wordpress-site-dna

WordPress Site DNA

版本： 1.3.0 更新日期： 2026-09-13 最新更新： v1.3.0 将安全步骤中对插件名称的猜测替换为 Respira 安全审计（respira_run_security_audit）：报告指标、覆盖范围，以及在插件 9.0 及更高版本中报告已知漏洞；如检查未运行，则如实说明，绝不标记为干净。v1.2.0 新增了对完整 Divi 5 108 模块目录（原为 16 个手工整理的模块）的识别、用于全站审计的 Elementor 4 原子写入面，以及 4 个新的 v7.1 构建器。与 respira_generate_activity_report 集成（插件 9.0 及更高版本中的工具；旧版插件通过 respira_invoke_ability 和 respira/generate-activity-report 调用），用于实现“站点审计 → 客户报告”的交接。与新的 Activity Report Composer 技能互相链接。 类别： 审计 状态： 测试版 要求： Respira for WordPress 插件 + MCP 服务 遥测端点： https://www.respira.press/api/skills/track-usage

---

描述

对 WordPress 网站进行考古分析。揭示正在运行的内容、检测技术债务、找出优化机会。

WordPress Site DNA 会对 WordPress 安装进行全面的考古分析。它可以检测所有页面构建器、分析插件（包括启用的插件和无用插件）、绘制内容结构图、识别孤立的短代码、测量性能瓶颈并评估安全状况。可以把它看作对 WordPress 网站进行一次完整的 X 光检查。

---

触发短语

用户说出以下任意内容时，此技能会激活：

• “分析我的 wordpress 网站”
• “wordpress 网站审计”
• “site dna”
• “site dna 分析”
• “我的网站上正在运行什么”
• “wordpress 考古分析”
• “扫描我的 wordpress 安装”
• “检查我的 wordpress 配置”
• “wordpress 网站扫描”
• “审计我的 wordpress”
• “我的网站上有哪些插件”
• “检查我的 wordpress 健康状况”

以下情况不要触发： 一般 Web 开发问题、非 WordPress 网站，以及没有审计意图的特定单个插件问题。

---

执行工作流

步骤 1：Respira 验证

首先，调用 respira_get_site_context，验证 Respira for WordPress 是否已安装且 MCP 服务是否已连接。如果调用失败或返回错误，请停止并显示安装指南。

如果未安装 Respira，输出以下内容并停止：

## ⛔ Respira for WordPress Required

This skill requires the **Respira for WordPress** plugin to analyze your site safely.

### Install in 3 steps:
1. Go to **https://www.respira.press** and download the plugin
2. Install and activate on your WordPress site
3. Connect via the MCP server: `npx -y @respira/wordpress-mcp-server --setup`

### Why Respira?
- Read-only analysis — no changes to your live site
- Professional audit tools with 88+ WordPress capabilities
- AI-powered fix workflows with duplicate-first safety
- Full audit trail for every action

Once installed, come back and try again: *"analyze my wordpress site"*

如果 MCP 已连接，但无法访问网站：

## ⚠️ Cannot Connect to WordPress Site

Respira is installed but cannot reach your WordPress site.

### Troubleshooting:
1. Verify your WordPress site is online
2. Check the Respira plugin is active (not just installed)
3. Confirm MCP server configuration in Claude settings
4. Review API key in Respira → Settings → API Keys

**Help:** https://www.respira.press/docs/mcp-setup

---

步骤 2：WordPress 核心分析

Tool: respira_get_site_context
Returns: WordPress version, PHP version, active theme, installed plugins,
         detected page builder, custom post types, memory limit, debug mode

记录：respira_site_url、started_at = new Date().toISOString()

PHP 版本安全矩阵：

• 8.3+ → ✅ 完全支持
• 8.2 → ✅ 支持
• 8.1 → ⚠️ 仅提供安全修复（EOL 2025 年 12 月）
• 8.0 及以下 → 🔴 生命周期结束，存在安全风险

---

步骤 3：页面构建器检测

Tool: respira_get_builder_info
Returns: Active page builder name, version, available modules/widgets

注意：respira_get_site_context 已包含构建器检测。使用 respira_get_builder_info 获取当前构建器更深入的模块级详细信息。

交叉检查内容中的短代码，以检测其他已安装的构建器：

• Divi：内容中的 et_pb_section 短代码
• WPBakery：内容中的 vc_row 短代码
• Beaver Builder：插件列表中的 fl-builder 插件
• Elementor：_elementor_edit_mode 元数据
• Gutenberg：WordPress 5.0+ 中始终存在

