Description
NPC Maintenance Inspector performs 9-point health diagnostics on your WordPress site directly from the admin dashboard:
- WordPress core updates — Detect missing core updates.
- Plugin updates — List plugins with available updates.
- Site Health issues — Extract critical issues from WP standard Site Health API.
- PHP version — Warn on end-of-life PHP versions.
- Error log analysis — Summarize debug.log entries and save a one-click backup to uploads/ for safe review.
- File integrity — Detect suspicious code patterns in core files (eval / base64_decode / etc.) by comparing checksums against the WordPress.org Checksum API.
- Suspicious files — Find unexpected PHP files in wp-content/uploads/, with built-in whitelist for known legitimate plugin files (Ajax Load More templates, WP STAGING index.php, AIOS firewall rules, etc.).
- SSL certificate — Check days until expiration (warn under 30 days, critical at 0).
- File permissions — Check critical files like wp-config.php, .htaccess, wp-content/.
Operational features:
- History — Keep the last 10 diagnoses as a custom post type.
- Scheduled auto-check — Run daily, weekly, or monthly via WP Cron.
- Email notifications — Send alerts only on critical issues.
- One-click debug.log clear — Truncate the log while preserving file permissions.
- Optional AI report — Generate maintenance suggestions via Anthropic Claude API. Disabled by default; opt-in via a wp-config.php constant.
The plugin is locked to the user who activated it and to the original site URL, so it stays inert after backup restores to a different domain.
External services
This plugin can optionally connect to the Anthropic Claude API (https://api.anthropic.com/v1/messages) to generate AI-powered maintenance reports. This is the only external service the plugin ever contacts.
When is data sent?
- When you manually click the “Generate AI Report” button in the admin.
- When an automatic scheduled diagnosis detects a critical issue and notifications are enabled. In that case the AI report is generated once per critical run and attached to the notification email.
What data is sent?
- The diagnosis result text only:
- Site URL, site name, WordPress version, theme name
- Counts of plugin updates / Site Health issues / error-log entries
- PHP version, memory limit, max upload size
- SSL expiration date and days remaining
- File-permission status of critical files
- Suspicious code patterns detected (function names like
eval,base64_decode)
- No login data, no post content, no personal data of site visitors.
Is the data sent unconditionally?
No. The AI feature is completely disabled unless you define NPCMI_API_KEY in wp-config.php. Without that constant, no external connection to Anthropic is ever made.
Anthropic’s terms and privacy policy:
- Consumer Terms of Service: https://www.anthropic.com/legal/consumer-terms
- Privacy Policy: https://www.anthropic.com/legal/privacy
- Commercial Terms of Service (if you use a paid API plan): https://www.anthropic.com/legal/commercial-terms
By enabling the AI report feature (i.e. by defining NPCMI_API_KEY), you agree to Anthropic’s applicable terms.
Screenshots








Installation
- Upload the plugin folder to
/wp-content/plugins/or install it via Plugins Add New in the admin. - Activate NPC Maintenance Inspector through the Plugins menu.
- Open NPC Inspector in the admin sidebar.
- Click Run Diagnosis to start a manual check.
- (Optional) Open NPC Inspector Settings to enable scheduled auto-checks and email notifications.
- (Optional) Define
NPCMI_API_KEYinwp-config.phpto enable the AI report feature (see FAQ).
FAQ
-
Is the AI report feature required?
-
No. AI report is optional and disabled by default. To enable it, add this line above
/* That's all, stop editing! */in yourwp-config.php:define( 'NPCMI_API_KEY', 'sk-ant-xxxx' );Without that constant the plugin still runs all 9 diagnostics, scheduled checks, email notifications, and history.
-
Does the plugin send any data externally?
-
By default, no. Only the AI report feature sends data, and only to Anthropic Claude API, and only when explicitly triggered (manual “Generate AI Report” button, or automatic generation when a scheduled check detects a critical issue). See the External services section below for details.
-
Who can use the plugin after activation?
-
Only the user who activated it. The user ID/email and the site URL are recorded on first activation, and the plugin refuses to operate for other users or on a different domain. This is a deliberate constraint to keep the AI cost surface and the admin actions tied to a specific operator.
-
Why are AI reports in Japanese?
-
This plugin was initially built for Japanese-speaking WordPress maintainers. The AI prompt instructs Claude to reply in Japanese. We will localize the prompt for additional output languages in a future release.
