DEV3Technologies
All case studies

DEV3 Technologies · own product

DEV3 AI Site Health & Security Log Analyst: logs, logins and file checks explained plainly, secrets masked

Our own WordPress plugin: it reads the PHP error log, Site Health, logins, suspicious requests, updates, cron and file checksums, groups them into ranked issues, and has the Google Gemini API explain each one after secrets, paths and personal data are masked.

WordPressPHPReactSite Health APIwordpress.org checksumsWP-CronWP-CLIGoogle Gemini APIREST APIPHPUnitJest
Industry
Website Operations & Security (WordPress)
Services
AI ImplementationWeb DevelopmentCustom Software

Live project preview

Client systems are private — screenshots shown where permitted.

DEV3 Technologies · own product — screenshots
Errors, Site Health results, file checks and security events grouped into ranked issues, with source, count and last seen.

Errors, Site Health results, file checks and security events grouped into ranked issues, with source, count and last seen.

The challenge

When a WordPress site misbehaves, the evidence is spread across a debug.log full of stack traces, Site Health results, failed logins, plugin changes and cron events. Developers can read it; most site owners can't. Sending raw logs to an AI for an explanation solves one problem and creates another, because logs contain database passwords, API keys, session cookies, server paths, emails and IP addresses. We needed an analyst that collects these signals cheaply, groups repeats into a short ranked list, explains each issue in plain words, changes nothing on the site by default, and never lets a secret leave the server.

Our solution

We built DEV3 AI Site Health & Security Log Analyst as a PHP plugin with a React admin app, a dashboard widget and WP-CLI commands. It is an analyst, not a firewall or malware cleaner, and it never claims a site is secure.

Key design decisions

  • Collectors that read only what's new. The PHP log is tailed from a stored offset (2 MB per run at most) with rotation and truncation detection by size, inode and a hash of the first 256 bytes. Site Health tests, logins, suspicious request lines, plugin and theme changes, updates, cron and slow queries each feed the same issue list.
  • Fingerprints, not lines. Messages are normalised (numbers, hex, memory sizes, ids and timestamps collapsed) and fingerprinted with source, file and line, so 400 repeats of one warning become one issue with a count and first/last seen. Resolved issues that come back are marked as regressed.
  • A redactor in front of every AI call. Redactor::mask() removes API keys, JWTs, bearer tokens, key/value secrets in query strings, JSON and PHP defines, cookies, database users and DSNs, the site host, absolute paths outside WordPress, long hashes, user names, emails, IPs and card numbers. Admins can view the exact masked payload.
  • Built-in explanations first. Every issue has a rule-based explanation. With a key, the AI adds a summary, likely cause, impact, numbered fix steps and who should fix it.
  • Read-only by default. One-click fixes (deactivate a plugin, restore a core file from wordpress.org, block an IP, remove an orphan cron hook, disable XML-RPC) are off until enabled, each needs a preview, a single-use 10-minute token and explicit confirmation, and each can be undone.

Architecture

Collectors run hourly through WP-Cron and on demand. A file integrity job compares core files with the official wordpress.org checksums and wordpress.org plugins with their published checksums; plugins not on wordpress.org are reported as not verifiable, never as modified. A health score from 0 to 100 weighs open issues by severity, capped per source so one noisy log can't sink it. Email alerts have per-type cool-downs, and a weekly HTML report summarises score, issues, security and updates. The API client and settings come from a shared core used across DEV3's plugins.

Results

The plugin is complete. It ships in the DEV3 AI Content, SEO & Site Tools Plugins Bundle on the DEV3 marketplace, alongside 6 other content and site plugins, and is being prepared for CodeCanyon. What was built and verified:

  • 72 PHPUnit tests in wp-env, including 8 redactor tests (API keys, JWTs, key/value secrets in nine formats, DB credentials, paths, emails, IPv4 and IPv6, card numbers) and a test that captures the outgoing AI request and checks no secret, path, host or email is in it
  • 32 Jest tests for the admin screens and shared UI
  • Log tests cover tail-only reads, rotation and truncation without double counting, and stack traces folded into one entry
  • Fix tests cover read-only default, single-use confirmation tokens, checksum-verified core restore with backup, and undo
  • The AI paths were tested with mocked API responses; a run with a live key is the next step. PHP errors are read from log files, so logging must be enabled

Setup guide

No licence key or activation is needed: install the zip and every feature works.

