WordPress settings checks in Shadow

WordPress settings that are often left on their defaults: site title, language and timezone, comments and discussion, updates, email deliverability and SMTP, registration, media, and maintenance mode.

There are 29 checks in this family. Shadow reports what it finds, and nothing is changed until you approve a fix.

In this family

What each check looks at

Admin Email Deliverable

Checks whether the WordPress admin email address is valid and not using a generic placeholder, ensuring site notifications are deliverable.

Admin Email Uses Own Domain

Checks whether the WordPress admin email address uses the site's own domain rather than a free consumer email provider. Using a @gmail.com or @hotmail.com address for site notifications looks unprofessional and reduces deliverability of transactional emails.

Auto-Update Policy

Checks whether WordPress core automatic updates have been completely disabled, leaving the site without background security patching.

Comment Policy

Checks whether WordPress comments are open by default without comment moderation, which exposes the site to spam and unreviewed public content.

Comment Spam Backlog Managed

Checks that the spam comment queue is not excessively large. A large backlog wastes database space and signals that spam filtering is not working.

Comments Auto Close Old Posts

Checks whether WordPress is configured to automatically close comments on posts older than a set number of days. Leaving comments permanently open on all posts is an ever-growing spam surface.

Checks that a recognised cookie consent or GDPR compliance plugin is installed and active, as required for sites serving EU and international visitors.

Date Time Format

Checks whether the date and time display formats match the convention expected by the site's locale. A UK or Australian business showing US-style dates (e.g. "January 5, 2025") looks unprofessional to local visitors.

Default Category Renamed

Checks whether the WordPress default post category has been renamed from "Uncategorized". New posts inherit this category automatically, so an unnamed default creates low-quality URLs and category archive pages.

Default User Role

Checks whether the default role assigned to new user registrations is a safe, low-privilege role such as Subscriber rather than an elevated role.

Discussion Defaults

Checks whether WordPress discussion settings, comments, pings, and moderation, have been intentionally configured to prevent spam and unmoderated content.

Front Page

Checks whether WordPress is set to show a static front page and that the assigned page is published and accessible.

Checks whether the published privacy policy and other legal pages are linked somewhere in the site footer for compliance and visitor trust.

Mail Sender

Checks whether the WordPress outgoing mail sender name and email address have been customized from the generic WordPress defaults.

Maintenance Mode Off

Checks whether the site is currently in maintenance or coming-soon mode that is blocking real visitors from accessing the site.

Media Sizes

Checks whether WordPress media size settings have been customized from factory defaults, which may otherwise generate unnecessarily large or poorly-sized images.

Media Year Month Folders Enabled

Checks whether WordPress is organising media uploads into year/month subdirectories. When this is disabled, every uploaded file lands in a single flat uploads/ folder, which creates filesystem performance issues and makes manual file management impractical as the library grows.

Pingbacks and Trackbacks

Checks whether pingbacks and trackbacks are enabled by default on new posts, which exposes the site to link spam and DDoS amplification abuse.

Posts Per Page Optimized

Checks whether the "Blog pages show at most" setting is within a sensible range. Very high values load excessive content on a single page, slowing performance; very low values bury content and hurt crawlability.

Registration Setting

Checks whether open user registration is intentional and restricted to a safe default role to prevent unauthorized account creation.

Why it matters. Checks whether open user registration is enabled and, if so, whether the default role is low-privilege. Flags when registration is open with a high-privilege default role, or as a medium finding when it is open with a safe role but potentially unintentional.

Site Charset UTF-8

Checks whether the WordPress blog_charset option is set to UTF-8. Sites migrated from legacy hosting sometimes carry an ISO-8859-1 or other charset that causes character encoding errors in page content, RSS feeds, and REST API responses.

Site Language

Checks whether the WordPress site language has been explicitly set to match the business audience, rather than left at the server default or left as the installer default of en_US.

Site Title And Tagline

Checks whether the site title and tagline have been updated from the WordPress default placeholder values that appear in browser tabs and search results.

Site URLs Correctly

Checks whether the WordPress Address and Site URL are both using HTTPS and are consistent with each other to avoid redirect loops or mixed content.

SMTP

Checks whether an SMTP or transactional email plugin is active to ensure outgoing emails are reliably delivered rather than relying on PHP mail().

Timezone

Checks whether the WordPress timezone is set to a named region timezone rather than a generic UTC offset, which affects scheduled tasks and date displays.

Trash Auto Empty Configured

Checks whether WordPress is set to automatically empty the trash. When EMPTY_TRASH_DAYS is 0, deleted posts and attachments accumulate in the database indefinitely, bloating the wp_posts table.

Update Services

Checks whether the WordPress ping/update services list has been intentionally configured. For non-blog business sites that do not publish regular posts, auto-pinging blog aggregators adds no value.

Upload Size Configured

Checks that the maximum upload size is at least 16 MB and that post_max_size is strictly larger than upload_max_filesize, preventing silent upload failures for images, PDFs, and media files.

The other check families

Shadow is free and runs on your own server, with no account. The source is on GitHub, and these descriptions come from it.