WordPress & WooCommerce diagnostics
Every WordPress site hides problems. Some of them are already inside.
SiteVitals traces every slow response back to the plugin, query, or config behind it, then keeps reading past the files, into the database rows, administrator accounts and cloaked pages a scanner never looks at. Lighthouse gives you a score. This is the diagnosis.
- Free plan, no account needed
- Unlimited audits from $19/mo billed annually
- Nothing changes until you switch it on
Live diagnosis
Run a diagnosis. Watch the real problems surface.
This is the same audit SiteVitals runs on your site. Pick a site type and press run. It reads performance, database, security, and store data in one pass, then ranks what to fix first.
Don't take our word for it. Run the same trace we run on your site.
Ready to trace a page load
Auditing a WooCommerce store across performance, database, WooCommerce, and checkout.
Auditing a WordPress site across performance, backend, database, security, and SEO.
Reading site data from your-store.com ok
Profiling 1,216 requests over the last 48 hours ok
Building the callback waterfall across 9 plugins ok
Replaying checkout across 3 payment gateways ok
Checking HPOS status and order storage ok
Ranking findings by impact on revenue
Reading site data from your-site.com ok
Profiling PHP callbacks across 1,204 requests ok
Building the callback waterfall across 6 plugins ok
Scanning wp_options autoload, 45,120 rows ok
Checking OPcache and object cache status ok
Ranking findings by impact
Audit insights, 54 / 100
1 critical 2 high 1 easy fix
One thing is doing most of the damage. About 58% of this page's load time comes from a single plugin task, WC_Filters\Override::render_wcf_elements (34.1s). Fix that first.
Where the time went, by plugin
Time budget for this page
- PHP 66%
- Database 22%
- External HTTP 8%
- Overhead 4%
CRITICAL One plugin callback runs for 34 seconds
WC_Filters render_wcf_elements = 58% of the request
Fix: Defer filter rendering or replace the plugin
Dominates every category page
HIGH Checkout blocked by a synchronous gateway call
Payment step waits 2.1s on the gateway handshake
Fix: Move the gateway handshake off the render path
Every checkout, every customer
HIGH Orders still on legacy postmeta, HPOS off
Order queries scan wp_postmeta, 180k rows
Fix: Enable High-Performance Order Storage
Slower orders and reports
EASY FIX 904 MB reclaimable in the database
12,400 stale sessions and expired transients
Fix: Run the scheduled cleanup
Five-minute fix
Audit insights, 63 / 100
1 critical 2 high 1 easy fix
One thing is doing most of the damage. About 37% of this page's load time comes from a single plugin task, plugin external API calls on wp_loaded (1.41s). Fix that first.
Where the time went, by plugin
Time budget for this page
- PHP 48%
- Database 24%
- External HTTP 22%
- Overhead 6%
CRITICAL OPcache memory exhausted
256MB allocated, 72 bytes free, 7,502 scripts cached
Fix: Raise opcache.memory_consumption to 512MB
Affects every cache-miss request
HIGH Plugin blocks render with external API calls
3 synchronous calls, avg 1.4s each, no caching
Fix: Cache responses with a one-hour transient
Adds 1.4s to every page load
HIGH Autoload scanning 45,000 rows
4.2MB autoloaded on expired data
Fix: Disable autoload on stale options
Adds 0.8s per request
EASY FIX 6,847 expired transients
Stale rows never cleaned up
Fix: Schedule a weekly cleanup
Five-minute fix
Everything below appears in one report, no tab-hunting. Figures are representative of real audits; yours runs on your own traffic.
Already inside
Malware scanners read your files. The thing that survives the cleanup lives in your database.
Your security plugin does two things well. It blocks bad requests at the door, and it reads the files on disk. Neither of those reaches a row in your database, which is where the thing that puts the file back usually lives. SiteVitals reads that every day and tells you exactly what is there and where.
We read the files too: your WordPress core against the official checksums, your plugins against theirs where published, your uploads folder, and the must-use plugins and drop-ins that load on every single request. What makes this section different is that we keep going after the files are clean.
Your security plugin watches the front door. This checks whether someone is already inside.
What a scanner or firewall covers
- Bad requests blocked at the door, before they reach WordPress.
- Files on disk read and compared against known malware.
