=== CatCode Site Doctor ===
Contributors: catcodestudio
Tags: php compatibility, php 8, site health, compatibility checker, troubleshooting
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.2
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Find out which plugins and themes break on your next PHP version, with the file, the line and the fix, and get site health checks that say what to do.

== Description ==

Hosts are moving sites off old PHP versions: PHP 8.1 gets no security fixes since the end of 2025, PHP 8.2 loses them at the end of 2026. The question is always the same: will the site still work after the switch?

Site Doctor reads the code of your plugins and themes and compares it with what changed in PHP from version 7.0 to 8.5. It runs on the PHP you have today (7.2 or newer) and tells you, before anything is switched, which plugins will stop working on the version you are moving to. It works on any WordPress site, with any plugins, and needs nothing else installed.

**The PHP check**

* Pick the PHP version you are moving to: 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 or 8.5. The report switches between versions without scanning again.
* A verdict for every active plugin and theme, must-use plugins and drop-ins: **Will break**, **Encoded — ask the vendor**, **Works differently**, **Deprecation notices**, **Ready**.
* For every finding: the file, the line, the code, what changed in PHP, since which version, and how to fix it, with a link to the PHP migration guide.
* Plugins with an update waiting are marked "update first, then scan again" — when the update itself supports the new PHP.
* CSV export (comma or semicolon) for your developer, your host's support or the plugin's author.
* A Site Health test: Tools → Site Health shows how many active plugins would break.
* WP-CLI: `wp catcode-doctor scan`, `wp catcode-doctor report --target=8.4`, `wp catcode-doctor export report.csv`, `wp catcode-doctor health`.

**What it finds**

* Code that no longer loads at all — the whole file fails: curly-brace offsets (`$text{0}`), nested ternaries without parentheses, the `(real)` and `(unset)` casts, `=& new`, classes named after new reserved words (`mixed`, `never`, `readonly`, `match`), a function called `match()` or `__autoload()`.
* Removed functions: `each()`, `create_function()`, `get_magic_quotes_gpc()`, `money_format()`, `split()`, the `ereg` family and many more.
* Extensions taken out of PHP: `mysql_*` (PHP 7.0), `mcrypt_*` (7.2), `xmlrpc_*` (8.0), `imap_*`, `pspell_*` and `oci_*` (8.4).
* Removed constants, calls that turned into fatal errors (`implode()` with the array first, `parse_str()` without a result, `mktime()` without arguments), and code that silently does something else: old-style constructors that no longer run, `is_resource()` on handles that became objects, `define()` with case-insensitive constants, `assert()` with code in a string, `preg_replace()` with `/e`.
* Deprecations of every version up to 8.5: implicitly nullable parameters (8.4), missing return types on `Countable`, `ArrayAccess`, `Iterator`, `JsonSerializable` and other PHP interfaces (8.1), `utf8_encode()` (8.2), `strftime()` (8.1), `FILTER_SANITIZE_STRING` (8.1), `E_STRICT` (8.4), CSV functions without the escape argument (8.4), `curl_close()` and `imagedestroy()` (8.5), the backtick operator and non-canonical casts (8.5) and others.
* ionCube- and SourceGuardian-encoded files — they cannot be read, so the report tells you to ask the vendor.

Code that already copes with both versions — inside a check of the PHP version, `function_exists()`, `extension_loaded()` or `defined()`, or a plugin that ships its own replacement of a removed function — is shown as "guarded" and does not count against the plugin.

**Site health checks**

Each check reads the live site. When something is wrong, it says what it means and exactly what to do, with a link to the right screen.

* Updates: PHP support dates, WordPress, plugins and themes with updates, plugins not tested with recent WordPress releases, unused plugins and themes.
* Security: HTTPS, PHP errors shown to visitors, a debug log anyone can download, the code editor, an administrator called "admin", registration that gives administrator rights, wp-config.php permissions, the file list of the uploads folder.
* Server: PHP memory, upload limits, `max_input_vars`, the time limit, PHP extensions, free disk space.
* Database: version, character set, options loaded on every page (with the biggest ones named), expired cache records.
* Settings: scheduled tasks that run late, whether the site can reach itself, "Discourage search engines" left on, plain page addresses.

