A while back WordPress introduced a “Site Health” screen, which takes your site through a number of different status checks. In this post, we take you through what each check means, how important it is, and what (if anything!) you need to do.
Currently reading: WordPress Site Health Status Checks Explained Click To Tweet
Use the quick jump links below to navigate, or simply read from top to bottom.
- How to find the WordPress Health Check
- What you need to know
- About the Site Health checks
- The Site Health checks explained
- Having a default theme available
- Removing inactive plugins
- Removing inactive themes
- PHP version check
- One or more recommended modules are missing
- Scheduled events
- WordPress version
- PHP default time zone is valid
- SQL server is up to date
- UTF8MB4 support
- Active HTTPS connection
- Secure communication with other services
- HTTP requests working as expected
- Your site is not set to output debug information
- The REST API is available
- Can communicate with WordPress.org
- Background updates are working
- Your site can perform loopback requests
How to find the WordPress Health Check
it’s located on the default screen of your wordpress dashboard as a widget. if you have other widgets already there, you may need to scroll to see the “Site Health Status” box, which has a link to click through to the “Site Health Screen.”
What you need to know
Within the WordPress community, the Site Health screen is seen as very controversial. There’s a lot of debate on it including criticism and feedback about how it works and how the information is presented and described.
It’s important to note that:
- No automated tool is 100% accurate.
- This tool isn’t specific to any given hosting environment.
- Both these things can lead to false positives.
Some of these checks are more likely to lead to false positives than others. As we go through the checks below, we note next to the check in question if it’s highly likely to throw a false positive.
It’s also worth noting that not all the checks are equally important, so don’t worry if there’s a minor check you don’t pass, especially if there’s a good reason why! It’s always more important to go by what’s really best for your own website rather than blanket following automated suggestions.
About the Site Health checks
The checks are loosely divided into two main categories: Security and Performance. Some checks don’t actually fall into either category, but are still assigned one of them, so this categorization is best used as a rough guideline at most. Some checks fall into both categories but are still only assigned one of them.
We cover each check in more detail below. (If you’re seeing a check for your website that we haven’t covered here yet, please let us know so we can add it. Thanks so much!)
The Site Health checks explained
Let’s dive into what each check means, how important it really is, and what you need to know.
Having a default theme available
This check is to see if you have one of WordPress’s default themes (for example “Twenty Nineteen” or “Twenty Twenty”) installed. This is because some support staff may ask you to switch your website theme to a default theme to rule out a problem with a custom theme.
Type of check – Security
How important it is? – Not only is it rare for themes to cause issues of this type, there are better ways of diagnosing an issue caused by a theme than switching to a default theme. So it’s not important for you to have one of the WordPress default themes installed on your website, especially if you’re not planning to use it.
What else do I need to know? – You can download and install a default theme from your Dashboard by going to Themes > Add New, but it’s not something you need to do. It’s often better to not have a default theme available as then you, a developer, or a plugin can’t switch to it by accident/unnecessarily.
Removing inactive plugins
If you’ve installed plugins but they aren’t active, this check advises you to remove them. Inactive plugins are less of a threat to your website security than active ones, but removing inactive plugins means you’re less likely to activate old plugins that have been abandoned by the developer.
Type of check – Security
How important it is? – As the plugins aren’t active, it’s more of a housekeeping exercise than a big security risk, but there are no downsides to removing inactive plugins so it can be a good move. From your WordPress Dashboard, choose “Plugins” in the sidebar to see which are inactive and remove them as preferred.
What else do I need to know? – If it’s a paid plugin, you may want to check you still have a copy of it on your computer or in the cloud in case you want to reinstall it again in the future.
Removing inactive themes
As you can only have one theme active at a time, this check reminds you to clear out old inactive themes you no longer want to use.
Type of check – Security
What else do I need to know? – Inactive themes aren’t overly bad unless they have been abandoned by the developer and/or injected with malicious code and you end up activating them in future, as this may make your site vulnerable without you realizing. Cleaning out old themes you’ll no longer use is always a good idea, especially if you’ve used a web host that installs a bunch of themes by default.
