Inherited WordPress sites are archaeology: Elementor templates nobody uses, two snippets fighting over one filter, a tracking tag loaded twice, redirects that chain into a 404.
Strata reads every layer (builder content, theme files, custom CSS, snippet plugins, four redirect plugins and the whole media library) and ranks what to fix first. You get one health score, a plain sentence about it, and the five things to do next.
Every finding says what to do
Down to which copy of a duplicated function to keep and which lines to delete. A finding names what’s wrong, why it matters, the fix, and every place it shows up.
Reading code without running it
Strata never executes the code it audits. PHP from the theme, snippet plugins and page builders is parsed into a syntax tree with PHP-Parser, and the facts are read off the tree: which functions, classes, constants and shortcodes each source defines, which hooks it adds or removes, and which ones sit behind a function_exists guard.
That’s what lets it say more than “duplicate found”. It knows the order WordPress loads things in (snippets first, then the child theme, then the parent), so it can tell a copy that will crash the site from one a guard makes harmless, and which copy to keep. The same pass finds filters that replace each other, a library loaded twice, two tags for the same tracking account, and CSS rules fighting over one element.
- Five snippet and code sources. WPCode, Code Snippets, Simple Custom CSS and JS, Elementor Custom Code and Astra hooks, alongside theme files, Customizer CSS, and Elementor and block editor content.
- Four redirect plugins. Redirection, Rank Math, Yoast Premium and Safe Redirect Manager, read side by side with Strata’s own redirects.
- Its libraries can’t collide. The PHP and CSS parsers it ships are moved into Strata’s own namespace with php-scoper, so another plugin’s copy can never load in their place.
Built for cheap hosting
Shared hosting kills long requests, so a scan is a queue of short batches on Action Scheduler. Each batch works to a time budget (20 seconds by default) and a memory budget of 60 percent of PHP’s limit, then saves its place. Eleven modules run in a fixed order, each through discover, process and finalize, and every step can pick up where it stopped.
Hosts still kill things. A one-minute watchdog requeues a scan that has stalled, work held by a killed batch is released, and the scan lock is taken the way WordPress core locks its own upgrades, so two runners can never scan at once. When a batch fails, it’s retried one item at a time, so one bad post doesn’t sink the rest.
The link checker doesn’t follow redirects itself, so chains and loops are visible, and it backs off when the server says it’s busy. A busy or slow server is reported as “could not check”, never as a broken link.
A score that stays fair
Content, code, CSS, links and conflicts each get a score out of 100. Findings are weighted by severity, repeats of one rule are capped so a single noisy issue can’t sink a score, and the total is scaled to the size of the site, so a small site and a large one are judged on the same terms. An area that wasn’t scanned, or whose scan failed, gets no score at all instead of a reassuring 100.
Fixes you can take back
Every fix saves a snapshot of what it will replace before it changes anything, then logs itself on the Activity screen. Undo restores from that snapshot, but only in places nobody has edited since, so taking a fix back never overwrites someone’s later work. Strata never edits theme files; for those it shows the exact lines to delete. Media goes to the trash, never straight to deletion.
Tested like a product
It’s more than 63,000 lines of PHP, checked by PHPStan and the WordPress coding standards, and it runs on PHP 7.4 and up. The suite has 599 unit tests and 2,637 integration tests, 163 browser tests across the free and Pro versions, and scale tests that hold every REST route to a time budget on a large site. New work starts with a failing test.
Every week a check on GitHub Actions installs the newest WordPress release and any beta, runs the suites against MySQL, then does a full scan with the current Elementor. A WordPress or Elementor release can’t break the plugin quietly.
Free and Pro ship from one codebase. Pro lives in its own folders, the free download is built without them, and a check fails the build if any Pro code leaks into it. The free edition is submitted to the WordPress.org directory and Pro is sold through Freemius. Everything in the admin also runs from WP-CLI: scan, status, resume, cancel, findings, fix, undo and report.
The product site
I also built its product site: static pages with no build step, and a check script that fails on an em dash, a colour outside the tokens, a broken link or a missing alt text.