WordPress Health Check, or Site Health, is a built-in WordPress tool that checks in a few seconds whether your website is secure, up to date and working properly. It has been in the dashboard of every WordPress site since version 5.2, yet most business owners have never opened it. In this article we explain where to find it, what its warnings mean, what you can fix yourself and when it is time to call a developer.
Where to find WordPress Site Health
Log in to your WordPress dashboard and go to Tools → Site Health. A short summary also appears on the dashboard home screen in the “Site Health Status” widget. The tool has two tabs:
- Status – the result (“Good” or “Should be improved”) and the issues found, each with an explanation.
- Info – a technical overview: WordPress, PHP and database versions, server, plugins, theme, directory sizes and settings.
Critical issues and recommended improvements
Site Health splits its findings into two groups. Critical issues affect security or reliability and should be fixed right away. Recommended improvements do not break the site but slow it down or increase future risk. Each line has an explanation and often a link to documentation.
The most common warnings and what they mean
- Outdated PHP version. Old PHP is slower and no longer receives security fixes. The upgrade is done in your hosting panel, but first check that your theme and plugins work with the new version.
- WordPress, plugins or themes not updated. Most hacks exploit vulnerabilities that have already been patched. Update regularly, but always after taking a backup.
- Inactive plugins and themes. A deactivated plugin’s files are still on the server and can contain a vulnerability. Delete what you do not use.
- HTTPS is not used. Without an SSL certificate the browser shows “Not secure”, and Google prefers secure sites.
- A scheduled event is late. WP-Cron is not running properly, so backups, newsletters or scheduled posts may not happen.
- No page cache detected or a persistent object cache is recommended. Without caching the server rebuilds every page on every visit and the site is slow. Read more in our article on website speed and SEO.
- Loopback request or REST API failed. WordPress cannot talk to itself. This blocks automatic updates, scheduled tasks and sometimes the block editor. The cause is usually a security plugin, a firewall or server settings.
- Debug mode is enabled. If WP_DEBUG displays errors to visitors, it can reveal server paths and other sensitive information.
- Too many autoloaded options. The database loads data from long-removed plugins on every page, slowing down the whole site.
The Info tab: what to send your developer
If you need help, click “Copy site info to clipboard” on the Info tab and send the text to your developer. They will immediately see the WordPress, PHP and server versions, active plugins and settings, and will not need your password for a first diagnosis. Review the text before sending to make sure it contains nothing you do not want to share.
Health Check & Troubleshooting plugin and Troubleshooting Mode
The official plugin from the WordPress team, Health Check & Troubleshooting, adds a Troubleshooting Mode. It disables all plugins and switches to a default theme for your session only, while visitors see the site as usual. You then re-enable plugins one by one to find the one causing the error. It is the safest way to debug a live website.
What Site Health does not check
A green “Good” does not mean everything is fine. Site Health cannot see:
- whether backups are actually made and whether the site can be restored from them;
- whether the site has already been hacked or contains malware;
- how fast the site is for real visitors (Core Web Vitals) and on mobile;
- broken links, SEO errors and missing meta descriptions;
- whether contact form emails and order confirmations are delivered.
For a quick look at speed, SEO and security, run our free website audit. We check all of this every month as part of our WordPress maintenance. If your site has already been compromised, see hacked website repair.
How often should you check Site Health?
Once a month is enough, plus after major updates or a hosting change. If you see a critical issue you cannot solve yourself, do not put it off: outdated PHP and unpatched plugins are the most common reasons WordPress sites get hacked. See also our monthly website maintenance checklist.
Frequently asked questions
What is WordPress Health Check?
It is the built-in WordPress Site Health tool (Tools → Site Health) that checks security, versions, caching and server configuration and lists the issues it finds with explanations.
Does “Should be improved” mean my site is at risk?
Not necessarily. Check whether any of the issues are critical. Recommended improvements mostly affect speed and future risk; critical issues should be fixed straight away.
Can I upgrade PHP myself?
In many hosting panels it is a single button, but take a backup first and check that your theme and plugins support the new PHP version. Otherwise the site may show a white screen or a critical error.
Does Site Health replace website maintenance?
No. It is a good first check, but it cannot see backups, malware, real-user speed, broken links or whether forms work. Those are part of monthly maintenance.
What if Site Health itself will not open?
If the dashboard or the tool does not load, the problem is deeper: a plugin conflict, a memory limit or a server error. Write to us and we will take a look.
Is Site Health showing red lines you do not understand? Send us a screenshot and we will tell you for free what is urgent, what can wait and what you can fix yourself.