hidden_files
Hidden files included
The plugin package contains hidden files or directories that usually should not ship in a WordPress.org release.
Why It Shows Up
Plugin Check found dotfiles, hidden folders, or operating-system metadata in the plugin ZIP.
Why It Matters
Hidden files can leak development metadata, repository configuration, local tooling state, or unexpected content.
How to Fix
- Exclude dotfiles and local metadata from the release build.
- Build release ZIPs from a clean export or packaging script.
- Keep only files required for the plugin to run, document itself, or provide distributed assets.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #501 | Japanese font for WordPress(Previously: Japanese Font for TinyMCE) | 35 | 11 | 37 | 10k+ | Non-prefixed global variable | ||
| #502 | JetStyleManager for Gutenberg | 35 | 20 | 64 | 20k+ | Nonce verification recommended | ||
| #503 | JS Categories List Widget | 35 | 37 | 18 | 1k+ | Non Singular String Literal Domain | ||
| #504 | JSON Feed (jsonfeed.org) | 35 | 9 | 29 | 1k+ | Non-prefixed global variable | ||
| #505 | Nobs • Share Buttons | 35 | 314 | 85 | 3k+ | Output is not escaped | ||
| #506 | JWT Auth – WordPress JSON Web Token Authentication | 35 | 14 | 18 | 6k+ | Output is not escaped | ||
| #507 | Kadence for WooCommerce and Elementor | 35 | 39 | 21 | 3k+ | Output is not escaped | ||
| #508 | Kaya QR Code Generator | 35 | 193 | 40 | 20k+ | Non Singular String Literal Domain | ||
| #509 | Kustom Checkout for WooCommerce | 35 | 101 | 505 | 10k+ | Dynamic hook name | ||
| #510 | Klarna Order Management for WooCommerce | 35 | 22 | 37 | 10k+ | Non-prefixed hook name | ||
| #511 | LiteSpeed Cache | 35 | 286 | 893 | 7m+ | Non-prefixed global variable | ||
| #512 | Log HTTP Requests | 35 | 7 | 18 | 2k+ | Interpolated SQL is not prepared | ||
| #513 | Login-Logout | 35 | 104 | 8 | 3k+ | Output is not escaped | ||
| #514 | Log in with Google | 35 | 5 | 17 | 6k+ | Non-prefixed global variable | ||
| #515 | LottieFiles | 35 | 8 | 1 | 7k+ | Hidden files included | ||
| #516 | Magic Login – Passwordless Authentication for WordPress – Login Without Password | 35 | 23 | 53 | 3k+ | Missing nonce verification | ||
| #517 | Map Block for Google Maps | 35 | 6 | 5 | 20k+ | Hidden files included | ||
| #518 | MapSVG – Vector maps, Image maps, Google Maps | 35 | 74 | 47 | 1k+ | Missing direct file access protection | ||
| #519 | Mark Posts | 35 | 30 | 34 | 1k+ | Output is not escaped | ||
| #520 | MathML Block | 35 | 10 | 2 | 1k+ | Hidden files included | ||
| #521 | Media Library Downloader | 35 | 21 | 16 | 4k+ | Output is not escaped | ||
| #522 | Menu Item Duplicator | 35 | 3 | 0 | 2k+ | Hidden files included | ||
| #523 | MetaSlider Gallery – Image Gallery, Lightbox Galleries, Modal Windows | 35 | 157 | 49 | 10k+ | Output is not escaped | ||
| #524 | Modal Guten Block | 35 | 6 | 3 | 2k+ | Hidden files included | ||
| #525 | More Widgets | 35 | 55 | 15 | 1k+ | Output is not escaped | ||
| #526 | MotoPress Hotel Booking Styles & Templates | 35 | 37 | 19 | 10k+ | block api version too low | ||
| #527 | Hide from Search | 35 | 5 | 8 | 3k+ | Missing direct file access protection | ||
| #528 | My Eyes Are Up Here | 35 | 7 | 12 | 2k+ | Missing nonce verification | ||
| #529 | myPOS Checkout | 35 | 151 | 8 | 4k+ | Text Domain Mismatch | ||
| #530 | Nginx Cache Controller | 35 | 79 | 96 | 1k+ | Text Domain Mismatch | ||
| #531 | NS Cloner – Site Copier | 35 | 29 | 16 | 7k+ | Missing direct file access protection | ||
| #532 | Fonts Plugin | Google Fonts, Adobe Fonts & Upload Fonts | 35 | 41 | 8 | 200k+ | Missing direct file access protection | ||
| #533 | Newsletters, Email Marketing, SMS and Popups by Omnisend | 35 | 5 | 2 | 100k+ | Hidden files included | ||
| #534 | Email Marketing for WooCommerce by Omnisend | 35 | 15 | 21 | 50k+ | Non-prefixed function | ||
| #535 | ONet Regenerate Thumbnails | 35 | 190 | 64 | 1k+ | Text Domain Mismatch | ||
| #536 | Order Delivery Date for WooCommerce | 35 | 2,060 | 73 | 10k+ | wp function not compatible with requires wp | ||
| #537 | Orderable – Restaurant & Food Ordering System | 35 | 12 | 324 | 5k+ | Non-prefixed global variable | ||
| #538 | OSM Map Widget for Elementor | 35 | 183 | 14 | 9k+ | Text Domain Mismatch | ||
| #539 | Page Visits Counter – Lite | 35 | 28 | 35 | 5k+ | Output is not escaped | ||
| #540 | Paytrail for WooCommerce | 35 | 28 | 46 | 3k+ | Non-prefixed global variable | ||
| #541 | Pearl – Header Builder | 35 | 7 | 283 | 5k+ | Non-prefixed global variable | ||
| #542 | Permissions Editor for Ninja Forms | 35 | 29 | 6 | 1k+ | Output is not escaped | ||
| #543 | Phone Orders for WooCommerce | 35 | 1 | 229 | 1k+ | Non-prefixed hook name | ||
| #544 | Pie Calendar – Events Calendar Made Simple | 35 | 83 | 53 | 1k+ | Text Domain Mismatch | ||
| #545 | Piwik PRO | 35 | 22 | 3 | 3k+ | Output is not escaped | ||
| #546 | Plausible Analytics | 35 | 244 | 61 | 10k+ | Exception output is not escaped | ||
| #547 | Pochipp | 35 | 27 | 102 | 20k+ | Non-prefixed global variable | ||
| #548 | Pods Alternative Cache | 35 | 1 | 0 | 5k+ | Hidden files included | ||
| #549 | Post Content Shortcodes | 35 | 205 | 56 | 2k+ | Output is not escaped | ||
| #550 | Post Meta Data Manager | 35 | 30 | 112 | 1k+ | Non-prefixed global variable |
