Backup, restore, and migrate WordPress sites fast. Supports TAR, remote backups, multi schedules, and full multisite compatibility.
10
Score
1,563
Errors
149
Warnings
+0
Change
Category Scores
Security0
Repo0
Performance98
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
807
7 issue groups
Maintainability
646
16 issue groups
Supply Chain
138
1 issue group
I18n
16
1 issue group
ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" (Code: {$e->getCode()})"'.677
- Category
- Security
- Occurrences
- 677
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" (Code: {$e->getCode()})"'.
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;307
- Category
- Maintainability
- Occurrences
- 307
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
ERRORSupply ChainHidden files includedHidden files are not permitted.138
- Category
- Supply Chain
- Occurrences
- 138
- Severity
- error
Sample message
Hidden files are not permitted.
ERRORMaintainabilityfile system operations fcloseFile operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().59
- Category
- Maintainability
- Occurrences
- 59
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
ERRORMaintainabilityunlink unlinkunlink() is discouraged. Use wp_delete_file() to delete a file.57
- Category
- Maintainability
- Occurrences
- 57
- Severity
- error
Sample message
unlink() is discouraged. Use wp_delete_file() to delete a file.
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"- ATIME: {$sparse->getAtime()} -> {$sparse->getAtime(false)}"'.54
- Category
- Security
- Occurrences
- 54
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"- ATIME: {$sparse->getAtime()} -> {$sparse->getAtime(false)}"'.
ERRORMaintainabilityfile system operations fopenFile operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().47
- Category
- Maintainability
- Occurrences
- 47
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().
ERRORMaintainabilityfile system operations fwriteFile operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite().35
- Category
- Maintainability
- Occurrences
- 35
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite().
ERRORMaintainabilityfile system operations mkdirFile operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir().24
- Category
- Maintainability
- Occurrences
- 24
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir().
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_COOKIE[GoogleAuthenticator::MFA_COOKIE_KEY]23
- Category
- Security
- Occurrences
- 23
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_COOKIE[GoogleAuthenticator::MFA_COOKIE_KEY]
Show 15 moreShow less
ERRORMaintainabilityrename rename21
- Category
- Maintainability
- Occurrences
- 21
- Severity
- error
Sample message
rename() is discouraged. Use WP_Filesystem::move() to rename a file.
WARNINGSecurityRequest data is not unslashed20
- Category
- Security
- Occurrences
- 20
- Severity
- warning
Sample message
$_COOKIE[GoogleAuthenticator::MFA_COOKIE_KEY] not unslashed before sanitization. Use wp_unslash() or similar
ERRORMaintainabilityfile system operations fread17
- Category
- Maintainability
- Occurrences
- 17
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fread().
ERRORI18nText Domain Mismatch16
- Category
- I18n
- Occurrences
- 16
- Severity
- error
Sample message
Mismatched text domain. Expected 'backup' but got 'jetbackup'.
WARNINGMaintainabilityDiscouraged PHP function14
- Category
- Maintainability
- Occurrences
- 14
- Severity
- warning
Sample message
The use of function ini_set() is discouraged
WARNINGSecurityNonce verification recommended13
- Category
- Security
- Occurrences
- 13
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORSecuritySQL query is not prepared11
- Category
- Security
- Occurrences
- 11
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $preparedQuery
WARNINGMaintainabilityerror log print r11
- Category
- Maintainability
- Occurrences
- 11
- Severity
- warning
Sample message
print_r() found. Debug code should not normally be used in production.
ERRORMaintainabilityForbidden PHP function found10
- Category
- Maintainability
- Occurrences
- 10
- Severity
- error
Sample message
The use of function eval() is forbidden
WARNINGMaintainabilityerror log error log9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- warning
Sample message
error_log() found. Debug code should not normally be used in production.
WARNINGSecurityMissing nonce verification9
- Category
- Security
- Occurrences
- 9
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORMaintainabilityfile system operations touch9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: touch().
ERRORMaintainabilityparse url parse url9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- error
Sample message
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
WARNINGMaintainabilityMissing Version9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- warning
Sample message
Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching.
WARNINGMaintainabilityNon-prefixed constant8
- Category
- Maintainability
- Occurrences
- 8
- Severity
- warning
Sample message
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "DISABLE_WP_CRON".
External Connections
Potential connections found in static code analysis.
Outbound calls
300
External assets
0
Incoming endpoints
0
Notable Domains
angularjs.org30 · outbound
developer.mozilla.org24 · outbound
getbootstrap.com16 · outbound
popper.js.org9 · outbound
quirksmode.org6 · outbound
charistheo.io3 · outbound
Platform / Reference Domains
External Asset Domains
No external asset domains detected.
Incoming Endpoints
No public endpoints detected.
Score History
4 score snapshots
v3.1.23.3
10
Latest
- Findings
- 1,712
- Errors
- 1,563
- Warnings
- 149
- Check
- 2.0.0
v3.1.22.4
10
Score
- Findings
- 1,712
- Errors
- 1,563
- Warnings
- 149
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 10 | 1,712 | 1,563 | 149 | v3.1.23.3 | 2.0.0 |
| 10 | 1,712 | 1,563 | 149 | v3.1.22.4 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Issue
Exception output is not escaped677 findingsMissing direct file access protection307 findingsHidden files included138 findingsfile system operations fclose59 findingsunlink unlink57 findingsOutput is not escaped54 findingsfile system operations fopen47 findingsfile system operations fwrite35 findings
Domain
Related
Jetpack – WP Security, Backup, Speed, & Growth22 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce22 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreLiteSpeed Cache35 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreAkismet Anti-spam: Spam Protection35 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreAll-in-One WP Migration and Backup34 scoreUpdraftPlus: WP Backup & Migration Plugin59 scoreDuplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More21 scoreManageWP Worker23 score
Author
Issue
Exception output is not escaped677 findingsMissing direct file access protection307 findingsHidden files included138 findingsfile system operations fclose59 findingsunlink unlink57 findingsOutput is not escaped54 findingsfile system operations fopen47 findingsfile system operations fwrite35 findings
Domain
Related
Jetpack – WP Security, Backup, Speed, & Growth22 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce22 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreLiteSpeed Cache35 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreAkismet Anti-spam: Spam Protection35 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreAll-in-One WP Migration and Backup34 scoreUpdraftPlus: WP Backup & Migration Plugin59 scoreDuplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More21 scoreManageWP Worker23 score
Related Plugins
Export Media as ZIP
1k+ active installs
100
Aruba Migration Tool
600 active installs
100
Glow: maintenance & support management for agencies
700 active installs
99
Menu Backup & Restore + Import/Export
400 active installs
99
Exclude Image Thumbnails From UpdraftPlus Backups
4k+ active installs
98
Remote Website Management by Watchful
3k+ active installs
97