PHP version check
This checks to see if your website is running the latest stable version of PHP, which is the programming language WordPress websites are written in.
Type of check – Performance
How important it is? – The short answer is, it depends. If you’re running a super old version of PHP that’s no longer supported, you’ll want to upgrade to a later version for security reasons. If you’re running an old version of PHP, it could be because you’re using a theme or plugin that’s only compatible with older versions, or you’ve migrated an old site from a host that didn’t upgrade you. Switching PHP versions can break your website, so it’s best done with tech support just in case.
What else do I need to know? – PHP versions are supported for a certain length of time, so as long as you’re using a version that is still supported, it doesn’t matter if it’s not the latest one (in the same way that you can still use Windows 8 when Windows 10 comes out and they still release updates and security patches for it). You can view a list of currently supported versions of PHP here and see when they’re due to go end of life.
Using the latest stable version of PHP is recommended for optimal speed and security, but not all plugins and themes will be compatible with it. For that reason, you may not want to change your PHP version yourself as it may break your website. If you’re a Lyrical Host customer and want to change your version of PHP, please contact our support team so they can help you do it safely.
One or more recommended modules are missing
PHP modules are a little like plugins and provide specific functionality to software that runs on PHP (such as WordPress). In a lot of cases there are a variety of modules that provide the same (or similar) functonality, and exactly which modules are available to a particular WordPress site depends on your hosting configuration.
WordPress keeps a liist of modules that are required for WordPress to function, and also a list of optional modules that it recommends.
Type of check – Performance
How important it is? – Unless a required module is missing, this check isn’t important, as the recommended modules are mainly personal preference on behalf of the team behind WordPress. Other modules that provide the same functionality are just as good (and in the case of some server configurations may even be better).
Scheduled events
Scheduled events, also known as cron jobs, are tasks that your website has set up to run at a certain time, for example running a scan or publishing a scheduled blog post. This check sees if it will think scheduled events will run as intended.
Type of check – Performance
How important it is? – Scheduled events can be very inconsistent in WordPress, so don’t worry if your site tries this check and doesn’t display a pass. This check doesn’t retry when you refresh the page, so the last time it checked could have been a while ago. It doesn’t mean your site will fail to run a scheduled event in reality.
What else do I need to know? – Scheduled events are triggered if you have visitors on your website loading pages within a few seconds of the event being due to run (rather than checking constantly, which is resource intensive). If your task is set to run at a time when there are no visitors loading pages on your site, it may fail. You can read more about this in our support article, Why did my scheduled post not publish?
WordPress version
If your website isn’t running the latest version of WordPress, you’ll be asked to update it to pass this check.
Type of check – Performance
How important it is? – Important! If your version of WordPress is very old, this is likely to be flagged as a Critical issue in your site health check, rather than recommended.
What else do I need to know? – This is both a security and performance check. It’s advisable to keep your WordPress install up to date to avoid speed, security, and incompatibility issues further down the line. While you don’t have to be an early adopter, especially for major updates, you want to be sure you’re running a supported and relatively recent version.
PHP default time zone is valid
This checks that the right PHP default time zone is set (this is different to the Timezone set within your WordPress settings).
Type of check – Performance
How important it is? – This is quite important as WordPress Core relies on the assumption that the PHP default timezone is set to UTC for a number of its functions to work correctly.
What else do I need to know? – This should be a check you automatically pass. If you’re a customer, please contact support if your site appears to fail this.
SQL server is up to date
This check is to make sure you have up to date database software. This is something we take care of for you, so you should pass this check automatically.
Type of check – Performance
How important it is? – It’s very important for your site’s performance that you pass this check.
What else do I need to know? – You don’t need to do anything yourself for this, except contact us if you have concerns about it.
UTF8MB4 support
This check is another database check, to make sure the right character set (UTF8MB4) is being used. Similarly to the SQL check, this is done for you automatically.
Type of check – Performance
How important it is? – It’s important, but the good news is you should pass this check without needing to do anything.
What else do I need to know? – UTF8MB4 is used because it safely supports the widest set of characters and encodings, for example emoji and characters specific to different languages.
