NPC Maintenance Inspector

Changelog

1.0.5 (2026-10-24)

• Suspicious Files: a PHP file hidden in a known plugin folder could pass as harmless. Files in folders such as uploads/updraft/ are treated as plugin files only when they contain nothing but comments, or start with a recognised stop statement such as exit;. The comment check removed single-line comments up to the end of the line, but in PHP a single-line comment ends at the closing tag (and at a carriage return). A file with a “Silence is golden” comment followed by a closing tag and a second PHP block was treated as comments only, so the code in the second block was never reported. The check now uses PHP’s own tokenizer. When the tokenizer extension is not available, a character-by-character scanner that follows the same rules is used instead of regular expressions. #[...] lines are no longer treated as comments, because they are attributes (code) on PHP 8.
• Suspicious Files: a file that starts with an if ( ! defined( 'ABSPATH' ) ) guard was accepted when the guard only began with “exit” or “die”, such as a call to a function named exitnow() or exit( print( ... ) ). The guard must now be a plain exit; / die;, optionally with a literal message: a single-quoted string, or a double-quoted string without $ (a double-quoted string can run code inside {$...}).
• When the SSL certificate could not be checked (connection failed or the certificate could not be read), the result is now a warning in the overall grade and on the card instead of being counted as OK.
• The overall grade, the AI report input and the history list now use the same per-item status. Previously the AI report received raw values such as update_available and unknown, a File Integrity result whose differences were all in files known to differ was passed to the AI as a warning while the card and the grade showed OK, and the history list showed the grade saved at the time while the latest result was re-evaluated.
• The AI report no longer states that notices from other plugins have no effect on the site, and no longer lists them under “no issues”. They are shown in a separate reference section, because the diagnosis does not check their effect. The AI input now starts with a summary of each item’s status, and the AI is asked to list only items whose status is OK under “no issues” (it used to move the parts of a warning item that were fine there), and not to describe checksum differences as false positives or probably safe.
• Admin screen texts are now translated. The JavaScript translation file (languages/npc-maintenance-inspector-ja-npc-maintenance-inspector-admin.json) was missing, so the Japanese admin screen showed the JavaScript texts in English. Three untranslated texts around the debug.log backup are now translated as well.
• A saved result without the SSL item no longer stops the results screen from rendering, and a saved result with missing items no longer stops the history list from rendering.
• An AI report that was cut off at the length limit is no longer saved as complete. When you generate it manually, you are asked to generate it again; a scheduled run sends the notification without the AI report, as with other AI errors. The length limit was raised from 2000 to 4000 tokens, the request timeout from 60 to 80 seconds, and the AI is asked to keep the report within about 2,500 Japanese characters (in a test with many warnings, the report used to stop in the middle even at 4000 tokens).
• The readme now describes the WordPress.org checksum request made by the File Integrity check. It previously said the AI report was the only external connection.

1.0.4 (2026-10-13)

• File Integrity no longer reports “OK” when nothing was actually checked. checked_files used to be the number of entries in the WordPress.org checksum list, not the number of files compared, and target files that were missing on the site were skipped silently. A site where none of the target files could be read was still reported as “OK”. checked_files is now the number of files actually read and compared. Files outside the check scope (excluded_count) and target files that are missing or unreadable (failed_files / failed_count) are reported separately.
• If any target file is missing or unreadable, or no file could be checked at all, File Integrity is now a warning instead of OK.
• When the checksum data cannot be retrieved from WordPress.org, File Integrity is now counted as a warning in the overall grade and in the AI report input instead of as OK, and the card shows the reason instead of “No changes to core files.”
• An unreadable core file is no longer reported as “modified, no suspicious code”. It is listed as a file that could not be checked.
• A modified file whose contents could not be scanned for suspicious code (unreadable or larger than 1 MB) is no longer described as having no suspicious code. It is counted in unscanned_count, and the result is not downgraded to OK.
• The File Integrity card now says “No changes in the checked core files.” and shows how many files were checked and how many were outside the check scope, missing, unreadable or not scanned. The same counts are passed to the AI report.
• Suspicious Files: unreadable PHP files and folders in the uploads directory are now reported separately (unreadable_files / unreadable_dirs) and keep the result at warning. Previously an unreadable folder stopped the whole diagnosis with an exception. If the uploads directory cannot be found, the result is a warning instead of OK. The number of readable PHP files that were examined is reported as scanned_count.
• The admin script is now loaded with the plugin version (1.0.4). Version 1.0.3 still loaded it as 1.0.2, so browsers could keep using a cached older script.

1.0.3 (2026-08-31)

• Site Health no longer shows a permanent warning for issues that are not meant to be fixed on a live site. WordPress core reports “good” when there are no critical issues, but this plugin flagged a warning whenever any recommended item existed. On maintained sites the same recommended items (outdated MySQL on shared hosting, no persistent object cache) are always present, so the warning was permanently on and stopped carrying information.
• Those items are now excluded from the warning and shown separately as “excluded as no action required”, with the reason kept. Nothing is silently dropped.
• If an excluded test key never matches (e.g. WordPress renames a test), the unmatched keys are reported so the exclusion cannot fail silently.
• The keys of the remaining recommended items are now included in the result, making it possible to review what should be added to the exclusion list.

1.0.2 (2026-08-09)

• Fixed a major bug: WordPress core Site Health tests were never executed. Core registers its tests as strings (e.g. 'test' => 'wordpress_version') which the caller resolves to a get_test_{$key}() method, so checking only is_callable() silently skipped all 22 core direct tests. Only tests added by other plugins were being counted.
• Site Health results are now split into WordPress core tests (used for the diagnosis) and tests added by other plugins (shown for reference only). Plugins that report their own features as unconfigured no longer affect the overall grade.
• Site Health test results now pass through the wp_site_health_test_result filter, matching core behaviour.
• A Site Health test added by another plugin that throws an exception no longer aborts the whole diagnosis; it is recorded as skipped instead.
• AI report prompt updated so plugin-originated notices are listed as “no action required” instead of appearing as critical items.

1.0.1 (2026-05-15)

• Update Claude model to claude-sonnet-4-6 (the previous claude-sonnet-4-20250514 will be retired by Anthropic on 2026-06-15).

1.0.0 (2026-05-11)

• Initial public release on WordPress.org (forked from the internal npc-wp-healthcheck 0.7.8 series).
• 9-point health diagnostics.
• Diagnosis history (last 10 entries) stored as a custom post type.
• WP Cron-based auto-check (daily / weekly / monthly).
• Email notifications on critical issues only.
• Optional AI-powered maintenance reports via Anthropic Claude API (opt-in via NPCMI_API_KEY).
• Full internationalization (English source strings, Japanese translation included).