Home Industries Sign in Run free audit
Free WordPress plugin

Website audit, SEO & security checks inside wp-admin.

Install it and you get instant health checks of your WordPress settings, no account needed. Connect a free Make It Flow account to run a full audit of your site and see the score, grades and copy-paste fixes on your dashboard.

Coming soon to WordPress.org Create a free account

The plugin is waiting for review by the WordPress.org plugin team. This page will link to it once it is approved.

Instant checks, no account

Read-only checks of your own WordPress install. They run on your server in a fraction of a second and send nothing anywhere.

  • Search engine visibility Warns when "Discourage search engines from indexing this site" is switched on.
  • HTTPS and site address Checks that your WordPress and site addresses use HTTPS and match.
  • Permalinks Flags the plain ?p=123 structure that wastes your URLs.
  • robots.txt and sitemap Confirms the robots.txt and the built-in XML sitemap are reachable.
  • Versions and updates Shows outdated PHP or WordPress and how many plugin and theme updates are waiting.
  • Risky settings Spots debug output shown to visitors and an administrator account called "admin".
  • Site icon Reminds you when no site icon (favicon) is set.

Full audit with a free account

Click Run audit in the plugin and our servers check your home page the same way the audit on this site does. You get an overall score, a grade per category and the most important issues with the fix to copy. The free plan includes 5 audits a day.

Speed Core Web Vitals and page-weight checks from a real page load.
SEO Titles, descriptions, headings, canonical, structured data and indexability.
Security HTTPS, TLS and the security headers your server sends.
Email and DNS SPF, DKIM, DMARC and DNS records, with the exact record to add.

Privacy and the data it sends

  • The local checks never contact Make It Flow.
  • When you connect, your browser opens makeitflow.si with your site address. After you approve, your site exchanges a one-time code for an access token, which is stored in your WordPress database and only works for auditing that one site.
  • When you run an audit, your site sends its home page address to makeitflow.si and reads back the result. The audit itself fetches your public pages, as any visitor would.
  • Usage statistics are off by default. Only if you tick the box, the plugin sends a one-way hash of your site address, the plugin, WordPress and PHP versions, your site language, and when it is installed, activated, deactivated or deleted. No IP address, email or content is stored with it.
  • Disconnecting or deleting the plugin revokes the token and removes all of its settings from your database.

See our privacy policy and terms. Already using it? Manage connected sites.