Shadow by Christopher Ross is a WordPress diagnostics plugin that runs entirely inside your own install. It looks over your site the way I would on a first pass: 230 checks across accessibility, performance, security, SEO, code quality, and more, each one written up in plain language with a clear next step. No account to create. Nothing uploaded anywhere. You install it, you run a scan, and you get a readable report on what’s healthy and what needs attention.
Why it exists, in full, is at the bottom of this page. The short of it: I needed a tool that would tell me the truth about a site without phoning home to a stranger, and the ones I tried wouldn’t. So I wrote one.
What’s inside
Shadow ships with 230 display-ready diagnostics, grouped into 11 categories so you can read the parts that matter to you and skip the rest:
- accessibility
- code quality
- database health
- design
- monitoring
- performance
- security
- SEO
- settings
- WordPress health
- workflows
Each finding explains what it checked, what it found, and why it matters, in language a site owner can act on without a developer sitting next to them. Where a finding has a fix, Shadow offers a treatment. Lower-risk treatments apply with one click and keep an undo, so you can put the site back the way it was if you change your mind. Higher-risk changes are review-first: Shadow shows you the exact change before it writes anything, and waits for you to approve it. A handful of items are guidance only, where the right move depends on judgement Shadow can’t make for you.
Scans run on demand, whenever you click the button. You can also set an optional schedule if you’d rather Shadow check in on its own. Treatments are always opt-in. Shadow never changes a live site on its own.
Who it’s for
Shadow is built for the person who owns or runs a WordPress site and wants to know its real condition without hiring that out every time. If you can find your way around the WordPress dashboard, you can read a Shadow report and understand it. You don’t need to be a developer.
It’s also genuinely useful to the people who do this for a living. I run it myself on client sites as a first-pass triage before I quote a project, because it surfaces in ten minutes what used to take me an afternoon of poking around. If you maintain sites for other people, Shadow gives you a consistent checklist that doesn’t depend on whatever you happened to remember that day.
How to install and verify
- Download the .zip using the Download button below.
- In your WordPress dashboard, go to Plugins → Add New → Upload Plugin, choose the .zip, and click Install Now.
- Activate the plugin. You’ll find Shadow in the dashboard menu.
- Run your first scan. It works on the spot, with no setup wizard and no key to paste in.
If you want to confirm the “local-first” claim rather than take my word for it, open your browser’s developer tools, switch to the network tab, and run a scan. You’ll see the scan makes no third-party requests. Everything happens between your browser and your own server. That’s the whole point, and it’s checkable.
Shadow is also coming soon to the WordPress.org plugin directory, where it’s currently in review. Once it lands there, you’ll be able to install it straight from the dashboard search the same way you would any other plugin.
How it differs from the alternatives
Most site-audit tools route your data through their own servers. That’s how they offer the headline feature, the one that says “here’s how your site compares to 10,000 others.” That comparison is real, but it’s only possible because a vendor is collecting data from a fleet of customer sites to build the baseline. I decided not to do that, which means Shadow can’t show you that benchmark. It’s a fair trade to name out loud: you give up the comparison, and in return nothing about your site ever leaves your install.
Three things follow from that choice. There’s no account to create, so there’s nobody holding your audit history on a server you don’t control. Every check runs locally, so the tool works behind a VPN, on a staging box, or on a site with no outbound internet access at all. And the diagnostics aren’t paywalled, so you don’t hit a wall halfway through a report where the actually useful finding is locked behind an upgrade.
What Shadow doesn’t do
Shadow is a diagnostics-and-fixes tool, and I’d rather be clear about its edges than let you find them the hard way.
It doesn’t back up your site. The earlier versions of this plugin included a full-site backup and restore feature; that’s now its own separate plugin, because backups are a serious enough job to deserve their own focus. What Shadow does keep is narrower and worth understanding: when a treatment modifies a file, it saves a reversible snapshot of that one change so you can undo it. That is not a backup of your site, and you should still keep a real backup running.
It won’t compare your site against a fleet of others, for the reason above, and it won’t run changes against a production site unattended. Where a decision genuinely needs a human, Shadow gives you guidance instead of a button.
Requirements
- WordPress 6.4 or newer
- PHP 8.1 or newer
- An existing WordPress install to run it against
File details
- Version: 1.6165
- Last updated: June 14, 2026
- Format: .zip
- License: GPL-2.0-or-later
- Tested with: WordPress 7.0
- Requires PHP: 8.1+
Other downloads from this practice
- WordPress WebP Plugin. Auto-convert new image uploads to WebP at upload time.
- WP Title Case. Auto-format titles, headers, and feeds to title case.
- Protect wp-config.php. Block direct browser access to your config files.