WordPress.WP.AlternativeFunctions.parse_url_parse_url
parse url parse url
The plugin uses raw URL parsing where WordPress URL helpers may be safer or more compatible.
Why It Shows Up
Plugin Check found `parse_url()` in plugin code.
Why It Matters
URL parsing is easy to get subtly wrong, especially with relative URLs, encoded values, and malformed input.
How to Fix
- Use WordPress helpers such as `wp_parse_url()`, `esc_url_raw()`, `esc_url()`, and `wp_http_validate_url()` where they fit.
- Validate schemes and hosts before using parsed URL parts.
- Do not use parsed URLs to build redirects or requests without allowlisting.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1051 | Disable Registration Page | 88 | 4 | 6 | 400 | Text Domain Mismatch | ||
| #1052 | Smart Blocks – WordPress Gutenberg Blocks | 88 | 10 | 76 | 1k+ | Post Not In post not in | ||
| #1053 | SiteLock Security – WP Hardening, Login Security & Malware Scans | 89 | 44 | 9 | 1k+ | Text Domain Mismatch | ||
| #1054 | Child Themify | 90 | 10 | 4 | 7k+ | Missing direct file access protection | ||
| #1055 | Content Anchor Links | 90 | 6 | 5 | 1k+ | Non-prefixed hook name | ||
| #1056 | Ergonet Cache | 90 | 3 | 2 | 2k+ | Output is not escaped | ||
| #1057 | LH Force Lowercase URLs | 90 | 4 | 3 | 2k+ | Input is not validated or sanitized | ||
| #1058 | PromPress | 90 | 8 | 4 | 700 | Missing direct file access protection | ||
| #1059 | Clever Fox | 91 | 16 | 1 | 30k+ | wp function not compatible with requires wp | ||
| #1060 | LegalBlink for Aruba | 91 | 33 | 29 | 7k+ | Missing direct file access protection | ||
| #1061 | MultiManager WP – Manage All Your WordPress Sites Easily | 91 | 28 | 11 | 1k+ | Missing Arg Domain | ||
| #1062 | Pantheon Advanced Page Cache | 91 | 10 | 6 | 10k+ | Request data is not unslashed | ||
| #1063 | Snow Monkey Forms | 91 | 36 | 41 | 30k+ | Non-prefixed global variable | ||
| #1064 | IndieAuth | 92 | 30 | 27 | 400 | Missing direct file access protection | ||
| #1065 | Import Shopify To WP | 93 | 7 | 5 | 900 | Missing Translators Comment | ||
| #1066 | LLMs.txt and LLMs-Full.txt Generator | 94 | 14 | 9 | 4k+ | Non-prefixed global variable | ||
| #1067 | Simple Lightbox for WordPress | 94 | 11 | 7 | 400 | Non Enqueued Script | ||
| #1068 | Image Size Selection for Divi | 96 | 60 | 3 | 500 | Text Domain Mismatch | ||
| #1069 | NextGenThemes jsDelivr CDN | 96 | 27 | 0 | 400 | wp function not compatible with requires wp | ||
| #1070 | Before + After Images for Divi | 97 | 12 | 3 | 3k+ | Missing direct file access protection | ||
| #1071 | SoundCloud Shortcode | 97 | 6 | 1 | 5k+ | Missing Arg Domain | ||
| #1072 | SameSite Cookies | 98 | 3 | 2 | 800 | Missing direct file access protection |
