WordPress.org, requested by WordPress itself
Outgoing web requests `http_requests`	Reuses core http_requests (WP_HTTP_BLOCK_EXTERNAL).	Daily	Low	None

Nothing here changes your site#

Checks only read. The plugin explains what it found and links to a fix; it does not apply fixes. The one button that changes anything is "Clear the log file", and only after you confirm. See Privacy and external services for exactly what leaves your site, and WP-CLI to run these from a terminal.