- The bad file quarantined, and a report saying it is gone.
What is left unchecked after that
- The database row that writes the file back tonight.
- An account that gained administrator power with nobody signed in to grant it.
- A page serving different content to Googlebot than it serves to you.
Keep your scanner. This is the layer underneath it.
Hidden administrators
Accounts holding full admin power that never appear as administrators in your user list, because the capabilities were written straight into the database instead of assigning the role.
wp_usermeta · capabilities set directly, role absent
Triggers that rewrite your data
A database trigger sitting on your users, options or posts table puts the infection back after you have deleted every last bad file.
AFTER INSERT ON wp_users · reinfection layer
Card-skimmer code in the database
Snippet and injector tables carrying script that loads a remote origin or beacons data off your checkout page. No file on disk to find.
snippet table · remote origin on checkout
Loaders that leave nothing behind
Code that decodes a hidden payload, runs it, and deletes the evidence before the page finishes loading. There is no file left to find afterwards, which is exactly the point of it.
decode · run · delete, in one request
Where the line is
These checks run every day, and they tell you exactly what is there and where it lives. Removing the malware and cleaning the files is still a job for you or your security plugin. We find it and hand you the evidence.
Administrator guard Free on every plan, account or not
Every WordPress break-in ends the same way. Some account walks out with administrator power.
Exploits change every month. What they are reaching for does not. SiteVitals watches how accounts gain administrator access, and if one gains it while nobody was signed in to grant it, it can hold that account inert and ask you first. Because it watches the moment those permissions are granted, it does not wait for a scan to come round.
Nothing deleted, nothing rewritten. One click puts it back if you recognise the person.
Monitor: watch and tell me Protect: hold it until I look Your call, either way.
Account held for review
- Account wp_support_04
- Gained Administrator
- Admin signed in No session
- Status Held, nothing deleted
Keep it held I know them, restore
Representative of a real alert. The guard acts the moment an account gains administrator power.
A score is not a diagnosis
Why your site feels slow when the score says 90
Synthetic tests hit your cache. Your real visitors do not. That gap is where the slow pages live.
So we do not just re-run the lab test. Every audit pulls Chrome's real-user data (CrUX) for your site and puts it next to lab probes on the same card, mobile and desktop, so you can see the gap instead of arguing about it.
What speed tools tell you
"Consider reducing unused JavaScript and leveraging browser caching for improved performance."
Vague metrics, no root cause
What SiteVitals traces
- +1.2s A plugin makes 3 external API calls on every page load. Your server blocks and waits.
- +0.8s The database scans 45,000 rows because autoload is enabled on expired data.
Plain language. Exact cause. A specific fix.
Diagnose, understand, fix
Most tools stop at half the job
Speed plugins apply fixes blindly and hide what they changed. Developer profilers show the problem but leave you to solve it. SiteVitals does the whole loop, in plain language, and shows its work.
Trace the real cause
Reads your site as it actually runs, not a cache-warmed synthetic test. Turn the profiler on and every slow response is tied to the exact plugin, query, hook, or external call behind it.
Read it in plain English
No black box and no wall of jargon. Each finding says what it is, what it costs, and exactly what to change, ranked so you always know the one thing to do next.
Apply safe fixes in one click
The built-in toolkit applies vetted optimizations for you. Every one is reversible, so it is one click to turn on and one click to undo. Nothing changes until you say so. Twenty-four tweaks are on the free plan; a plan adds fourteen more, the ones that can break a site if they are applied wrong. A tag means that fix needs a plan.
And then prove it worked
Run an audit before a change and after it. You get the difference, not just a new number: which findings cleared, which ones appeared, and what it did to your load time.
Copy any finding as text. Every finding, and the whole report, copies out as clean Markdown — straight into a ticket, a client email, or whatever AI assistant your developer works with.
For WooCommerce
Built for WordPress. Tuned for WooCommerce.
SiteVitals runs on any WordPress site. On a store it looks where money is actually made or lost, from the payment step to order storage. This is the work we do best.
Work out what one second at your checkout is worth to you. Then look at what is sitting in front of your payment button.
