How to Run a WordPress Website Health Check in WP Umbrella: 8 Steps

A WordPress website health check tells you whether a site is up, current, secure, and backed up before anyone changes a thing. We run ours in WP Umbrella, the dashboard our team uses to deliver our WordPress maintenance services, and WooNinjas is now a WP Umbrella partner.

This guide walks through the eight steps we follow, using real results from one of our own test sites, a WooCommerce store we checked on October 12, 2026. For each step, you’ll see where the data lives in WP Umbrella and how we acted on it.

At first glance, the store looked healthy, with 100% uptime. Underneath, it had no backups, a security score of 15 out of 100, and 11 known vulnerabilities, so the check ended with one decision for the owner and a safe order for every fix.

How to check WordPress site health?

Check WordPress site health in two layers. Start with the Site Health screen built into WordPress, which tests how the site is configured right now, then connect the site to WP Umbrella to track uptime, updates, vulnerabilities, and backups over time. These eight steps make up the full WordPress website health check we ran on our test site.

1. Run WordPress’s built-in Site Health check
2. Connect the site to WP Umbrella
3. Check uptime, SSL, and domain expiry
4. Check performance and broken links
5. Review pending updates and PHP errors
6. Scan for vulnerabilities and read the security score
7. Confirm backups before changing anything
8. Rank the fixes and run safe updates

1. Run WordPress’s built-in Site Health check

Open Tools > Site Health in the WordPress dashboard. The Status tab sorts results into critical issues, recommended improvements and passed tests, and the Info tab can export your setup details for a developer.

Fix critical items such as an outdated PHP version first, and our guide on how to update PHP in WordPress covers that one step by step. The WordPress Site Health screen only reflects the moment you open it, so it can’t tell you whether the site went down last week or whether a plugin has a known flaw.

2. Connect the site to WP Umbrella

Copy your API key from the WP Umbrella dashboard. In WordPress, go to Plugins > Add New, search for WP Umbrella, then install and activate the plugin. Open Settings > WP Umbrella, paste the key and save.

The site then appears as a row on the WP Umbrella dashboard, with its performance score, pending updates, security score, PHP issues and backup status. Our test site came in at a performance score of 73, 16 pending updates, a security score of 15 out of 100 and 21 PHP issues.

3. Check uptime, SSL and domain expiry

Open Monitoring > Uptime. WP Umbrella checks the site from one location you choose (Europe, USA West, USA East, Asia or Australia) at an interval between 2 and 60 minutes, with 30 minutes as the default.

Our test site, checked every 30 minutes from EU West, had 100% uptime over 30 days. The same screen showed the SSL certificate expiring in about two months, and WP Umbrella’s daily digest flags any domain or certificate with 30 days or less left.

4. Check performance and broken links

WP Umbrella runs Google Lighthouse performance tests that follow the same method as PageSpeed Insights. It refreshes the score every 5 days, and you can request a manual rescan once every 24 hours.

Broken links sit under Monitoring > Broken links. The scan runs as soon as you enable it, then every 48 hours, listing the worst pages first. From each one, you can highlight the link on the live page or create a 301 redirect, while ignoring a link only hides it from the dashboard.

5. Review pending updates and PHP errors

Under WordPress Management, the Plugins, Themes, and Core tabs list every update waiting. Our test site had 15 plugin updates and one theme update, WooCommerce included. For a schedule to follow after day one, our guide on how often to update a WordPress website breaks it down by site type.

The PHP issues count comes from WP Umbrella’s PHP error monitoring. Each entry logs the error message, file, line number and a backtrace, along with the PHP, WordPress and plugin versions involved, which tells you which plugin to test first.

6. Scan for vulnerabilities and read the security score

WP Umbrella checks every connected site against Patchstack’s vulnerability database every 6 hours, and that comes with every account. Each finding shows its severity and the version that fixes it.

Our scan found 11 known vulnerabilities, 6 rated high and 5 rated medium. The urgent one was a privilege escalation flaw in WooCommerce 11.1.0, fixed in 11.2.1, and three of the high-rated flaws sat in plugins that were switched off.

The security score explains the 15 out of 100. Known vulnerabilities can take up to 70 of the 100 points, at 15 points per high-rated flaw, so our six high-rated issues alone hit that cap. Another 10 points go while the Security add-on’s virtual patching is off, and each inactive plugin or theme costs one more point.

If a scan suggests a site has already been compromised, our WordPress security services team takes over with malware cleanup and hardening.

7. Confirm backups before changing anything

Open the Backups tab. Our test site had none on record, so backups were the first fix and the owner’s first decision.

To set them up, choose what to include in Content Selector, where cache files are excluded by default), then pick a frequency and time under Scheduling. WP Umbrella backups are incremental, kept for 50 days on servers in France, and manual backups are capped at 3 per month per site.

There’s a second reason to start here. WP Umbrella’s malware scanner runs after each backup and can’t run a standalone scan, so a site with no backups also has no malware scanning.

8. Rank the fixes and run safe updates

Fix in this order: backups, then security updates for active plugins, then vulnerable inactive plugins, then everything else. Claude’s first ranked plan on our test site put the plugin fixes ahead of backups, even though its own note said to back up before updating, which is why a person signs off on the order.

For the updates themselves, WP Umbrella’s update dialog offers three modes.

