Harden your site security with Login Security, Two-Factor Authentication (2FA), Vulnerability Scanner, Firewall, and more. Formerly iThemes Security.
21
Score
1,060
Errors
957
Warnings
-2
Change
Category Scores
Security0
Repo74
Performance98
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
883
12 issue groups
Maintainability
699
11 issue groups
I18n
271
2 issue groups
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.248
- Category
- I18n
- Occurrences
- 248
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;195
- Category
- Maintainability
- Occurrences
- 195
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" $var=\"$val\""'.188
- Category
- Security
- Occurrences
- 188
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" $var=\"$val\""'.
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.132
- Category
- Maintainability
- Occurrences
- 132
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.118
- Category
- Security
- Occurrences
- 118
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().112
- Category
- Maintainability
- Occurrences
- 112
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGSecurityRequest data is not unslashed$_COOKIE[self::C_SAME_BROWSER] not unslashed before sanitization. Use wp_unslash() or similar107
- Category
- Security
- Occurrences
- 107
- Severity
- warning
Sample message
$_COOKIE[self::C_SAME_BROWSER] not unslashed before sanitization. Use wp_unslash() or similar
ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"'$role' is not a valid canonical role."'.106
- Category
- Security
- Occurrences
- 106
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"'$role' is not a valid canonical role."'.
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_COOKIE[self::C_SAME_BROWSER]101
- Category
- Security
- Occurrences
- 101
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_COOKIE[self::C_SAME_BROWSER]
ERRORSecuritySQL query is not preparedUse placeholders and $wpdb->prepare(); found $blog88
- Category
- Security
- Occurrences
- 88
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $blog
Show 15 moreShow less
ERRORMaintainabilitydate date70
- Category
- Maintainability
- Occurrences
- 70
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
WARNINGMaintainabilityNon-prefixed hook name65
- Category
- Maintainability
- Occurrences
- 65
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'two-factor-user-options-' . $class".
WARNINGSecurityMissing nonce verification44
- Category
- Security
- Occurrences
- 44
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGMaintainabilityNon-prefixed global variable42
- Category
- Maintainability
- Occurrences
- 42
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$__composer_autoload_files".
WARNINGSecurityInput is not validated39
- Category
- Security
- Occurrences
- 39
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_GET['page']. Check that the array index exists before using it.
WARNINGSecurityInterpolated SQL is not prepared30
- Category
- Security
- Occurrences
- 30
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable $extra_checks at \t\t\t$extra_checks\n
ERRORSecurityDatabase parameter is not escaped24
- Category
- Security
- Occurrences
- 24
- Severity
- error
Sample message
Unescaped parameter $build_results['sql'] used in $wpdb->get_results()\n$build_results['sql'] assigned unsafely at line 633.
WARNINGMaintainabilityerror log trigger error24
- Category
- Maintainability
- Occurrences
- 24
- Severity
- warning
Sample message
trigger_error() found. Debug code should not normally be used in production.
ERRORI18nText Domain Mismatch23
- Category
- I18n
- Occurrences
- 23
- Severity
- error
Sample message
Mismatched text domain. Expected 'better-wp-security' but got 'stellarwp-telemetry'.
WARNINGSecurityDatabase parameter is not escaped22
- Category
- Security
- Occurrences
- 22
- Severity
- warning
Sample message
Unescaped parameter $main_options used in $wpdb->get_results()\n$main_options assigned unsafely at line 924.
WARNINGMaintainabilityDynamic hook name21
- Category
- Maintainability
- Occurrences
- 21
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$this->cron_interval_identifier".
ERRORSecurityUnsafe printing function16
- Category
- Security
- Occurrences
- 16
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
WARNINGMaintainabilityNon-prefixed function15
- Category
- Maintainability
- Occurrences
- 15
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "_manually_load_plugin".
ERRORMaintainabilityparse url parse url13
- Category
- Maintainability
- Occurrences
- 13
- Severity
- error
Sample message
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
WARNINGMaintainabilitySchema Change10
- Category
- Maintainability
- Occurrences
- 10
- Severity
- warning
Sample message
Attempting a database schema change is discouraged.
External Connections
Potential connections found in static code analysis.
Outbound calls
280
External assets
0
Incoming endpoints
20
Notable Domains
go.solidwp.com69 · outbound
json-schema.org22 · outbound
yandex.com12 · outbound
en.wikipedia.org10 · outbound
ithemes.com9 · outbound
itunes.apple.com5 · outbound
Platform / Reference Domains
w3.org48 · platform/reference
github.com10 · platform/reference
api.w.org3 · platform/reference
opensource.org2 · platform/reference
api.wordpress.org1 · platform/reference
gnu.org1 · platform/reference
validator.w3.org1 · platform/reference
wordpress.org1 · platform/reference
External Asset Domains
No external asset domains detected.
Incoming Endpoints
/wp-json/ithemes-security/rpc/ban-users/add-manyREST
register_rest_route
/wp-json/ithemes-security/rpc/discoverREST
register_rest_route
/wp-json/ithemes-security/rpc/file-change/file-treeREST
register_rest_route
/wp-json/ithemes-security/rpc/file-writing/get-config-rulesREST
register_rest_route
/wp-json/ithemes-security/rpc/global/detect-ipREST
register_rest_route
/wp-json/ithemes-security/rpc/notification-center/available-users-rolesREST
register_rest_route
Admin AJAX endpoints7
wp_ajax_itsec_debug_pageauthenticated
wp_ajax
wp_ajax_itsec_help_pageauthenticated
wp_ajax
wp_ajax_itsec_logs_pageauthenticated
wp_ajax
wp_ajax_itsec-set-user-settingauthenticated
wp_ajax
wp_ajax_two_factor_backup_codes_generateauthenticated
wp_ajax
wp_ajax_two-factor-totp-get-codeauthenticated
wp_ajax
wp_ajax_two-factor-totp-verify-codeauthenticated
wp_ajax
Score History
2 score snapshots
v10.0.3
21
Latest
- Findings
- 2,017
- Errors
- 1,060
- Warnings
- 957
- Check
- 2.0.0
v10.0.2
23
Score
- Findings
- 2,020
- Errors
- 1,053
- Warnings
- 967
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 21 | 2,017 | 1,060 | 957 | v10.0.3 | 2.0.0 |
| 23 | 2,020 | 1,053 | 967 | v10.0.2 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Category
Issue
Domain
Related
Wordfence Security – Firewall, Malware Scan, and Login Security21 scoreLiteSpeed Cache35 scoreWooCommerce21 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreAll-in-One WP Migration and Backup34 scoreAkismet Anti-spam: Spam Protection35 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreWPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager88 scoreHostinger Tools82 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreAll-In-One Security (AIOS) – Security and Firewall24 score
Author
Category
Issue
Domain
Related
Wordfence Security – Firewall, Malware Scan, and Login Security21 scoreLiteSpeed Cache35 scoreWooCommerce21 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreAll-in-One WP Migration and Backup34 scoreAkismet Anti-spam: Spam Protection35 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreWPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager88 scoreHostinger Tools82 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreAll-In-One Security (AIOS) – Security and Firewall24 score
Related Plugins
Login Security Captcha
10k+ active installs
100
Stop XML-RPC Attacks
6k+ active installs
100
Dam Spam
2k+ active installs
100
Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…
1k+ active installs
100
Remove XML-RPC Methods
1k+ active installs
100
Compromise Scanner for wp2shell
1k+ active installs
100