WooCommerce health
last 30 days
50/100
- Active subscriptions 160 · $9,609 MRR
- Out of stock 136 · 40.6% of catalog
- Expired sessions 15,590 · 94.6%
User journey & conversion
live session snapshot
- Top traffic source Organic · $143.40 AOV
- Top device Mobile · $84.80 AOV
- Low products per page Only 12 shown with 335 total products
Checkout flow
We replay the checkout step by step and flag anything blocking the payment button, the most expensive place a store can be slow.
Payment gateways
Gateway handshakes that run on the render path add seconds at the worst moment. We measure each one and show you which is slow.
HPOS & order storage
We check whether orders still live in legacy postmeta and whether High-Performance Order Storage is ready to turn on.
Cart & sessions
Uncached cart fragments and expired sessions quietly weigh down every page. We catch both and tell you how to clean them up.
Product schema
Missing GTIN and brand data weakens how your products show up in search. We find the gaps across your catalog.
Checkout analytics Growth and up
See where checkouts fail over time, which errors spike, and when, so you can fix the ones costing you the most orders.
Checkout protection · WooCommerce
Card-testing bots don't fill in your checkout form
They post straight to your store's checkout API, which is why reCAPTCHA never sees them. SiteVitals checks that every checkout submission came from a browser that actually loaded your checkout page — proof your site issues and signs itself, so a script can't fabricate it.
It calibrates before it acts. It won't block on a checkout it has never seen working, and if that proof stops arriving after a theme or plugin update, blocking pauses itself and tells you rather than turning real customers away.
You choose monitor or protect the first time you open it. Monitor logs and blocks nothing, so you can watch a week of real traffic before you hand it the keys.
Where the line is: it separates scripts that never loaded your checkout from real shoppers. A bot driving a full browser needs a bot-mitigation service as well.
Free on every plan, account or not
Blocked checkout attempts
last 7 days
1,284 submissions with no proof of a real checkout page
- POST /?wc-ajax=checkout · 41.98.x.x BLOCKED
- POST /?wc-ajax=checkout · 185.22.x.x BLOCKED
- Checkout by a real shopper · proof valid ALLOWED
Attempts are recorded on your own server and kept for 30 days. Your checkout data never reaches Carticy. Figures here are representative of real stores.
Real findings, real sites
The problems hiding in production right now
These are the kinds of issues SiteVitals surfaces on live sites. None of them show up in a speed score.
PHP script cache completely full
Every uncached page recompiles from scratch, adding seconds your synthetic tests never see.
256MB allocated, 72 bytes free
Checkout blocked by a gateway call
A payment gateway handshake runs on the render path, so the checkout page waits before it can respond.
2.1s at the payment step
External API calls blocking render
A plugin makes three uncached calls to a third party on every page load, and your server waits for all of them.
3 blocking calls, 1.4s each
Bot traffic hammering the login
Automated requests pound wp-login and the REST API, burning server capacity and skewing your analytics.
1,284 bot requests this week, 3 headers missing
6,800 expired transients
Years of temporary data never cleaned up, dragging on every autoloaded query. A five-minute cleanup.
6,847 rows, 4.2MB stale data
What is hiding in your site?
Run one audit and get every finding ranked by impact, with the exact fix for each.
See what's hidingDatabase
You already know which plugin is slowing your site. Now see which one is eating your database.
The report breaks your database down by the plugin that put the data there, and itemises what can be recovered: leftover tables from plugins you removed, expired cache, options nobody reads any more.
One real audit came back with 7.64 MB recoverable — 39.9% of the entire database.
Database size by plugin
137 tables
7.64 MB recoverable 39.9% of the database
Security checklist
Thirty-seven checks, each one a plain pass or fail
Alongside the findings you get a checklist you can read top to bottom: what is already right, what is not, and what to do about each one. It is the page an agency screenshots for a client.
The list below is from one real audit: 37 checks, 19 passing, 18 to review.
Security checklist
19 passing 18 to review
- XML-RPC accessible unprotected FAIL
- Add Strict-Transport-Security header FAIL
- Add X-Frame-Options header FAIL
- REST API enumeration possible FAIL
- File editing enabled FAIL
- SSL certificate valid and current PASS
- Directory listing disabled PASS
- …and 30 more, each with the fix underneath it. Every check is shown on every plan; a tag means the one-click fix for that row needs one.