-
My site shows “suspicious files” in wp-content/uploads/. Should I delete them?
-
Not automatically. The detector tries to whitelist known legitimate plugin files (Ajax Load More templates, WP STAGING index.php, AIOS firewall rules, etc.). Anything that still appears in the warning should be opened and inspected first — many backup/staging/security plugins legitimately drop PHP files there.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“NPC Maintenance Inspector” is open source software. The following people have contributed to this plugin.
ContributorsTranslate “NPC Maintenance Inspector” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.4 (2026-10-13)
- File Integrity no longer reports “OK” when nothing was actually checked.
checked_filesused to be the number of entries in the WordPress.org checksum list, not the number of files compared, and target files that were missing on the site were skipped silently. A site where none of the target files could be read was still reported as “OK”.checked_filesis now the number of files actually read and compared. Files outside the check scope (excluded_count) and target files that are missing or unreadable (failed_files/failed_count) are reported separately. - If any target file is missing or unreadable, or no file could be checked at all, File Integrity is now a warning instead of OK.
- When the checksum data cannot be retrieved from WordPress.org, File Integrity is now counted as a warning in the overall grade and in the AI report input instead of as OK, and the card shows the reason instead of “No changes to core files.”
- An unreadable core file is no longer reported as “modified, no suspicious code”. It is listed as a file that could not be checked.
- A modified file whose contents could not be scanned for suspicious code (unreadable or larger than 1 MB) is no longer described as having no suspicious code. It is counted in
unscanned_count, and the result is not downgraded to OK. - The File Integrity card now says “No changes in the checked core files.” and shows how many files were checked and how many were outside the check scope, missing, unreadable or not scanned. The same counts are passed to the AI report.
- Suspicious Files: unreadable PHP files and folders in the uploads directory are now reported separately (
unreadable_files/unreadable_dirs) and keep the result at warning. Previously an unreadable folder stopped the whole diagnosis with an exception. If the uploads directory cannot be found, the result is a warning instead of OK. The number of readable PHP files that were examined is reported asscanned_count. - The admin script is now loaded with the plugin version (1.0.4). Version 1.0.3 still loaded it as 1.0.2, so browsers could keep using a cached older script.
1.0.3 (2026-08-31)
- Site Health no longer shows a permanent warning for issues that are not meant to be fixed on a live site. WordPress core reports “good” when there are no critical issues, but this plugin flagged a warning whenever any recommended item existed. On maintained sites the same recommended items (outdated MySQL on shared hosting, no persistent object cache) are always present, so the warning was permanently on and stopped carrying information.
- Those items are now excluded from the warning and shown separately as “excluded as no action required”, with the reason kept. Nothing is silently dropped.
- If an excluded test key never matches (e.g. WordPress renames a test), the unmatched keys are reported so the exclusion cannot fail silently.
- The keys of the remaining recommended items are now included in the result, making it possible to review what should be added to the exclusion list.
1.0.2 (2026-08-09)
- Fixed a major bug: WordPress core Site Health tests were never executed. Core registers its tests as strings (e.g.
'test' => 'wordpress_version') which the caller resolves to aget_test_{$key}()method, so checking onlyis_callable()silently skipped all 22 core direct tests. Only tests added by other plugins were being counted. - Site Health results are now split into WordPress core tests (used for the diagnosis) and tests added by other plugins (shown for reference only). Plugins that report their own features as unconfigured no longer affect the overall grade.
- Site Health test results now pass through the
wp_site_health_test_resultfilter, matching core behaviour. - A Site Health test added by another plugin that throws an exception no longer aborts the whole diagnosis; it is recorded as skipped instead.
- AI report prompt updated so plugin-originated notices are listed as “no action required” instead of appearing as critical items.
1.0.1 (2026-05-15)
- Update Claude model to
claude-sonnet-4-6(the previousclaude-sonnet-4-20250514will be retired by Anthropic on 2026-06-15).
1.0.0 (2026-05-11)
- Initial public release on WordPress.org (forked from the internal
npc-wp-healthcheck0.7.8 series). - 9-point health diagnostics.
- Diagnosis history (last 10 entries) stored as a custom post type.
- WP Cron-based auto-check (daily / weekly / monthly).
- Email notifications on critical issues only.
- Optional AI-powered maintenance reports via Anthropic Claude API (opt-in via
NPCMI_API_KEY). - Full internationalization (English source strings, Japanese translation included).