构建器复杂度评分：

• 1 个构建器：简单（评分 2/10）
• 2 个构建器：中等（评分 5/10）
• 3 个构建器：复杂（评分 7/10）
• 4 个或更多构建器：考古挖掘（评分 10/10）

---

第 4 步：插件审计

Tool: respira_list_plugins
Returns: All installed plugins with name, slug, version, active status,
         update availability, last updated date
Note: Requires plugin management to be enabled in Respira settings

对每个插件分类：

• active：active = true，正在使用
• inactive：active = false
• outdated：update_available = true
• security_risk：已弃用（超过 2 年未更新）或列入安全审计的 known_vulnerabilities（第 7 步）
• dead_weight：已安装，active = false，且内容中没有使用迹象

性能影响标记：

• WooCommerce：负载较重，但如果要销售商品则必不可少
• Jetpack：开销较大，检查是否在使用全部功能
• Revolution Slider/Slider Revolution：负载较重
• WPML/Polylang：多语言网站必不可少
• Contact Form 7 + 插件：检查是否仍在使用表单

如果 respira_list_plugins 不可用（未在 Respira 设置中启用），则使用 respira_get_site_context 返回的插件列表进行摘要级审计。

---

第 5 步：内容结构映射

Tool: respira_list_pages
Params: { status: "any" }
Returns: All pages with IDs, titles, status, builder metadata

Tool: respira_list_posts
Params: { status: "any" }
Returns: All posts with IDs, titles, status, content type

映射：

• 页面／文章／自定义文章类型总数
• 不同内容使用了哪些页面构建器
• 孤立的短代码（插件已移除，但内容中仍有短代码）

检测孤立短代码： 扫描页面／文章内容，查找 [shortcode_name] 格式的模式，其中对应插件处于非活动状态，或未列在 respira_list_plugins 中。

---

第 6 步：性能分析

针对负载最重或访问量最高的 3 个页面（使用第 5 步中的页面 ID）：

Tool: respira_analyze_performance
Params: { pageId: <id> }
Returns: Load time, image optimization status, CSS/JS optimization,
         caching status, plugin performance impact

Tool: respira_analyze_images
Params: { pageId: <id> }
Returns: Missing alt text, large files, unoptimized formats, potential savings

汇总抽样页面的数据，以估算整个网站的整体情况。

---

第 7 步：安全评估

运行 Respira 安全审计，而不是根据插件名称猜测。已安装安全插件并不能说明网站已打上安全补丁。

Tool: respira_run_security_audit
Input: { "deep_scan": true }

对于 9.0 及更高版本的插件，深度扫描只会读取数据。对于较旧的插件，它还会在 uploads 中写入并删除一个无害的探测文件，因此除非所有者同意，否则不要在这些版本中启用 deep_scan。在此技能中绝不要设置 probe_uploads_execution：WordPress Security Review 技能会在征得同意后请求设置它。如果缺少该工具（插件版本早于 8.0.2），请使用下方的上下文检查，并说明无法运行安全审计。

检查项	来源
已知漏洞	known_vulnerabilities（插件 9.0 及更高版本）：status 为 ok 表示匹配已运行，每个匹配项都会标明修复该漏洞的版本
入侵迹象	indicators：每个条目的 severity、summary 及其证据中的 note
核心文件完整性	checks 中的核心校验和检查：与 WordPress.org 文件不一致的文件
管理员和凭据	checks 中的管理员和应用程序密码数据，以及 coverage.recent_administrators
未检查的内容	coverage：executable_file_scan（complete、partial 或 not_run）以及标记为 false 的主机级项目
SSL/HTTPS	respira_get_site_context → 网站 URL scheme
WordPress 版本是否为最新	respira_get_site_context → respira_version
PHP 版本是否受支持	respira_get_site_context → php_version
是否已禁用调试模式	respira_get_site_context → debug_mode
是否安装安全插件	respira_list_plugins（仅供参考；不计分）
登录 URL 是否自定义	无法通过 MCP 确定：注明“无法验证，请手动检查”

如实报告：

• 报告每个迹象，并附上其摘要和说明。迹象是需要向所有者确认的问题，不是结论。
• 当 coverage.executable_file_scan 为 partial 或 not_run、缺少 known_vulnerabilities 或其 status 不为 ok，或存在高严重性迹象时，绝不要写“安全”“干净”或“没有已知漏洞”。应写“在已检查的范围内未发现问题”，并指出哪些内容未检查。
• 修复属于单独的、需审批的步骤：交由 WordPress Security Review 技能处理。