Cloaking check
What Google sees is not always what you see
A compromised site often looks perfectly normal to its owner. The spam is served only to search engines, so your rankings and your traffic go while every page you open looks fine. During an audit we ask a few of your pages twice, once as an ordinary visitor and once as Googlebot, and compare the answers.
Plenty of sites change between one visit and the next, so we measure how your page normally varies before we say anything, and check twice before we do. A rotating homepage is not an accusation.
/best-sellers
DIFFERENT CONTENTServed to a visitor
<title>Best sellers — Northwind</title>
42 products · your own catalogue
Served to Googlebot
<title>Cheap replica watches</title>
318 links to a domain you do not own
Representative example. Confirmed on a repeat check before you are told. If a firewall or CDN refuses the crawler request, we report it as inconclusive rather than as a problem with your site.
One audit, one report
Seven dimensions, checked in a single run
You pick which of the seven to run, and you get one clear report — not seven dashboards to babysit.
Performance
Your real load time next to a lab probe, Core Web Vitals, and the pages that are actually slowest.
Frontend
Inline code bloat, render-blocking resources, image failures, and the gap from synthetic to real. Optional deep speed runs measure your real pages — cart and checkout included — from a real device and location.
Database
Orphaned tables, duplicate queries, bloated options, and transients that slow every page.
Backend
Which plugins and callbacks eat your execution time, plus whether OPcache, object cache, page cache and your CDN are actually working, not just installed.
WooCommerce
HPOS readiness, attribute lookup tables, sessions, gateways, and checkout bottlenecks.
Security
Security headers, SSL, bot and login-attack traffic, plugin vulnerabilities, and file permissions.
SEO
Schema markup, sitemaps, canonical tags, crawl depth, and metadata consistency.
Between audits
Your site doesn’t only break while you’re watching
You run an audit when you want one. These keep going in between, and come to you when something changes.
We watch your site from outside
Our servers check your site every five minutes. If it goes down you get an email or a Slack message, and every incident stays on record, with 90 days of history to look back through.
Hear about a vulnerability early
Every day we check the vulnerability feeds against the versions you actually have installed. You hear about it because it affects a plugin you have — not because you happened to run a scan that week. Included from the free plan — it starts the day you connect.
Audits that run themselves
A weekly audit runs on its own, so your score and trends stay current without anyone remembering to press the button.
You can see what changed
Your site is never the same two weeks running. The plugin keeps its own record of what was installed and when — free, on the site itself — so when something gets slower you can see what changed around it instead of guessing.
A digest, on your schedule
Weekly, every two weeks, or monthly: a short summary of what changed and what needs attention, by email or into Slack.
How it works
From install to your first diagnosis in minutes
No consultants, no configuration. Install it, press run, read the report.
-
1
Install the plugin
Upload it like any WordPress plugin. Under a minute, works on any host, and the free plan needs no account.
-
2
Run your first audit
Create your free account — no card — and your welcome scan comes back in minutes: your health score, a score per section, and every finding ranked by the impact it is having. Your score and top fixes also sit on your WordPress dashboard, so you see them without going looking.
-
3
Go deeper if you want to
Optional. Switch the profiler on and it watches real traffic for a day or two, so your next audit can name the exact plugin, query, hook, or external call behind a slow response.
The math
Consultant-grade depth, without the consultant timeline
We are not replacing good consultants. We do the diagnostic work so they can focus on the fixes.
| What is being compared | Manual audit | SiteVitals |
|---|---|---|
| Time to first diagnosis | One to two weeks | Minutes after you install |
| What it looks at | A synthetic test and some spot checks | Your own site, its own data, its own traffic |
| Root cause | Depends who you hire | Named: the exact plugin, query, hook, or external call |
| Fixes | A list of recommendations to act on yourself | One-click fixes for the safe ones, instructions for the rest |
| Running it again | Pay again for every audit | Unlimited audits, whenever you want |
| Cost | $1,000 to $3,000+ per audit | From $19/mo billed annually ($24 monthly) |
| WooCommerce depth | Only if they know Woo | Built in: HPOS, checkout, gateways, product data |
| Who can read it | A developer's report, if you get one | Plain language, ranked — with the technical detail underneath when you want it |
| When you're not looking | Nothing | Uptime checks, daily vulnerability matching, and a record of what changed |
- Nothing changes until you say so Audits only read. The Toolkit and Optimizer act on what you switch on, one click undoes any of it, and every database index we add carries our own name so it can be found and removed later.