Active HTTPS connection
This is a check to see if you have a valid SSL certificate in place. This means that when someone visits your website, they see a padlock next to your URL in their browser and your website starts with https:// instead of http://. You can read more about this in How To Set Up An SSL Certificate.
If you’ve already set up an SSL certificate for your website and can see the padlock to the left of your browser URL bar as normal when you go to the https:// version of your site, this is a (fairly common) false result in WordPress and you don’t need to worry about it. If you see a broken padlock (e.g. a padlock with a cross or line through it, or a “Connection not private” or “Connection not secure” warning), please contact our support team and they’ll fix it so that your SSL certificate is implemented and working correctly.
Type of check – Security
How important it is? – It’s super important to have a valid SSL certificate for your website, even if you don’t sell anything on it. Not only does it stop your visitors’ connections being intercepted by third parties, it can also help you rank better in Google and give your visitors peace of mind when they visit your website.
What else do I need to know? – If you’re a Lyrical Host customer, we’ll help you set up an SSL certificate if you don’t already have one. Just ask!
Secure communication with other services
Your WordPress website communicates with a number of other servers, for example for fetching information, running external scripts, and processing payments. This check tests if your site can do these things securely.
Type of check – Security
How important it is? – It’s essential that your website can communicate securely with other services.
What else do I need to know? – If you have concerns about this check, please raise a support ticket.
HTTP requests working as expected
In WordPress’s own words: “It is possible for site maintainers to block all, or some, communication to other sites and services. If set up incorrectly, this may prevent plugins and themes from working as intended.”
Type of check – Performance
How important it is? – It’s essential HTTP requests are working for your site to work.
What else do I need to know? – You’ll know if these aren’t actually working because you likely won’t be able to load parts of your site, save posts, install plugins, and so on, depending on which requests are being blocked. Please contact support if you have concerns about this check!
Your site is not set to output debug information
Web developers and support staff may use WordPress’s debugging mode to investigate problems on your website. However, as it can often contain sensitive information, it shouldn’t be able to show this information to the whole world.
Type of check – Security
How important it is? – It’s important that you don’t have debugging on if you don’t need it/while you’re not using it.
What else do I need to know? – If you have someone do work on your site, run this check after to make sure they turned debugging off.
The REST API is available
The REST API is a service that helps applications (including parts of WordPress core such as the Gutenberg editor, along with plugins, themes and external applications) communicate with your WordPress site (for example to save posts), and allows a lot more functionality to be handled on the front-end by your browser. This means that you can make changes faster without needing to reload pages all the time, and allows things like the Gutenberg block editor to work.
Type of check – Performance
How important it is? – The check itself isn’t necessarily hugely important as it’s not always reliable, but it is important that your site can utilize the REST API.
What else do I need to know? – This check is prone to false positives, so it’s not uncommon to see it fail in the test; it doesn’t mean it will fail in real life.
Can communicate with WordPress.org
Your website communicates with WordPress.org to do things like check for new versions of WordPress, and to and update WordPress core, and install themes or plugins you choose to install from within your WordPress Dashboard.
Type of check – Security
How important it is? – It’s essential for running an active WordPress install.
What else do I need to know? – There’s no reason you should fail this check, but if for some reason your site fails it, please contact our support team if you’re a Lyrical Host customer.
Background updates are working
Background updates mean that WordPress can update itself if a security patch is released for your version.
Type of check – Security
How important it is? – If you prefer to run your own updates rather than have core WordPress auto-update, this check may not be that important to you. If you prefer your WordPress version to update on its own, this check is likely to be very important to you!
What else do I need to know? – It’s always good to keep on top of security updates, so this check can be useful to determine that your site can run background updates if you’re prone to forget about updating/checking for security updates.
Your site can perform loopback requests
In WordPress’s own words: “Loopback requests are used to run scheduled events, and are also used by the built-in editors for themes and plugins to verify code stability.”
Type of check – Performance
How important it is? – This check is important for a number of different aspects of WordPress.
What else do I need to know? – This check is prone to false positives. If you’re concerned about failing it, please contact our support team so they can confirm you’re all goood!
And that’s all the health checks explained!
Did you find this post useful? Please pin it for someone else to discover!
No Comments