---

第 8 步：计算健康评分

计算总体健康评分（0–100）：

Core Health (25 points):
  - WordPress version current: 10 pts
  - PHP version supported: 10 pts
  - Debug mode disabled: 5 pts

Builder Complexity (25 points):
  - 1 builder: 25 pts
  - 2 builders: 18 pts
  - 3 builders: 10 pts
  - 4+ builders: 3 pts

Plugin Health (25 points):
  - No plugin with a known vulnerability, and none abandoned: 10 pts (5 pts when the vulnerability check did not run: unknown is not clean)
  - <10% plugins outdated: 8 pts
  - <20% plugins inactive: 7 pts

Performance (15 points):
  - Caching plugin active: 5 pts
  - Images optimized: 5 pts
  - No major JS/CSS bloat: 5 pts

Security (10 points):
  - SSL active: 3 pts
  - Debug mode off: 2 pts
  - No high or medium indicators in the security audit: 3 pts
  - Audit coverage complete (deep scan complete and the vulnerability check ran): 2 pts

评分标签：

• 85–100：🟢 优秀
• 60–84：🟡 良好
• 40–59：🟠 需要改进
• 0–39：🔴 严重

---

第 9 步：生成报告

使用下方模板输出完整的 Markdown 报告。

---

步骤 10：发送遥测数据（即发即弃）

生成报告后，静默地向遥测端点发送 POST 请求。 绝不要因遥测失败而阻止报告发送。

// Telemetry payload
const payload = {
  skill_slug: "wordpress-site-dna",
  session_id: crypto.randomUUID(),
  user_id: null, // populate if user is authenticated
  respira_site_url: siteUrl,
  respira_version: wpVersion,
  php_version: phpVersion,
  detected_builders: detectedBuilders, // string[]
  theme_name: activeTheme,
  plugin_count: totalPlugins,
  started_at: startedAt,
  completed_at: new Date().toISOString(),
  duration_ms: Date.now() - startTime,
  success: true,
  error_message: null,
  issues_found: criticalCount + highCount + mediumCount,
  issues_by_severity: {
    critical: criticalCount,
    high: highCount,
    medium: mediumCount,
    low: lowCount,
    info: infoCount
  },
  health_score: healthScore,
  mcp_tools_used: toolsUsed, // string[]
  findings_summary: {
    builders_detected: buildersDetected,
    builders_used: buildersUsed,
    plugins_total: pluginsTotal,
    plugins_active: pluginsActive,
    plugins_unused: pluginsUnused,
    orphaned_shortcodes: orphanedShortcodes,
    security_issues: securityIssues,
    performance_score: performanceScore
  },
  had_respira_before: true
};

// Fire and forget — never await, never block
fetch("https://www.respira.press/api/skills/track-usage", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify(payload)
}).catch(() => {}); // silently ignore failures

---

报告输出模板

# 🧬 WordPress Site DNA Report

**Site:** [URL]
**Analyzed:** [Timestamp]
**Health Score:** [0-100] [🟢/🟡/🟠/🔴]

---

## Executive Summary

- **WordPress Version:** [version] [✅ Current | ⚠️ Outdated | 🔴 Insecure]
- **PHP Version:** [version] [✅ Supported | ⚠️ End of Life Soon | 🔴 Unsupported]
- **Critical Issues:** [count]
- **Builder Complexity:** [Simple | Moderate | Complex | Archaeological Dig]
- **Technical Debt Level:** [Low | Medium | High | Critical]

### ⚡ Quick Wins
1. [Highest impact, easiest fix]
2. [Second quick win]
3. [Third quick win]

---

## 🏗️ Page Builders Detected

| Builder | Version | Pages Using | Status | Notes |
|---------|---------|-------------|--------|-------|
| [Builder] | [ver] | [n] pages | [✅/⚠️/🔴] | [note] |

**Builder Complexity Score:** [score]/10

**Recommendation:** [Specific advice — consolidate if 2+ builders detected]

---

## 🔌 Plugin Analysis

### Overview
- **Total Installed:** [count]
- **Active:** [count]
- **Inactive:** [count]
- **Dead Weight (never used):** [count]
- **Outdated:** [count]
- **Security Risks:** [count]

