DigiAudit

What it does

It runs from inside the site, so it sees what an outside scanner cannot: plugin and theme versions, wp-config.php, scheduled tasks, the database and the error log, as well as the headers, certificate and pages a visitor gets. Every check only reads; nothing on the site is changed. The admin screens, e-mails and report are in French.

• A score and a grade

  Out of 100 with a grade from A to E, a score per category, and the change since the previous scan.

• 56 checks in four groups

  Security (23), performance (11), SEO (14) and maintenance (8) — from abandoned plugins and exposed backups to the sitemap and overdue cron jobs.

• Written for the owner

  Each problem says what was found, why it matters in business terms, the recommended fix and whether that is a quick, standard or advanced job.

• A quote in one click

  Tick the problems, fill in a short form and send it. The owner gets a reference number and an acknowledgement by e-mail.

• A weekly scan

  In the background through WP-Cron, with an e-mail when a new critical problem appears or the score drops by 10 points or more.

• A printable report

  The full result on one page, to save as PDF from the browser, plus a dashboard widget and a badge in the admin menu.

The full manual: every screen, setting and check, step by step

What it needs

WordPress

5.8 or newer

PHP

7.4 or newer

PHP extensions

No extension beyond a standard PHP build.

Install it

cd /path/to/wordpress/wp-content/plugins \
  && curl -fL -O https://github.com/digipacket-net/digiaudit/releases/download/v1.0.0/digiaudit.zip \
  && echo "494143b7c4396e50c1f516f8668d18c15e5f0ac5f114e8bf8187cbd8630533d8  digiaudit.zip" | sha256sum -c - \
  && unzip -q digiaudit.zip \
  && rm digiaudit.zip

wp plugin activate digiaudit --path=/path/to/wordpress

Why the commands look like this

• Why -f is not optional

  Without it, curl writes the server's error page into your file and exits 0. You unzip an HTML document into wp-content/plugins and WordPress shows a broken plugin. With -f, curl writes nothing and exits 22.

• Why the checksum is printed here

  A hash served next to the file only proves the download was not corrupted in transit. This page is a second channel: if the number here and the number on the file agree, both would have had to be changed.

• Why the steps are chained with &&

  A semicolon runs the next command whether or not the last one worked. With &&, a failed download or a failed checksum stops the chain before anything is written into your plugins directory.

Verify the download

# GNU coreutils, on a Linux server
echo "494143b7c4396e50c1f516f8668d18c15e5f0ac5f114e8bf8187cbd8630533d8  digiaudit.zip" | sha256sum -c -

# macOS, and anywhere sha256sum is missing
echo "494143b7c4396e50c1f516f8668d18c15e5f0ac5f114e8bf8187cbd8630533d8  digiaudit.zip" | shasum -a 256 -c

Always the newest release

The pinned URL above is the one to use in documentation and in a change you want to be able to repeat. In a provisioning script you usually want whatever is current, and there is a trap in the obvious way of asking for it.

Ask the API which asset the latest release actually publishes, then download that:

url=$(curl -fsSL https://api.github.com/repos/digipacket-net/digiaudit/releases/latest \
  | grep -o '"browser_download_url": *"[^"]*\.zip"' \
  | cut -d'"' -f4)

curl -fL -O "$url"

Update it

Removing the folder first is safe for your data: scans, history, settings and the quote log are in the WordPress database. It does replace config.php — if you changed it, apply the change again, or move it to the digipacket_audit_agency_config filter in a must-use plugin, where an update cannot reach it.

cd /path/to/wordpress/wp-content/plugins \
  && curl -fL -O https://github.com/digipacket-net/digiaudit/releases/download/v1.0.0/digiaudit.zip \
  && echo "494143b7c4396e50c1f516f8668d18c15e5f0ac5f114e8bf8187cbd8630533d8  digiaudit.zip" | sha256sum -c - \
  && rm -rf digiaudit \
  && unzip -q digiaudit.zip \
  && rm digiaudit.zip \
  && wp plugin activate digiaudit --path=/path/to/wordpress

Remove it

wp plugin deactivate digiaudit --path=/path/to/wordpress \
  && wp plugin delete digiaudit --path=/path/to/wordpress

What it sends

A scan makes one kind of outside request, and nothing else leaves the site until the owner acts. This is the list a privacy policy needs.

• During a scan: the slug of each installed plugin, up to 50, to api.wordpress.org — to learn whether it was closed or has not been updated for two years. Answers are kept for three days. Every other request in a scan goes to the site itself.
• When the owner sends a quote request, and only after they tick the consent box: their name, company, e-mail, phone, preferred contact method, urgency and message, the problems they selected and the others found, the score, and the site's environment — address, WordPress and PHP versions, theme and active plugins. It goes by e-mail, through the site's own wp_mail(), to [email protected].
• When the owner has turned on proactive support — it is off by default — and a weekly scan finds a new critical problem: the new problems, the score, the WordPress and PHP versions and the contact details from the plugin's settings, by e-mail to the same address.
• Nothing goes to a webhook unless one is written into config.php. The published release has none.

What it does not do

Written down for the same reason as everything else on this page: finding out after you have installed it is worse.

• It finds problems; it does not fix them. Every check only reads, and the fixes are the work a quote request asks us for.
• The interface, the e-mails and the report are in French. The strings are translation-ready under the digiaudit text domain, but no translation ships.
• A quote request is an e-mail sent by the site's own server. Where that server cannot send mail, the request is logged as failed in the plugin's history and does not reach us — the "Fiabilité des e-mails" check is there to warn about exactly that.
• The weekly scan runs on WP-Cron, which runs when the site has visitors. On a site with almost none, it runs late.
• It checks from the inside. Where the server refuses requests to its own address, the checks that need one are marked "Non vérifié" and left out of the score rather than guessed. It does not scan files for malware.

If a command fails