hidden_files
Hidden files included
The plugin package contains hidden files or directories that usually should not ship in a WordPress.org release.
Why It Shows Up
Plugin Check found dotfiles, hidden folders, or operating-system metadata in the plugin ZIP.
Why It Matters
Hidden files can leak development metadata, repository configuration, local tooling state, or unexpected content.
How to Fix
- Exclude dotfiles and local metadata from the release build.
- Build release ZIPs from a clean export or packaging script.
- Keep only files required for the plugin to run, document itself, or provide distributed assets.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #801 | SrbTransLatin – Serbian Latinisation | 35 | 11 | 28 | 2k+ | Non-prefixed global variable | ||
| #802 | SSL Insecure Content Fixer | 35 | 28 | 60 | 100k+ | Input is not sanitized | ||
| #803 | Steady for WordPress | 35 | 6 | 13 | 600 | Non-prefixed global variable | ||
| #804 | Sticky Social Link | 35 | 49 | 2 | 1k+ | Output is not escaped | ||
| #805 | SumUp Payment Gateway For WooCommerce | 35 | 29 | 62 | 10k+ | Nonce verification recommended | ||
| #806 | Super Cool Ad Inserter Plugin | 35 | 22 | 5 | 600 | Text Domain Mismatch | ||
| #807 | Svea Checkout for WooCommerce | 35 | 18 | 72 | 800 | Request data is not unslashed | ||
| #808 | SweepPress: Website Cleanup and Optimization | 35 | 71 | 176 | 600 | Non-prefixed global variable | ||
| #809 | Table for Divi | 35 | 5 | 2 | 2k+ | Hidden files included | ||
| #810 | Table Of Content Block – Auto-Generate Clickable Table of Contents | 35 | 2 | 1 | 3k+ | Hidden files included | ||
| #811 | TailPress – Tailwind for WordPress | 35 | 23 | 22 | 500 | Output is not escaped | ||
| #812 | Tapfiliate | 35 | 35 | 49 | 400 | Nonce verification recommended | ||
| #813 | Taxonomy Checklist Tree | 35 | 3 | 1 | 400 | Hidden files included | ||
| #814 | Taxonomy CSV Import Export | 35 | 5 | 30 | 700 | Missing nonce verification | ||
| #815 | TBThemes Theme Import | 35 | 84 | 48 | 400 | Text Domain Mismatch | ||
| #816 | TC Custom JavaScript | 35 | 19 | 26 | 10k+ | Missing Version | ||
| #817 | Teamleader CRM Forms | 35 | 150 | 30 | 500 | Non Singular String Literal Domain | ||
| #818 | Starter Sites & Templates by Neve | 35 | 28 | 88 | 100k+ | Non-prefixed hook name | ||
| #819 | Termageddon: Cookie Consent & Privacy Compliance | 35 | 27 | 13 | 7k+ | Exception output is not escaped | ||
| #820 | The Courier Guy Shipping for WooCommerce | 35 | 57 | 107 | 3k+ | Missing nonce verification | ||
| #821 | The Social Links | 35 | 16 | 29 | 2k+ | Non-prefixed global variable | ||
| #822 | theMarketer – Email marketing, Newsletters, Automation & Loyalty for Woocommerce | 35 | 4 | 47 | 700 | Nonce verification recommended | ||
| #823 | ThemeRain Core | 35 | 69 | 61 | 1k+ | Text Domain Mismatch | ||
| #824 | TikTok | 35 | 31 | 22 | 200k+ | Missing Arg Domain | ||
| #825 | TinyMCE Templates | 35 | 41 | 27 | 20k+ | Text Domain Mismatch | ||
| #826 | Tockify Events Calendar | 35 | 35 | 12 | 2k+ | Output is not escaped | ||
| #827 | Transcoder | 35 | 42 | 111 | 400 | Non-prefixed function | ||
| #828 | uCalc | 35 | 78 | 8 | 600 | Text Domain Mismatch | ||
| #829 | Unagi | 35 | 9 | 2 | 900 | Missing direct file access protection | ||
| #830 | Under Construction | 35 | 3 | 0 | 600k+ | Hidden files included | ||
| #831 | Use Google Libraries | 35 | 13 | 5 | 10k+ | Hidden files included | ||
| #832 | UTM for Woocommerce | 35 | 14 | 4 | 900 | Output is not escaped | ||
| #833 | Vendi Abandoned Plugin Check | 35 | 13 | 3 | 1k+ | trademarked term | ||
| #834 | Embed videos and respect privacy | 35 | 6 | 11 | 2k+ | Non-prefixed global variable | ||
| #835 | Walls.io: Social Media Feed | 35 | 10 | 7 | 1k+ | Hidden files included | ||
| #836 | WATI Chat and Notification | 35 | 9 | 0 | 600 | Missing direct file access protection | ||
| #837 | Wavy Divider | 35 | 10 | 1 | 700 | Hidden files included | ||
| #838 | WC Moneris Payment Gateway | 35 | 104 | 28 | 900 | Text Domain Mismatch | ||
| #839 | Payphone – Payment Gateway Button | 35 | 3 | 2 | 2k+ | Hidden files included | ||
| #840 | Deliver via Shipos for WooCommerce | 35 | 11 | 78 | 600 | Nonce verification recommended | ||
| #841 | Product Attributes Shortcode | 35 | 3 | 4 | 700 | Nonce verification recommended | ||
| #842 | Webflow Pages | 35 | 36 | 63 | 2k+ | Non Singular String Literal Domain | ||
| #843 | Converter for Media – Optimize images | Convert WebP & AVIF | 35 | 133 | 53 | 500k+ | curl curl setopt | ||
| #844 | WEDOS OnLine monitoring | 35 | 36 | 15 | 700 | Output is not escaped | ||
| #845 | wePOS – Point Of Sale (POS) for WooCommerce & Dokan | 35 | 47 | 66 | 2k+ | Output is not escaped | ||
| #846 | What The File | 35 | 9 | 12 | 40k+ | Input is not sanitized | ||
| #847 | Which Elementor Addon | 35 | 26 | 3 | 500 | Text Domain Mismatch | ||
| #848 | Wild Apricot Login | 35 | 88 | 30 | 800 | Non Singular String Literal Domain | ||
| #849 | Open Graph and Twitter Card Tags | 35 | 15 | 27 | 50k+ | error log error log | ||
| #850 | Asaas Gateway for WooCommerce | 35 | 12 | 109 | 8k+ | Non-prefixed global variable |