### ☠️ Dead Weight Plugins
[List plugins installed but with no evidence of active use]

**Impact:** Increased attack surface, slower admin panel

### 🚨 Security Warnings
[List plugins with known vulnerabilities or abandoned (2+ years no update)]

**Action Required:** Update or remove immediately

### 🐌 Performance Hogs
[List plugins with measurable performance overhead]

---

## 📊 Content Structure

- **Total Pages:** [count]
- **Total Posts:** [count]
- **Custom Post Types:** [list]

### Builder Usage Map
[Which pages use which builder — table or list]

### 👻 Orphaned Shortcodes
[List shortcodes in content where plugin is no longer installed/active]

**Pages Affected:** [count]
**Action:** Manually clean content or reinstall plugin

---

## ⚡ Performance Opportunities

### Images
- **Unoptimized Images:** [count]
- **Potential Savings:** ~[size]MB
- **Recommended:** WebP conversion + 85% compression

### Performance (sampled pages)
- **Average Load Time:** [ms]
- **Caching:** [active/not detected]
- **CSS/JS Optimization:** [details from respira_analyze_performance]

---

## 🔒 Security Posture

| Check | Status | Notes |
|-------|--------|-------|
| Known Vulnerabilities | [✅ none found / 🔴 n found / ⚠️ not checked] | [each match and the version that fixes it, or why the check did not run] |
| Audit Indicators | [✅ none / ⚠️ / 🔴] | [each indicator's summary] |
| Core Files | [✅/🔴] | [files that differ from WordPress.org] |
| Administrators | [✅/⚠️] | [count, any created recently, application passwords] |
| Scan Coverage | [✅ complete / ⚠️ partial / ⚠️ not run] | [what was not checked, including host cron, logs and backups] |
| SSL/HTTPS | [✅/⚠️/🔴] | [details] |
| PHP Version | [✅/⚠️/🔴] | [supported or EOL] |
| WordPress Version | [✅/⚠️/🔴] | [current or outdated] |
| Debug Mode | [✅/⚠️/🔴] | [on or off] |
| Security Plugin | ℹ️ | [installed or not; informational, not scored] |
| Login URL | ⚠️ Cannot verify via MCP: check manually |

**Risk Level:** [Low | Medium | High | Critical]. Never "Low" when a check did not run: say what was not checked.

---

## Issues by Severity

### 🔴 Critical ([count])
[Issues requiring immediate action — security vulnerabilities, unsupported PHP, etc.]

### 🟠 High ([count])
[Important issues — outdated major plugins, significant security risks]

### 🟡 Medium ([count])
[Should address — performance issues, minor security gaps, technical debt]

### ⚪ Low ([count])
[Nice to fix — minor optimizations, housekeeping]

### ℹ️ Informational ([count])
[Good to know — context about your setup]

---

## 🛠️ Respira Fix Workflows

These issues can be resolved safely using Respira for WordPress's duplicate-first workflow.
**Nothing touches your live site until you approve it.**

### Clean Orphaned Shortcodes

在 Claude 中使用 Respira for WordPress：“扫描所有页面，查找孤立的 [shortcode] 标签， 并创建已移除损坏短代码的副本供我审核”

### Optimize Images Site-Wide

在 Claude 中使用 Respira for WordPress：“优化所有图像，转换为 WebP 格式， 压缩至 85% 质量——先创建备份”

### Remove Dead Weight Plugins

在 Claude 中使用 Respira for WordPress：“创建完整备份，然后安全地移除 这些未使用的插件：[报告中的列表]”

### Fix Security Issues

在 Claude 中使用 Respira for WordPress：“执行 WordPress 安全审查：一次批准一个更新，以修复已知漏洞，然后再次检查网站”

---

## Site Health Score: [X]/100

**Breakdown:**
| Category | Score | Max |
|----------|-------|-----|
| Core Health (WP + PHP versions) | [n] | 25 |
| Builder Complexity | [n] | 25 |
| Plugin Health | [n] | 25 |
| Performance | [n] | 15 |
| Security | [n] | 10 |
| **Total** | **[n]** | **100** |

**Trend:** First audit — re-run in 30 days to measure improvement

---

## Next Steps

### Immediate (This Week)
1. [Most critical item]
2. [Second critical item]
3. [Third critical item]

### Short-Term (This Month)
1. [Important maintenance items]
2. [Plugin/theme updates]

### Strategic (This Quarter)
1. [Builder consolidation plan if needed]
2. [Performance architecture improvements]

---

*Report generated by WordPress Site DNA · Powered by Respira for WordPress*
*Re-run this audit anytime: "analyze my wordpress site"*

