=== Carticy SiteVitals – Security, Speed, Performance & Database Optimization ===
Contributors: carticy, alikhallad
Tags: security, performance, optimization, database, woocommerce
Requires at least: 6.6
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

See which plugin is slowing your site down and fix it in one click. Plus security settings you can turn on right away, with no account.

== Description ==

Most performance plugins tell you your site is slow. Very few tell you why.

SiteVitals measures real visits to your site and shows you which plugin is using the time. When a page takes 1.2 seconds, you get the plugin name, the file, and what it was doing. Not just a number.

It also comes with security settings you can switch on right away. Close the settings attackers check first, limit login attempts, require strong passwords, and get told when a new administrator account appears.

Every switch explains what it does before you turn it on, and every one can be turned back off.

= Free, no account needed =

Twenty-four switches. None of them send anything to us.

**Security**

* Turn off XML-RPC, an old WordPress feature attackers use to guess passwords. You can also keep it and remove only the risky parts.
* Turn off the file editor, so nobody can change your theme or plugin code from inside WordPress.
* Stop people scanning your site to collect your usernames.
* Keep your username off your posts, so only your display name is shown.
* Remove the "Remember Me" box from the login form.
* Limit login attempts. If someone is locked out, the message tells them how long it lasts and who to contact.
* Require strong passwords, and block the common ones attackers try first.
* Get warned when a new administrator account is created.
* Hide the file list in your uploads folder.
* Turn off application passwords. These let apps sign in without using your login page.
* Close new sign-ups if your site does not need them.
* Slow down repeated password reset requests.

**Speed**

* Stop your site notifying itself every time you link to your own posts.
* Remove the emoji script that loads on every page.
* Remove tags from your page code that most sites never use.
* Slow down the admin auto-refresh that runs while you work.
* Stop loading the Dashicons icon font for visitors who are not signed in.
* Save the results of database queries your admin screens repeat.

**Database**

* Limit how many old copies of each post WordPress keeps.
* Keep the background task log shorter so it stops growing.
* Delete temporary data that has expired.

**WooCommerce**

* Block bots at your checkout. This runs on your site and sends nothing to us.
* Hide the WooCommerce status box on your dashboard.
* Turn off WooCommerce marketplace adverts.

**Always running**

* A small counter records how long your pages take, how much memory they use, how many database queries they run, and any errors. It adds up the totals every hour. None of it leaves your site.
* A record of what changed and when, so you can match "the site got slow this week" against "that plugin updated on Tuesday".

= What a free Carticy account adds =

Connect a free account and you get a full check of your site: a health score, a score for each area, and a list of fixes in the order they are worth doing. You also find out if any of your plugins or themes have known security problems. A free account covers one check on one site.

= What paid plans add =

Fourteen more switches, plus monitoring and reports.

**Security**

* Two-step sign-in. Before it turns on, it checks that the code really reached you. It shows your backup codes once, and there is a command to switch it off if you are ever locked out.
* Security headers for your pages, tested on your live site first and only kept if everything still works.
* Automatic updates for plugins with known security problems. If one cannot be updated safely, it is switched off instead.
* A log of security events on your site, with the time each one happened.
* File permission checks that tell you what changed since your last check.
* Stop PHP files running from your uploads folder.
* Stop file lists showing in your uploads folder and every folder inside it.
* Shorter sign-in sessions for accounts that can change the site.

**Speed and database**

* Faster versions of some common slow database queries.
* Autoload optimizer, for the settings WordPress loads on every single page.
* Index manager, which adds the database indexes your queries are missing.
* Delete leftover data from posts, users and comments that were removed.
* WooCommerce: load product options in the background instead of all at once.
* WooCommerce: skip a slow scan on the product edit screen.

**Monitoring and reports**

* The full report: slow queries traced back to the exact file and line, slow code traced back to the plugin that added it, autoload size split up per plugin, and a written summary of what to fix first.
* Reports covering speed, security, SEO and WooCommerce.
* Checks on a schedule, compared against the last one, so you can see what got worse.
* Uptime monitoring and email summaries.
* Checkout reports for WooCommerce stores.

Plans start with Protect: one site, unlimited checks whenever you want, uptime monitoring, and all the switches. Growth adds checkout reports, scheduled deep checks and up to five sites. Agency plans cover ten sites and more. Current prices are at https://carticy.com/sitevitals

== Installation ==

1. Upload the plugin ZIP under Plugins, Add New, Upload. Or install it from the WordPress.org directory.
2. Activate the plugin.
3. Open **SiteVitals** in the admin menu. On the first run you can either connect a Carticy account for a full health report, or skip that and go straight to the Toolkit.
4. Optional: create a free Carticy account at https://carticy.com/sitevitals

== Frequently Asked Questions ==

= Does the plugin work without a Carticy account? =

Yes. Twenty-four switches are yours with no account: the security ones, the speed ones, the database cleanups, WooCommerce checkout bot blocking, the performance counter and the change record. All of it runs on your own site and contacts nobody.

