Someone installs a plugin you'd never approve. Debug gets left on after a support call. An admin account appears and stays. Define your agency standard once — and score every site against it.
FROM $49/YEAR · LIFETIME OPTION · 14-DAY GUARANTEE
“Fifty sites, one standard — supposedly. Then a client's nephew installed a page builder we've never supported, three sites still ran PHP 7.4, and nobody could say which sites had debug logging on. Every support ticket was a lottery.”— the fleet that drifted, one small change at a time
Drift is invisible until it costs you an afternoon. WP Drift Auditor makes it a number on every site's dashboard.
Everything is read from the site itself — no external calls, nothing changed. The audit is instant and the score is on the dashboard every time you log in.
Approved plugins, banned plugins, minimum PHP and WordPress versions, admin account rules, permalink structure, cron mode, debug policy, update policy and security configuration. Or skip the typing: open your best-kept site and click Adopt this site as the baseline.
The baseline travels as a JSON file. Export it from the golden site, import it on every site you maintain — the whole fleet is measured against the same standard, and new takeovers get audited against it on day one.
0–100 on a compliance ring with a plain verdict — Compliant, Minor drift, Drifting, Severe drift. Weighted so a banned plugin or public debug output moves the number more than a permalink mismatch.
No vague warnings. "Core auto-updates are disabled — the standard is minor/security releases only." "5 admin accounts — the standard allows 3." Every deviation names what the standard says and what the site is doing instead.
Print-ready drift report carrying your logo, colour and agency name — the ring, the verdict and every finding. The evidence behind the re-alignment work you're about to quote.
An enforceable whitelist. Anything installed that isn't on the list counts as drift — active is major, installed-but-inactive is minor.
The plugins your agency never allows. Flagged the moment they appear on any site carrying the baseline.
Minimum versions for both, plus a flag whenever core falls behind the latest release.
Maximum admin count, banned usernames (goodbye, "admin"), and an optional rule that every admin email belongs to your agency domain.
The structure every site should use. Plain permalinks on a client site is a major finding — with a warning about fixing it carefully.
WP-Cron or a real server cron — whichever your standard says — plus overdue-job detection that catches a scheduler that quietly stopped keeping up.
WP_DEBUG, error display and SAVEQUERIES — with a per-site "debug allowed" switch so staging sites don't fail the audit.
Core auto-update posture, plugin auto-update policy, tolerated pending updates — plus HTTPS, the file editor, open registration and the table prefix.
One number for "how far has this site moved from our standard" — comparable across the whole fleet.
Compliant, Minor drift, Drifting or Severe drift — so the next action (ignore, fold into maintenance, or quote a re-alignment) is obvious.
Every finding names the standard and the deviation. Nothing to interpret, nothing to argue about.
The same agency-standard.json on every site — so two sites with the same score have drifted the same amount.
The alternative is a mental checklist, applied whenever someone remembers, by whoever happens to log in. Here's what changes.
| WP Drift Auditor (us) | Checking by hand | |
|---|---|---|
| The standard exists in writing | ✓ A baseline file | ✗ In someone's head |
| Unapproved plugins spotted | ✓ On every audit | ✗ When something breaks |
| Debug left on after support | ✓ Major finding | ✗ Found by a visitor |
| Admin-account creep | ✓ Counted & named | ✗ Nobody counts |
| Consistent across the fleet | ✓ Same baseline everywhere | ✗ Depends who checked |
| A number you can track | ✓ Compliance 0–100 | ◐ "Seems fine" |
| Client-ready evidence | ✓ Branded report | ✗ None |
| Fixes the drift for you | ◐ Read-only, by design | ◐ If there's time |
The auditor never changes a site — it measures. Fixing the drift stays a decision you make, with the evidence in hand. Full comparison →
Every plan includes every feature — all nine categories, adopt-as-baseline, JSON export/import and the branded report. You're only choosing how many sites.
Up to 10 sites
25 sites · for agencies
Up to 100 sites
Up to 100 sites, forever
Prices in USD. Licence keys are domain-based — no accounts, no phoning home. VAT invoices available.
Nine categories, all read live from the site with no external calls: the approved-plugin whitelist, banned plugins, PHP and WordPress minimum versions, administrator accounts (count, banned usernames, agency email domain), permalink structure, cron configuration, debug settings, update policy and security configuration. Every deviation is listed as expected vs actual.
Define it once. Open the plugin on your best-kept site and click "Adopt this site as the baseline" — its plugins, versions and settings become the standard. Export the baseline as a JSON file, then import it on every site you maintain. The whole fleet is now measured against the same standard, and the import side is never locked.
A 0–100 figure from the weighted drift findings, shown on a compliance ring with a plain verdict: Compliant, Minor drift, Drifting or Severe drift. Majors (a banned plugin active, debug printing to visitors, no HTTPS) weigh more than minors (a permalink mismatch, one admin over the limit).
No — deliberately. It is read-only: it measures and reports, and never changes the site. Whether a deviation gets fixed, billed or accepted is an agency decision; the auditor makes sure it stops being invisible.
Yes. The baseline has a per-site "WP_DEBUG allowed" switch, so a staging site can run debug without failing the audit while production sites are still held to the standard.
Yes. Produce a branded, print-ready drift report (your logo, colour and agency name) with the compliance ring, the verdict and every finding — evidence for the remediation work you're about to quote.
Order through the form and your licence key and invoice arrive by email, usually within the hour. Keys are domain-based — no account, no phoning home, no lock-in.
14-day money-back guarantee, no questions. Email us and we refund you.
Order below and your licence key and invoice arrive by email — usually within the hour. Adopt your golden site as the baseline, export it, and start importing it across the fleet the same afternoon.
14-DAY MONEY-BACK GUARANTEE · SUPPORT BY ACTUAL HUMANS