DEV3 AI Site Health & Security Log Analyst for WordPress

WordPress plugin: it reads the PHP error log, Site Health, logins, suspicious requests, updates, cron and file checksums, groups them into ranked issues, and has the Google Gemini API explain each one after secrets, paths and personal data are masked. Free download: sign in and click Download ZIP. Add your own Google AI Studio (Gemini) API key to switch on the AI features; the documentation says which features work without one.

How it works

We built DEV3 AI Site Health & Security Log Analyst as a PHP plugin with a React admin app, a dashboard widget and WP-CLI commands. It is an analyst, not a firewall or malware cleaner, and it never claims a site is secure.

Key design decisions

• Collectors that read only what's new. The PHP log is tailed from a stored offset (2 MB per run at most) with rotation and truncation detection by size, inode and a hash of the first 256 bytes. Site Health tests, logins, suspicious request lines, plugin and theme changes, updates, cron and slow queries each feed the same issue list.
• Fingerprints, not lines. Messages are normalised (numbers, hex, memory sizes, ids and timestamps collapsed) and fingerprinted with source, file and line, so 400 repeats of one warning become one issue with a count and first/last seen. Resolved issues that come back are marked as regressed.
• A redactor in front of every AI call. Redactor::mask() removes API keys, JWTs, bearer tokens, key/value secrets in query strings, JSON and PHP defines, cookies, database users and DSNs, the site host, absolute paths outside WordPress, long hashes, user names, emails, IPs and card numbers. Admins can view the exact masked payload.
• Built-in explanations first. Every issue has a rule-based explanation. With a key, the AI adds a summary, likely cause, impact, numbered fix steps and who should fix it.
• Read-only by default. One-click fixes (deactivate a plugin, restore a core file from wordpress.org, block an IP, remove an orphan cron hook, disable XML-RPC) are off until enabled, each needs a preview, a single-use 10-minute token and explicit confirmation, and each can be undone.

Architecture

Collectors run hourly through WP-Cron and on demand. A file integrity job compares core files with the official wordpress.org checksums and wordpress.org plugins with their published checksums; plugins not on wordpress.org are reported as not verifiable, never as modified. A health score from 0 to 100 weighs open issues by severity, capped per source so one noisy log can't sink it. Email alerts have per-type cool-downs, and a weekly HTML report summarises score, issues, security and updates. The API client and settings come from a shared core used across DEV3's plugins.

What's in the download

• The installable plugin zip: upload it through Plugins → Add New → Upload Plugin.
• Full HTML documentation (installation, settings, hooks, FAQ).

Requirements

• WordPress 6.0 or newer and PHP 7.4 or newer (single site, or per site on multisite)
• To analyse PHP errors, PHP error logging must be on: set WP_DEBUG_LOG in wp-config.php, use PHP's error_log, or point the plugin at a log file in Settings. The Error log screen shows the snippet if logging is off
• Working WP-Cron for hourly checks, alerts and the weekly report. The file integrity check needs outgoing access to wordpress.org
• Slow-query capture only runs when SAVEQUERIES is on
• Optional: a Google Gemini API key for plain-words AI explanations. Without one, every issue still gets a built-in explanation

Learn more

• How we built it: the AI Site Health & Security Log Analyst case study
• Engineering write-up on the DEV3 blog
• Also free in the DEV3 AI Content, SEO & Site Tools Plugins Bundle with every other Content, SEO & Site Tools plugin.