An account adds the full site check and the vulnerability lookups. A paid plan adds fourteen more switches, monitoring and reports.

= Which features need a paid plan? =

The fourteen switches listed under paid plans, plus scheduled checks, uptime monitoring, email summaries, checkout reports and the full report. In the Toolkit each one shows which plan it belongs to, so you can see what is available without being pushed to buy.

= What information is sent to Carticy? =

Nothing until you connect your site. After you connect and run a check, we receive your site address, the names and versions of your plugins and themes, your WordPress, PHP and MySQL versions, and some database numbers such as how many settings and posts you have.

Your content never leaves your site. No posts, no user details, no customer records.

= Is my data private? =

Yes. Your results belong to your Carticy account and we never share them. The plugin can export or delete anything it has saved on your site, which covers GDPR requests, and removing the plugin removes every setting, table and scheduled task it created. The privacy text it adds to your privacy page lists every place data is kept.

= How do I remove the plugin? =

Deactivate and delete it under Plugins, Installed Plugins. The plugin always clears its scheduled tasks, saved results, any upload in progress, and any temporary accounts it created.

Deleting your stored settings and tables is your choice, under Settings, Advanced, "Remove all data on uninstall". This is off to begin with, so that deleting the plugin by mistake during an update cannot erase your history. Turn it on first if you want everything removed. If your site is connected, removing the plugin also tells us to disconnect it. On a multisite network, every site is cleaned the same way.

= Does the plugin contact your servers before I agree? =

No. On a new install with no account connected, activating contacts nobody, opening any screen contacts nobody, and turning on a switch contacts nobody. The first contact happens when you click "Connect to Carticy" or "Run audit". We test this before every release.

= Does the plugin slow down my site? =

The performance counter takes well under 1ms per page, and it runs after your visitor already has the page. Our admin files load only on SiteVitals screens, so every other admin page and your whole public site load none of our JavaScript or CSS.

= Is this a replacement for a security plugin? =

No, and we are not trying to be one. There is no malware scanner here and no firewall. What we do is check the places a scanner does not look, close the settings most sites leave open, and tell you when something changes. Use SiteVitals alongside your security plugin.

== Screenshots ==

1. A finished check. Scores for each area, the actions that would help most, a security list, and real Core Web Vitals. Checks need a connected Carticy account.
2. The dashboard: your health score and how it changed, the fixes worth doing first, uptime, and security warnings for the plugins you have installed.
3. The speed switches, free and with no account. Each one explains what it changes and what it saves, and every switch can be reversed.
4. The security switches, from turning off XML-RPC to watching administrator accounts. Anything WordPress already handles is marked, so you do not do the same job twice.
5. The first run offers two paths: connect a free account for a full health report, or go straight to the Toolkit with no sign-up.
6. Privacy settings. Sharing is off until you turn it on, anonymising is on by default, and every place your data could go is named on the page.
7. Choosing what a check covers. Areas can run together or on their own.

== Changelog ==

= 1.0.1 =
* Improved: audit results are easier to scan, with clearer grouping and labels.
* Improved: one-click fixes open where you need them.
* Improved: Toolkit and Settings save from a single bar, with fewer notices.
* Improved: account, connection and plan details are more accurate.
* Added: clear cached results from the Privacy screen.

= 1.0.0 =
* First public release.

== External Services ==

This plugin connects to one outside service, api.carticy.com, which is our own.

* **What it does:** runs the site check (speed, security, SEO, WooCommerce and page loading), looks up known security problems for your plugins and themes, returns suggested fixes, schedules checks and email summaries, and runs uptime monitoring on paid plans.
* **What we receive:** your site address, the names and versions of your plugins and themes, your WordPress, PHP and MySQL versions, database numbers such as autoload size, setting counts, temporary data counts and post detail counts, and the collected check data listed in the plugin's privacy policy. No content is sent: no posts, no customer records, no comments. The only email address we ever receive is one you type into the optional marketing box below. The site check itself sends no email addresses at all.
* **When it is called:** only after you connect your site to a Carticy account through the first-run screens or the Settings page, and then either run a check, switch on a service such as email summaries, uptime or scheduled checks, or the once-a-day background call runs for a connected site. A new install with no connection makes no calls at all, apart from the box below.
* **Optional marketing box:** the first-run screens offer an unticked box for occasional product tips by email. Only if you tick it and enter an address does that address reach us. Leave it alone and nothing is sent. This is the one call an unconnected install can make, and only because you asked for it.
* **Terms of service:** https://carticy.com/terms
* **Privacy policy:** https://carticy.com/privacy

Nothing else contacts an outside server. Every Toolkit switch, checkout bot blocking, temporary data cleanup, admin caching, the change record and the performance counter all run on your own site.
