Carticy SiteVitals

Description

Most performance plugins tell you your site is slow. Very few tell you why.

SiteVitals measures real visits to your site and shows you which plugin is using the time. When a page takes 1.2 seconds, you get the plugin name, the file, and what it was doing. Not just a number.

It also comes with security settings you can switch on right away. Close the settings attackers check first, limit login attempts, require strong passwords, and get told when a new administrator account appears.

Every switch explains what it does before you turn it on, and every one can be turned back off.

Free, no account needed

Twenty-four switches. None of them send anything to us.

Security

• Turn off XML-RPC, an old WordPress feature attackers use to guess passwords. You can also keep it and remove only the risky parts.
• Turn off the file editor, so nobody can change your theme or plugin code from inside WordPress.
• Stop people scanning your site to collect your usernames.
• Keep your username off your posts, so only your display name is shown.
• Remove the “Remember Me” box from the login form.
• Limit login attempts. If someone is locked out, the message tells them how long it lasts and who to contact.
• Require strong passwords, and block the common ones attackers try first.
• Get warned when a new administrator account is created.
• Hide the file list in your uploads folder.
• Turn off application passwords. These let apps sign in without using your login page.
• Close new sign-ups if your site does not need them.
• Slow down repeated password reset requests.

Speed

• Stop your site notifying itself every time you link to your own posts.
• Remove the emoji script that loads on every page.
• Remove tags from your page code that most sites never use.
• Slow down the admin auto-refresh that runs while you work.
• Stop loading the Dashicons icon font for visitors who are not signed in.
• Save the results of database queries your admin screens repeat.

Database

• Limit how many old copies of each post WordPress keeps.
• Keep the background task log shorter so it stops growing.
• Delete temporary data that has expired.

WooCommerce

• Block bots at your checkout. This runs on your site and sends nothing to us.
• Hide the WooCommerce status box on your dashboard.
• Turn off WooCommerce marketplace adverts.

Always running

• A small counter records how long your pages take, how much memory they use, how many database queries they run, and any errors. It adds up the totals every hour. None of it leaves your site.
• A record of what changed and when, so you can match “the site got slow this week” against “that plugin updated on Tuesday”.

What a free Carticy account adds

Connect a free account and you get a full check of your site: a health score, a score for each area, and a list of fixes in the order they are worth doing. You also find out if any of your plugins or themes have known security problems. A free account covers one check on one site.

What paid plans add

Fourteen more switches, plus monitoring and reports.

Security

• Two-step sign-in. Before it turns on, it checks that the code really reached you. It shows your backup codes once, and there is a command to switch it off if you are ever locked out.
• Security headers for your pages, tested on your live site first and only kept if everything still works.
• Automatic updates for plugins with known security problems. If one cannot be updated safely, it is switched off instead.
• A log of security events on your site, with the time each one happened.
• File permission checks that tell you what changed since your last check.
• Stop PHP files running from your uploads folder.
• Stop file lists showing in your uploads folder and every folder inside it.
• Shorter sign-in sessions for accounts that can change the site.

Speed and database

• Faster versions of some common slow database queries.
• Autoload optimizer, for the settings WordPress loads on every single page.
• Index manager, which adds the database indexes your queries are missing.
• Delete leftover data from posts, users and comments that were removed.
• WooCommerce: load product options in the background instead of all at once.
• WooCommerce: skip a slow scan on the product edit screen.

Monitoring and reports

• The full report: slow queries traced back to the exact file and line, slow code traced back to the plugin that added it, autoload size split up per plugin, and a written summary of what to fix first.
• Reports covering speed, security, SEO and WooCommerce.
• Checks on a schedule, compared against the last one, so you can see what got worse.
• Uptime monitoring and email summaries.
• Checkout reports for WooCommerce stores.

Plans start with Protect: one site, unlimited checks whenever you want, uptime monitoring, and all the switches. Growth adds checkout reports, scheduled deep checks and up to five sites. Agency plans cover ten sites and more. Current prices are at https://carticy.com/sitevitals

External Services

This plugin connects to one outside service, api.carticy.com, which is our own.

• What it does: runs the site check (speed, security, SEO, WooCommerce and page loading), looks up known security problems for your plugins and themes, returns suggested fixes, schedules checks and email summaries, and runs uptime monitoring on paid plans.
• What we receive: your site address, the names and versions of your plugins and themes, your WordPress, PHP and MySQL versions, database numbers such as autoload size, setting counts, temporary data counts and post detail counts, and the collected check data listed in the plugin’s privacy policy. No content is sent: no posts, no customer records, no comments. The only email address we ever receive is one you type into the optional marketing box below. The site check itself sends no email addresses at all.
• When it is called: only after you connect your site to a Carticy account through the first-run screens or the Settings page, and then either run a check, switch on a service such as email summaries, uptime or scheduled checks, or the once-a-day background call runs for a connected site. A new install with no connection makes no calls at all, apart from the box below.
• Optional marketing box: the first-run screens offer an unticked box for occasional product tips by email. Only if you tick it and enter an address does that address reach us. Leave it alone and nothing is sent. This is the one call an unconnected install can make, and only because you asked for it.
• Terms of service: https://carticy.com/terms
• Privacy policy: https://carticy.com/privacy

Nothing else contacts an outside server. Every Toolkit switch, checkout bot blocking, temporary data cleanup, admin caching, the change record and the performance counter all run on your own site.