Here’s how they compare, based on WP Umbrella’s documentation:

Update mode	What it does	Good fit for
Quick Update	Runs WordPress’s classic bulk upgrade function	Low-risk plugins on simple sites
Classic Safe Update	Updates with a backup of the plugin folder	Everyday plugin updates
Advanced Safe Update	Classic safe update plus visual regression testing, with manual review or automatic rollback	Stores, checkouts and busy pages

If an update still breaks something, WP Umbrella can roll a plugin back to an earlier version. Themes and WordPress core can’t be rolled back, so they rely on a restore, which can bring back the whole site, just the database or selected files.

On a store, the visual check in Advanced Safe Update earns its extra minutes. Our WooCommerce maintenance service also tests updates on staging before they reach the live store.

How can Claude speed up a WP Umbrella health check?

WP Umbrella’s MCP connector lets Claude read every site in your account and answer in plain English from live data. It’s hosted by WP Umbrella, signs in with your account and starts out read-only, with write access as a separate switch and every action logged.

These are the prompts we used on our test site, and what came back:

What we asked Claude	What came back
Which sites are down right now?	None. The test site was up, with 100% uptime over the last 30 days.
Which have known vulnerabilities?	Eleven, with a note that backups were off and one should be taken before updating.
Which sites need attention first?	A ranked plan: update the vulnerable active components, then turn on backups.
Summarize this month and draft a short client message. Do not make any changes.	Four summary figures and a draft message that opened with backups.

When we asked Claude to update WooCommerce, it stopped at a confirmation prompt and waited for one of our ninjas. WP Umbrella’s documentation also notes that the connector doesn’t take a backup before updating, so we ask for one first.

Our post on what WordPress AI can do covers where tools like this help and where they still fall short.

How do you turn the results into a health check report?

WP Umbrella’s maintenance reports turn a WordPress website health check into an email with an optional PDF. You pick the sections, such as uptime, performance, updates, security and backups, arrange them by drag and drop, and send them manually or on a weekly, monthly or quarterly schedule.

Reports can go out from your own domain with your logo, cover and colors, and recipients pre-fill from the clients linked to each site. For day one, we also had Claude draft a short message that opened with the owner’s one decision.

Before anything reaches you, our ninja team checks every number against the WP Umbrella dashboard.

What does WP Umbrella’s Security add-on add?

Vulnerability monitoring, hardening toggles and two-factor authentication for admins come with every WP Umbrella account. The paid Security add-on adds protection that works between scans and updates:

Feature	Every account	Security add-on
Vulnerability monitoring against Patchstack’s database	Included	Included
Hardening toggles and admin two-factor authentication	Included	Included
Firewall and virtual patching	Not included	Included
Malware scanner, run after each backup	Not included	Included
Security-driven activity log	Not included	Included
Malicious-IP login blocklist	Not included	Included
Malware cleanup	Not included	On request

Virtual patching blocks known exploits before the fixing update goes on, and WP Umbrella says plainly that it buys time and leaves updates and backups as the lasting fix.

How do WooNinjas maintenance plans use WP Umbrella?

We run every WordPress website health check in WP Umbrella, and our partnership means the tool and our team work from the same data. WP Umbrella watches the site around the clock, and on any WordPress maintenance plan, our ninjas decide what to fix, test it, and tell you what changed.

Each WordPress maintenance plan sets its own cadence after day one, as listed on our maintenance page:

Plan	Updates	Reports and reviews	Monitoring and security
Explorer	Monthly plugin, theme and core updates	Automated monthly maintenance report	Essential security patching and backups
Hiker	Weekly updates with staging tests	Monthly site audit plus custom code monitoring	5-minute uptime checks and hosting backups
Climber	Weekly updates	Monthly reports with insights and a monthly manual review	Real-time monitoring, malware scan and WAF, plus a dedicated support manager

Course sites get the same checks plus a look at enrollments and quizzes after each update. If your platform is Tutor LMS, our Tutor LMS maintenance plans are built around it.

Frequently asked questions

What is a WordPress website health check?

It’s a review of a site’s uptime, updates, known vulnerabilities, backups and errors that ends in a ranked list of fixes. Run on day one, it gives the owner and the maintenance team the same starting point.

How to check the health of a website?

Check whether it’s up, what’s out of date, what’s vulnerable and whether backups exist. On WordPress, the built-in WordPress Site Health screen covers configuration, and a dashboard like WP Umbrella covers uptime, updates, vulnerabilities and backups over time.

How can I check my WordPress site for malware?

Run a WordPress malware scanner that checks your files against known malware signatures and the official versions of core, plugins and themes. WP Umbrella’s scanner, part of its Security add-on, runs after each backup. If it confirms malware, have the site cleaned or restore a clean backup, then patch the way in.

Can AI make changes to my WordPress site without permission?

Not with the setup we use. WP Umbrella’s MCP connector starts out read-only, write access is a separate switch and each action can be set to allow, ask or block. On top of that, our ninjas approve every change before it runs.

How is a health check different from a full WordPress site audit?

A health check looks for what could break or get exploited soon. A full WordPress site audit adds speed, SEO, accessibility and code quality reviews, so it takes longer, and we schedule it through your WordPress maintenance plan.

How often should you run a WordPress website health check?

Run the full check on day one, then let monitoring carry it. In WP Umbrella, uptime checks run every 2 to 60 minutes, vulnerability checks every 6 hours, broken link scans every 48 hours and performance tests every 5 days, while updates and reports follow your plan’s cadence.

Ready to know where your site stands?

A WordPress website health check in WP Umbrella turns a site that looks fine into a clear plan. On our test site, that meant one decision about backups, then updates in a safe order, checked by a person at every step.

Every WooNinjas plan keeps that first check going with scheduled updates and a monthly report. Pick the WordPress maintenance plan that fits your site, and our ninjas will start on day one.