Requirements

  • WordPress 6.0 or newer and PHP 7.4 or newer (single site, or per site on multisite)
  • To analyse PHP errors, PHP error logging must be on: set WP_DEBUG_LOG in wp-config.php, use PHP's error_log, or point the plugin at a log file in Settings. The Error log screen shows the snippet if logging is off
  • Working WP-Cron for hourly checks, alerts and the weekly report. The file integrity check needs outgoing access to wordpress.org
  • Slow-query capture only runs when SAVEQUERIES is on
  • Optional: a Google Gemini API key for plain-words AI explanations. Without one, every issue still gets a built-in explanation

1. Install the plugin

  1. Unzip the bundle download and find dev3-ai-content-seo-site-tools-plugins-bundle/dev3-ai-site-health-analyst/dev3-ai-site-health-analyst.zip.
  2. In WordPress, go to Plugins → Add New → Upload Plugin, choose the zip and click Install Now.
  3. Click Activate. DEV3 AI Site Health & Security Log Analyst for WordPress appears in the plugin list and its menu, DEV3 AI Site Health, appears in the admin sidebar.

2. Connect Google Gemini (optional)

  1. Create a free API key in Google AI Studio (sign in with a Google account, then Create API key).
  2. Go to DEV3 AI Site Health → API Config, paste the key and click Validate & save. The key is stored encrypted and never sent to the browser.
  3. Optional: pick the model (gemini-2.5-flash is the fast default) and set a monthly budget. Secrets, paths, emails and IPs are masked before anything is sent.

Prefer config files? Add define( 'DEV3SH_GEMINI_API_KEY', 'your-key' ); to wp-config.php instead.

3. Set it up

  1. Open DEV3 AI Site Health → Overview and click Scan now for the first check. After that, checks run every hour in the background.
  2. Open Integrity and click Run check now to compare WordPress core and wordpress.org plugins with the official checksums (weekly by default).
  3. In Settings, choose which sources to collect, whether to include notices and deprecations, the failed-login and 404 thresholds, IP anonymisation and how long security events are kept.
  4. In Reports & alerts, add recipients, choose which alerts to send, and set the weekly report day and hour. Use Send now to test it.
  5. One-click fixes stay off until you switch on Allow one-click fixes (with confirmation) in Settings.

Prefer the command line? wp dev3sh scan, wp dev3sh issues --status=open and wp dev3sh report --send are available.

Updating

Download the new bundle version, then upload the plugin zip in Plugins → Add New → Upload Plugin and choose Replace current with uploaded. Settings, issues and history are kept.

Uninstalling

Deactivate and delete the plugin from Plugins. Issues and events are kept unless you turn on the delete-data-on-uninstall option first.

How to use

Work through the issue list

  1. Open DEV3 AI Site Health → Issues. Errors, warnings and findings are grouped into issues with severity, source, count and last seen. Repeats of the same error are one issue.
  2. Filter by severity or source, or search by message, file or plugin.
  3. Click an issue to see when it started, how often it happened, the file and the message, plus a built-in explanation of how to fix it.
  4. Click Explain with DEV3 AI for a plain-words summary, likely cause, impact, numbered steps and who should fix it (you, a developer or your host). Use Masked data sent to DEV3 AI to see exactly what was sent.
  5. Click Mark resolved when it's fixed, or Ignore if it doesn't matter. A resolved issue reopens if it happens again.
  6. To explain everything urgent at once, click Explain critical & high with DEV3 AI.

Check security activity

  1. Open Security for failed logins and suspicious requests over the last 14 days, the types of probes (SQL injection, user enumeration, sensitive files, path traversal) and the most active addresses.
  2. With fixes allowed, click Block… next to an address, review the preview and confirm. Blocks expire after the number of days you set and can be removed with Unblock.

Verify your files

  1. Open Integrity and click Run check now.
  2. Review changed core files, unknown PHP files inside wp-admin or wp-includes, and plugins that match, differ from, or can't be checked against wordpress.org.
  3. With fixes allowed, click Restore… on a changed core file. The plugin backs up the current file, downloads the official one, checks its checksum and records the fix so you can undo it.

Read the error log

  1. Open Error log to see the log file's location, size and the latest entries, filtered by level.
  2. Click Show stack trace to expand a fatal error, or open the issue it belongs to.

Get the weekly report

  1. In Reports & alerts, preview the weekly email: health score and trend, new and resolved issues, top issues, security figures and pending updates.
  2. Switch on With AI summary to add a short overview paragraph, then use Send now to check how it looks in your inbox.

Related case studies