playbook/antigravity-awesome-skills/skills/wp-site-health-auditor/references/catalog.md

WP Site Health item catalog

Extended list of less-common WordPress Site Health items, organized by category. Items in the main SKILL.md recipe list are NOT duplicated here.

Security

Passwords need updating — Tier 1

Users with weak or reused passwords. Inform the admin, list affected users:

wp user list --field=user_login | while read u; do echo "$u: $(wp user meta get "$u" session_tokens | wc -c)"; done

No automated fix — the admin must ask each user to update via wp user reset-password <user> or Users > Profile.

The site is not using a persistent connection (not an object cache) — Tier 3

Persistent database connections (mysqli.persist). Purely informational; most shared hosts disable this and there is no performance downside for standard WP installs. No action needed.

File permissions should be reviewed — Tier 2

wp-config.php and /wp-content/ directory permissions. Do not recursively chmod the whole web root, because it may contain host-managed files or private backup material. Draft the expected permissions for the WordPress-owned paths:

chmod 600 wp-config.php
find wp-content -type d -exec chmod 755 {} +
find wp-content -type f -exec chmod 644 {} +
chmod 400 .htaccess # if Apache; nginx ignores it

The user must verify with their host that the filesystem supports these permissions (some managed WP hosts lock permissions).

Performance

Indexed autoloaded options found — Tier 2

Autoloaded options larger than 1 MB. List the worst offenders:

SELECT option_name, LENGTH(option_value) AS size
FROM wp_options
WHERE autoload = 'yes'
ORDER BY size DESC
LIMIT 20;

If a plugin is the source, report the plugin name. Cleaning involves:

• wp option delete <key> (only if the option is safe to delete — confirm with the plugin author first).
• Disabling autoload: wp option update <key> <value> --autoload=no.

Can not process scheduled maintenance jobs (wp_cron) — Tier 2

DISABLE_WP_CRON is set but no system cron is running. Fix by either:

1. Setting up a real system cron job (recommended):

   * * * * * wget -q -O - https://example.com/wp-cron.php
   

2. Removing define('DISABLE_WP_CRON', true); from wp-config.php

Background updates failed — Tier 2

Automatic background updates for core/plugins/themes. Check:

wp core check-update
wp plugin list --update=available

If DISALLOW_FILE_MODS is true, background updates are blocked. Only override if the user explicitly wants auto-updates:

define('DISALLOW_FILE_MODS', false); // wp-config.php

SEO

llms.txt generation not configured — Tier 1

The site is missing an llms.txt file at the domain root. Install and activate an SEO plugin that supports it, or create a manual file via wp-admin > SEO > Settings. Not a ranking factor, but recommended for AI crawler discoverability.

No XML sitemap detected — Tier 1

Install an SEO plugin with sitemap support (Yoast, Rank Math, etc.) or a dedicated sitemap plugin. Enable sitemap generation from the plugin settings screen (no WP-CLI toggle reliably available across plugins).

Social preview images missing — Tier 2

Open Graph / Twitter Card meta tags not set. Requires theme integration or an SEO plugin. Draft the OG meta tags if the theme uses wp_head():

add_action('wp_head', function () {
    if (has_post_thumbnail()) {
        echo '<meta property="og:image" content="' . esc_url(get_the_post_thumbnail_url()) . '" />';
    }
});

Privacy

Privacy policy page not set — Tier 1

The site has no privacy policy page. Create one:

wp post create --post_type=page --post_title="Privacy Policy" --post_status=draft

Then set it under Settings > Privacy or via:

wp option update wp_page_for_privacy_policy <page-id>

Privacy policy page is outdated — Tier 2

The privacy policy page was created before the site's current privacy guidance generation date. Re-run the guidance generator in Tools > Export Personal Data and update the page content. No WP-CLI command for this — manual step.

Diagnostics / hard-to-classify

Requirement mis-match with Xdebug extension — Tier 3

Xdebug is loaded but is not required for production. If the user didn't intentionally install it, suggest removal via host panel or php.ini:

; php.ini
; zend_extension=xdebug.so  (comment out or remove)

ZipArchive / gzinflate / BCMath / Imagick missing — Tier 2

Missing PHP extensions that some plugins or WordPress itself need. List missing extensions and suggest installation via host panel or:

sudo apt install php-zip php-gd php-bcmath php-imagick

(Command varies by OS — draft the correct one for the user's environment.)

Items deliberately excluded from this catalog

• SQL Server version — WP core already reports this as Passed or Informational; no user action exists.
• Active theme up to date — Already green in Site Health; no action.
• Plugin updates available — Handled by wp plugin update --all.