WordPress diagnostics extension for Microsoft Edge

Choose the check that fits the problem

Review site health, known vulnerability matches, security headers, current availability, public plugin clues, WooCommerce signals, robots.txt, XML sitemaps and AI readiness. PHP checks ask for a target version. A plugin vulnerability lookup uses the plugin slug and installed version you supply.

The XSS2Shell check sends a non-destructive login-page probe and requires confirmation that you own the site or have permission. No check signs into WordPress, installs software or submits an order.

Public evidence has limits. Hidden plugins, unavailable responses and missing versions remain unverified. A passing check does not establish that a site is secure, and an availability check is a snapshot rather than continuous monitoring.

Extension privacy and data use

The extension reads the active tab address when you open it. It does not request browsing-history, cookie or password permissions, and does not automatically scan pages as you browse.

When you run a check, the displayed public URL and the tool's required inputs are sent to BugShield. Account and dashboard paths default to the public site root. Credentials are rejected; fragments and query details are removed, apart from numeric sitemap page parameters. Review the address before submitting a page whose path contains private information.

BugShield's server retrieves public website responses and uses the relevant diagnostic providers. Software and performance checks can query vulnerability databases, WordPress.org metadata or performance services. Those requests use the public website or software details needed for the check, without your browser cookies or WordPress login.

When you run a check, the extension automatically starts a limited diagnostics session lasting up to one hour. You stay in the popup throughout. Server limits control session creation and scan usage; this session does not authorise account actions.

The extension keeps its diagnostics session and its latest result in browser session storage. Closing the popup preserves that state; ending the browser session clears it. Clear local session removes it immediately. This does not cancel a check already submitted to the server.

Server job records expire automatically, using expiry windows of up to one hour that can renew as processing progresses. Abuse counters use hashed client identifiers and expire within 24 hours. Network providers and security logs also process connection information. The extension does not offer report emails or advertising tracking.