Every check in Shadow, and why it matters

Shadow is a free WordPress plugin that looks at your site and tells you what needs attention, in plain English. It runs on your own server and needs no account. This is the full list of what it checks, grouped by area, with what each check looks for and why it matters.

How it works

• Local-first. Everything runs on your own server. There is no cloud account or registration, and your site data never leaves your site.
• Review before it writes. When a fix would change something risky, you see the exact change before it is made.
• Reversible. Fixes apply with undo support, so one you don't like can be rolled back.
• Plain English. Findings are explained in language you can act on.

The 10 check families

There are 231 checks in the current release, in 11 categories that I've grouped into 10 pages.

• Accessibility (12 checks): These checks look at whether people who use a keyboard or a screen reader can get around your site: skip links, focus outlines, heading order, link styling, form error messages, button wording and the viewport setting.
• Code quality (7 checks): Leftovers from a fresh WordPress install.
• Database (12 checks): Database health.
• Design (17 checks): The pages and navigation a business site is expected to have: an about page, a contact page with a form, a homepage, menus, a logo, featured images and a copyright year that is still current.
• Monitoring (10 checks): Whether you would find out when something breaks.
• Performance (63 checks): The largest family.
• Security (46 checks): Hardening and everyday hygiene.
• SEO (28 checks): The search-facing basics for search engine optimization (SEO): titles and meta descriptions, canonical URLs, sitemaps, robots and noindex settings, schema, Open Graph and Twitter cards, permalinks and archives.
• Settings (29 checks): WordPress settings that are often left on their defaults.
• Health and workflows (7 checks): WordPress's own Site Health results and the PHP version, plus the scheduled-task (cron) checks that decide whether background jobs actually run.

Where this list comes from

I read each check straight from the plugin's source code, version 1.6251.1322 (September 8, 2026), so this list matches the release and not a marketing count. Shadow needs WordPress 6.4 or later and PHP 8.1 or later. The source is on GitHub, and the download page has the plugin.