- Built to stay out of the way Everyday monitoring is light enough to leave running. The deep profiler is optional, and you switch it off when you're done.
- Your checkout data stays with you Blocked bot attempts are recorded on your own server for 30 days. They are never sent to Carticy.
- Evidence, not guesses Every finding names what it is, what it is costing you, and the exact fix.
What happens in your first ten minutes
No setup call, no configuration file.
- 1 Minute one The plugin is installed and the Toolkit, checkout protection and local monitoring are available. Still no account.
- 2 Minutes two to five You create the free account (no card, under a minute) and your welcome scan runs. Health score, a score per section, and findings ranked by what they cost you.
- 3 Minutes five to ten You apply the one-click fixes you agree with. On any paid plan you re-run the audit straight away and see exactly what they bought you — which findings cleared and what it did to your load time.
For agencies and freelancers
Your account, your reports, your call
You install SiteVitals on a client's site. You decide what they see. Every result can stay with you, or you can share the dashboard — and either way their own admins keep the free local tools they'd have anyway.
All administrators
Every admin of the site can view results and manage audits. For a site you run yourself.
Others can view, only I manage
Other admins see scores and insights, but only you can run audits, change schedules, or touch the account. For when clients or developers share wp-admin.
Only I see Carticy results
Other admins only see the local features — Toolkit and performance monitoring. Audits, insights, and the account stay hidden. For when you deliver your own reports.
The report leaves as text
A copy button on every finding, and Export as markdown for the whole report. It pastes straight into a ticket, a client email, or an AI assistant.
Runs on multisite
Connect every subsite from the network admin in one pass, see which are connected at a glance, and watch your plan quota as you go. Each connected subsite uses one site slot.
Your data
Until you connect an account, the plugin makes no outbound requests at all
Not minimal. None. And once you do connect, you can see every destination your data can reach, by name, on the plugin’s own Privacy screen.
- Consent is off until you turn it on Audit consent starts off. Nothing leaves the site before you agree to it.
- Anonymised by default URLs, server paths and query parameters are anonymised out of the box, and visitor IPs are network-masked.
- Every destination, named Carticy, PageSpeed Insights, Chrome UX Report, the WordPress vulnerability database, your own host for self-checks, and AI providers only if you add the AI report.
- Your checkout data stays put Blocked bot attempts are recorded on your own server for 30 days. They are never sent to Carticy.
- Take it all with you One button exports everything the plugin has stored, as JSON.
- Leave and nothing is held Cancel and the local tools keep working. You can ask for your history to be erased permanently, with a 14-day grace period.
Pricing
Simple, transparent pricing
Unlimited audits on every paid plan. Prices are per month; paying annually works out to two months free.
This isn’t a maintenance dashboard. It’s the diagnostic work — the part you normally pay a specialist four figures for, once.
Free
Free forever, no account
Free forever, no account
- 1 site
- 1 free welcome scan
- Site health score and top fixes
- Upgrade any time
No card, no account, no expiry
Protect
$228/year billed yearly
$24 billed monthly
- 1 site
- Unlimited on-demand audits
- Uptime and regression monitoring
- One-click fixes and optimizer
- 1 AI PDF report per month
- 1 WebPageTest run per month
Cancel anytime
Growth
$684/year billed yearly
$69 billed monthly
- Everything in Protect
- Up to 5 connected sites
- Checkout analytics
- Scheduled deep audits
- 4 AI PDF reports per month
- 4 WebPageTest runs per month
Cancel anytime
Agency
$1,488/year billed yearly
$149 billed monthly
- Everything in Growth
- Up to 10 connected sites
- 10 AI PDF reports per month
- 8 WebPageTest runs per month
- Priority support
- 6 month data retention
Cancel anytime
$3,492/year billed yearly
$349 billed monthly
- Everything in Agency S
- Up to 25 connected sites
- 25 AI PDF reports per month
- 15 WebPageTest runs per month
- 12 month data retention
Cancel anytime
$6,492/year billed yearly
$649 billed monthly
- Everything in Agency M
- Up to 50 connected sites
- 50 AI PDF reports per month
- 30 WebPageTest runs per month
Cancel anytime
Annual billing by arrangement
$1,199 billed monthly
- Everything in Agency L
- Up to 100 connected sites
- 100 AI PDF reports per month
- 60 WebPageTest runs per month
- 24 month data retention
- Custom annual pricing
Cancel anytime
No account needed to start. On a store the free Toolkit reaches into WooCommerce too — checkout bot protection, forced-AJAX variations and Action Scheduler retention. The Toolkit, checkout bot protection and local performance monitoring work the moment the plugin is installed. Create a free account and you also get one welcome scan with your health score and top fixes.
