Tool Kits 2.7.30 — Contextual Scanner & Health Center

Tool Kits 2.7.30 adds contextual security scanning and a manual WordPress Health Center. This release includes the unreleased 2.7.29 Health Center work.

Security scanner

• Verify complete async CSS handler patterns and approved Google Analytics/Tag Manager loader grammars before suppressing expected behavior.
• Keep recognized providers separate from custom destination trust. Deceptive hosts, arbitrary paths, extra statements, and sensitive-data transports remain reviewable or reportable.
• Separate Security Findings, Needs Review, and Suppressed Findings. Retain audit evidence, rule IDs, confidence, timestamps, and administrator restoration overrides.
• Group repeated public findings with occurrence counts and affected pages, while preserving distinct database records, DOM locations, and resources.
• Add severity/type/source/classification/action/confidence/page filters.
• Inspect discovered local CSS in bounded batches, detect supported executable/exfiltration patterns, reuse analyses, and retain reference hashes for integrity-change review.

WordPress Health Center

• Add a dashboard widget and a detailed manual scan page under Tool Kits → System Tools → Health Center.
• Show saved Security, Performance, SEO, and Compatibility scores with transparent coverage and measurement sources.
• Measure public homepage TTFB, profile uncached homepage database queries and slow WordPress HTTP requests, and snapshot server information.
• Separate overdue WP-Cron events from retained Action Scheduler failed jobs. Unavailable metrics remain explicitly unmeasured.
• Use English throughout the widget, scan controls, progress, and error messages. Opening the dashboard or report does not start a scan.

Upgrade notes

• No database table migration is required. Scanner metadata uses dedicated non-autoload options and expiring sessions.
• Replace legacy wildcard trusted-host entries with exact hostnames before starting a new scan. Hostname trust alone does not approve arbitrary JavaScript.
• Existing reports remain available. Run a new manual scan to apply contextual classifications; the scanner does not alter site content, CSS/JavaScript, plugins, or WordPress configuration.
• Provider recognition verifies static code/destination patterns, not remote content integrity, account ownership, or GTM container contents. CSS reference changes can result from legitimate deployments.

Validation

• 51/51 regression cases pass with PHP 8.4 and PHP 7.4.
• All 103 PHP files pass syntax checks on both supported test runtimes.
• Real-browser scanner tests verify report separation, filtering, restoration, inert evidence, and no automatic scan requests.
• Health Center tests verify permission/nonce/session checks, saved results, manual-only execution, measured homepage profiling, and error handling.

Install or update using the attached tool-kits.zip. SHA256SUMS records its SHA-256 checksum.