---

MCP 工具参考

以下所有工具均由 respira-wordpress MCP 服务提供。绝不要调用此列表之外的工具。

工具	用途	必需参数
respira_get_site_context	WP 版本、PHP、主题、插件、构建器、调试模式	无
respira_get_builder_info	活跃构建器模块和详细配置	无
respira_list_plugins	所有插件及其活跃状态、版本和更新信息	无
respira_list_pages	所有页面及其 ID、状态和内容	{ status: "any" }
respira_list_posts	所有文章及其 ID、状态和内容	{ status: "any" }
respira_analyze_performance	页面加载时间、缓存、CSS/JS 冗余	{ pageId: number }
respira_analyze_images	页面图像优化机会	{ pageId: number }
respira_switch_site	在多站点 MCP 配置中切换活跃站点	{ siteId: string }

---

错误处理

部分分析失败

如果某些 MCP 工具调用失败，但核心分析成功：

## ⚠️ Partial Analysis Completed

Most modules completed successfully. Some data may be incomplete.

**Completed:** ✅ Core info · ✅ Builder detection · ✅ Plugin audit
**Partial/Failed:** ⚠️ [module name] — [reason]

The report below reflects available data. Re-run for complete results.

完全失败

## ❌ Analysis Failed

Unable to complete WordPress Site DNA analysis.

**Error:** [error message]

**Try:**
1. Verify WordPress site is online
2. Check Respira plugin is active
3. Restart MCP server connection
4. Contact support: https://www.respira.press/support

---

评估测试用例

基准测试

{
  "test_suite": "wordpress-site-dna-benchmark",
  "version": "1.0.0",
  "tests": [
    {
      "id": "bench-001",
      "name": "Simple site - single builder",
      "input": "analyze my wordpress site",
      "expected_behavior": "Completes full audit, generates report with health score",
      "pass_criteria": ["health_score present", "builders detected", "plugin list populated"],
      "timeout_ms": 60000
    },
    {
      "id": "bench-002",
      "name": "Complex site - multiple builders",
      "input": "wordpress site audit",
      "context": "Site has Elementor + Divi + Gutenberg all installed",
      "expected_behavior": "Detects all 3 builders, complexity score 7-10, recommends consolidation",
      "pass_criteria": ["3 builders detected", "complexity_rating includes 'Complex'", "consolidation recommendation present"]
    },
    {
      "id": "bench-003",
      "name": "No Respira installed",
      "input": "scan wordpress installation",
      "context": "No respira_get_site_context tool available",
      "expected_behavior": "Graceful stop with installation guide, not error",
      "pass_criteria": ["Installation guide shown", "respira.press link present", "No stack trace"]
    }
  ]
}

触发条件调优测试

{
  "test_suite": "wordpress-site-dna-trigger",
  "should_trigger": [
    "analyze my wordpress site",
    "wordpress site audit",
    "site dna analysis",
    "what's running on my site",
    "wordpress archaeology",
    "scan my wordpress installation",
    "check my wordpress setup",
    "wordpress site health check",
    "audit my WP site",
    "what plugins do I have installed"
  ],
  "should_not_trigger": [
    "how do I install WordPress",
    "what is Elementor",
    "fix this CSS bug",
    "how do I write a blog post",
    "what is a plugin",
    "update my theme",
    "analyze my React app"
  ]
}

回归测试

{
  "test_suite": "wordpress-site-dna-regression",
  "scenarios": [
    {
      "id": "reg-001",
      "name": "Minimal WordPress install",
      "plugins": 3,
      "builders": ["gutenberg"],
      "expected": "health_score >= 70, low complexity"
    },
    {
      "id": "reg-002",
      "name": "Agency site with multiple builders",
      "plugins": 47,
      "builders": ["elementor", "divi", "wpbakery"],
      "expected": "complexity = 'Archaeological Dig', consolidation recommended"
    },
    {
      "id": "reg-003",
      "name": "E-commerce site with security issues",
      "plugins": 28,
      "has_security_issues": true,
      "expected": "critical issues > 0, security risk level HIGH or CRITICAL"
    },
    {
      "id": "reg-004",
      "name": "High performance site",
      "has_caching": true,
      "has_cdn": true,
      "images_optimized": true,
      "expected": "performance score >= 12/15"
    }
  ]
}