The AI audit report, explained
A written PDF of a completed audit's findings, generated on request. It is the document you hand to a client or a developer instead of a screenshot. Optional add-on, metered by plan.
The findings are never paywalled
Every audit's full results are readable in the plugin on every plan, and that is where you normally work through them. The PDF is for sending, not for seeing.
Audits are unlimited on every paid plan. Only the heavy add-ons are metered: each plan includes a monthly allowance of AI PDF reports and WebPageTest runs. Need more? Top up any time with non-expiring packs. +10 AI reports ($49), or +10 WebPageTest runs ($49). Agencies run every site from one account, up to 100 sites. Installing SiteVitals on a client site does not hand them your account, and it does not take away the free local features their own users already have.
Questions
Straight answers
Will this slow my site down?
Everyday monitoring is light enough to leave running and your visitors will not notice it. The deep profiler is heavier, which is why it is optional: turn it on when you want request-level detail, and off once you have it.
Does it change anything on my site?
Not on its own. Audits only read. Toolkit and Optimizer changes happen when you switch them on, and every one of them is reversible with a single click.
Do I need a developer?
Not to read the report or apply the one-click fixes. Deeper server and code work does need one, and the report is written so you can hand it straight over.
What if I only have one site?
That is exactly what Protect is for: one site, unlimited audits, uptime monitoring and the optimizer, from $19/mo billed annually ($24 monthly).
What happens if I cancel?
Your site keeps working. The plugin's local features carry on running; the ones that need your account stop. Nothing breaks and nothing is held hostage.
What's the difference between the free version and a paid plan?
The local tools are yours forever with no account: the Toolkit, checkout bot protection, performance monitoring, and the change log. A free account adds one welcome scan. Paid plans are what make audits unlimited and turn on monitoring, the optimizer, and scheduled runs.
Can I use it on client sites?
Yes, and you decide what the client sees: everything, view-only, or nothing at all while you deliver your own reports. Their own admins keep the free local tools either way.
Does it work on multisite?
Yes. Connect every subsite from the network admin in one pass; each connected subsite uses one site slot on your plan.
Do you need admin access to my site?
No. You install the plugin and it runs inside your own WordPress. We never ask for a login.
Do I need WooCommerce?
No. Everything works on any WordPress site; the store-specific checks simply appear when WooCommerce is active.
What are the requirements?
WordPress 6.6 or newer and PHP 7.4 or newer.
How long does an audit take?
Minutes. You start it and the report comes back on its own — you do not have to sit and watch it.
Does it work with my host, cache and CDN?
Yes. It runs on standard WordPress hosting and sits alongside page caches and CDNs without fighting them.
What actually gets sent to you?
Nothing at all until you connect an account. After that, an audit sends site and server versions, which plugins and themes are installed, and database metrics. It never sends your posts, your customers or your orders.
Will it clash with my security plugin?
It sits alongside one rather than replacing it: your security plugin watches the front door, SiteVitals checks the database behind it. Login protection is the one feature that can overlap, so leave that switched off and keep the rest.
What happens to my data if I cancel?
Your site keeps working and the local features carry on. Account-connected features stop, and your audit history stays available while the account exists; you can ask for it to be erased permanently, with a 14-day grace period in case you change your mind.
How is this different from Lighthouse or PageSpeed?
Synthetic tests hit your cache and cannot see server-side problems like blocking API calls, database bloat or an exhausted OPcache. SiteVitals reads your site from the inside and names the cause.
Find out what's actually slowing you down
Install the plugin and your first audit comes back in minutes: your score, what each problem is costing you, and the exact fix. Nothing on your site changes until you switch it on.
Free plan with no account. Unlimited audits from $19/mo billed annually ($24 monthly). Cancel anytime.
From $19/mo Free plan, no account
Start free