**Your server**

* The PHP version, until when it gets security fixes, and whether a newer patch release of the same branch exists (with a note about Linux distributions that backport fixes without changing the number).
* Whether your WordPress version supports the PHP you are moving to.
* The ionCube Loader, and the extensions loaded today that the new PHP no longer ships.

**How it works**

The plugin reads the PHP files with PHP's own tokenizer. Nothing is executed, included or changed, and no code leaves your server. The scan runs in short steps, so a site with dozens of plugins does not hit the server's time limit; you can leave the page and continue later.

A scan of the code cannot see everything that happens while the site runs — for example a `null` passed to a PHP function or a property created on the fly. Such cases appear as deprecation notices in the PHP error log after the switch.

// @pro-start
**Pro**

* Runtime log: records PHP deprecation notices and fatal errors while the site runs, grouped by plugin and theme — turn it on before the switch and read it after.
* Conflict test: switch plugins and the theme off in your browser only, then turn them back on one at a time until the problem returns. Visitors and other administrators keep the normal site, and the test ends by itself after two hours.
* A plugin or theme is scanned again right after WordPress updates it.
* A weekly scan in the background with an e-mail report that also lists the site health problems.
// @pro-end

== External services ==

When "Latest PHP releases" is on (the default), the plugin asks php.net which release is the latest in each PHP branch and until when each branch gets security fixes, so it can tell you whether your PHP is up to date.

* Service: php.net release information, https://www.php.net/releases/branches.php
* When: when the plugin's screen or the Site Health test needs the data, at most twice a day (the answer is cached for 12 hours).
* Data sent: none besides the request itself (your server's IP address and a standard WordPress user agent, as with any web request). Nothing about your site, plugins or users is sent.
* Terms and privacy: https://www.php.net/license/ and https://www.php.net/privacy.php

Switch it off under Tools → Site Doctor → Settings; the plugin then uses the list of releases built into it.

The site health checks make three requests to your own site's address (the debug log, the uploads folder, admin-ajax.php). They go nowhere else.

// @pro-start
The Pro licence is checked with CatCode's licence server, catcode.com.ua: the licence key and the address of your site are sent when you activate a key or start the trial (with the e-mail you enter for the trial), and periodically afterwards. Updates of the Pro build come from the same server. Terms: https://catcode.com.ua/terms/ — privacy policy: https://catcode.com.ua/privacy/
// @pro-end

== Installation ==

1. Install from Plugins → Add New, or upload the zip.
2. Activate the plugin.
3. Go to Tools → Site Doctor.
4. Choose the PHP version you are moving to and click "Run the scan". Open the Site health tab for the checks.

== Frequently Asked Questions ==

= Does it change anything on my site? =

No. It only reads files and settings. It does not switch PHP, does not edit plugins and does not execute their code.

= Does it need WooCommerce or anything else? =

No. It works on any WordPress site.

= My site is on PHP 7.2 / 7.4. Can I check it for PHP 8.3? =

Yes — that is what it is for. The scan runs on the PHP you have and reports for the version you choose.

= Is a plugin marked "Ready" guaranteed to work? =

No tool can promise that by reading code. "Ready" means nothing was found that the chosen PHP version breaks. Test the site after the switch and keep a backup you can restore.

= Why is WordPress itself not in the list? =

WordPress publishes which PHP versions each release supports; the plugin shows that next to your WordPress version.

= What about encoded (ionCube) plugins? =

Encoded files cannot be read. They run only on the PHP versions their encoder and the loader on the server support, so the report tells you to ask the vendor before the switch.

= How is this different from Tools → Site Health in WordPress? =

WordPress's own screen stays as it is, and the plugin adds a PHP readiness test to it. The Site health tab of this plugin looks at other things as well, such as a public debug log, the biggest autoloaded options or free disk space, and writes out the fix for each problem.

== Changelog ==

= 1.0.0 =
* First release.
