Filter messages submitted through contact form 7 based on words and/or emails listed as restricted.
24
Score
1,044
Errors
1,594
Warnings
+0
Change
Category Scores
Security0
Repo90
Performance100
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Maintainability
1,546
12 issue groups
Security
779
9 issue groups
I18n
270
4 issue groups
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$account_addon_ids".1,216
- Category
- Maintainability
- Occurrences
- 1,216
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$account_addon_ids".
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" <a href='{$skip_url}' class='button button-small button-secondary'>{$use_plugin_anonymously_text}</a>"'.586
- Category
- Security
- Occurrences
- 586
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" <a href='{$skip_url}' class='button button-small button-secondary'>{$use_plugin_anonymously_text}</a>"'.
ERRORI18nNon Singular String Literal DomainThe $domain parameter must be a single text string literal. Found: KMCFMF_TEXT_DOMAIN256
- Category
- I18n
- Occurrences
- 256
- Severity
- error
Sample message
The $domain parameter must be a single text string literal. Found: KMCFMF_TEXT_DOMAIN
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.106
- Category
- Security
- Occurrences
- 106
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
WARNINGMaintainabilityNon-prefixed functionFunctions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "_fs_text".102
- Category
- Maintainability
- Occurrences
- 102
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "_fs_text".
WARNINGMaintainabilityNon-prefixed classClasses declared by a theme/plugin should start with the theme/plugin prefix. Found: "FS_Admin_Menu_Manager".60
- Category
- Maintainability
- Occurrences
- 60
- Severity
- warning
Sample message
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "FS_Admin_Menu_Manager".
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.36
- Category
- Security
- Occurrences
- 36
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGMaintainabilityNon-prefixed constantGlobal constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "FS_API__ADDRESS".34
- Category
- Maintainability
- Occurrences
- 34
- Severity
- warning
Sample message
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "FS_API__ADDRESS".
WARNINGMaintainabilityNon-prefixed namespaceNamespaces declared by a theme/plugin should start with the theme/plugin prefix. Found: "km_message_filter".34
- Category
- Maintainability
- Occurrences
- 34
- Severity
- warning
Sample message
Namespaces declared by a theme/plugin should start with the theme/plugin prefix. Found: "km_message_filter".
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;29
- Category
- Maintainability
- Occurrences
- 29
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Show 15 moreShow less
WARNINGMaintainabilityDirect Query20
- Category
- Maintainability
- Occurrences
- 20
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo Caching18
- Category
- Maintainability
- Occurrences
- 18
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGSecurityNonce verification recommended18
- Category
- Security
- Occurrences
- 18
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGMaintainabilityNon-prefixed hook name14
- Category
- Maintainability
- Occurrences
- 14
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'km_setting_' . $id".
WARNINGSecurityInput is not sanitized11
- Category
- Security
- Occurrences
- 11
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_POST[$name]
WARNINGMaintainabilitySchema Change9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- warning
Sample message
Attempting a database schema change is discouraged.
ERRORSecurityException output is not escaped8
- Category
- Security
- Occurrences
- 8
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$message'.
ERRORMaintainabilityOffloaded Content7
- Category
- Maintainability
- Occurrences
- 7
- Severity
- error
Sample message
Offloading images, js, css, and other scripts to your servers or any remote service is disallowed.
WARNINGSecurityRequest data is not unslashed6
- Category
- Security
- Occurrences
- 6
- Severity
- warning
Sample message
$_POST['wpforms']['id'] not unslashed before sanitization. Use wp_unslash() or similar
ERRORI18nMissing Arg Domain5
- Category
- I18n
- Occurrences
- 5
- Severity
- error
Sample message
Missing $domain parameter in function call to esc_html_e().
ERRORI18nNon Singular String Literal Text5
- Category
- I18n
- Occurrences
- 5
- Severity
- error
Sample message
The $text parameter must be a single text string literal. Found: $my_filter->id
ERRORSecurityDatabase parameter is not escaped4
- Category
- Security
- Occurrences
- 4
- Severity
- error
Sample message
Unescaped parameter $column used in $wpdb->query()\n$column used without escaping.
ERRORSecuritySQL query is not prepared4
- Category
- Security
- Occurrences
- 4
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $column
ERRORI18nText Domain Mismatch4
- Category
- I18n
- Occurrences
- 4
- Severity
- error
Sample message
Mismatched text domain. Expected 'cf7-message-filter' but got 'contact-form-7'.
WARNINGMaintainabilityerror log debug backtrace3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
debug_backtrace() found. Debug code should not normally be used in production.
External Connections
Potential connections found in static code analysis.
Outbound calls
246
External assets
13
Incoming endpoints
16
Notable Domains
freemius.com10 · outbound
ko-fi.com7 · outbound
momentjs.com6 · outbound
paypalobjects.com6 · outbound
php.net6 · outbound
choosealicense.com4 · outbound
Platform / Reference Domains
gnu.org112 · platform/reference
w3.org18 · platform/reference
github.com17 · platform/reference
wordpress.org11 · platform/reference
api.wordpress.org2 · platform/reference
make.wordpress.org2 · platform/reference
core.trac.wordpress.org1 · platform/reference
translate.wordpress.org1 · platform/reference
External Asset Domains
paypal.com6 · asset
fonts.googleapis.com3 · asset
quickchart.io2 · asset + outbound
cdn.jsdelivr.net1 · asset
Incoming Endpoints
No public endpoints detected.
Admin AJAX endpoints16
admin_post_fs_clone_resolutionauthenticated
admin_post
wp_ajax_fs_dismiss_notice_action_{$ajax_action_suffix}authenticated
wp_ajax
wp_ajax_fs_toggle_debug_modeauthenticated
wp_ajax
wp_ajax_kmcf7_clear_suggested_spam_wordsauthenticated
wp_ajax
wp_ajax_kmcf7_delete_all_messagesauthenticated
wp_ajax
wp_ajax_kmcf7_delete_messageauthenticated
wp_ajax
wp_ajax_kmcf7_download_csvauthenticated
wp_ajax
wp_ajax_kmcf7_get_statsauthenticated
wp_ajax
wp_ajax_kmcf7_messagesauthenticated
wp_ajax
wp_ajax_kmcf7_resubmit_messageauthenticated
wp_ajax
wp_ajax_kmcf7_save_visible_columnsauthenticated
wp_ajax
wp_ajax_kmcf7ms_dismiss_noticeauthenticated
wp_ajax
4 more hidden
Score History
3 score snapshots
v1.6.4.0
24
Latest
- Findings
- 2,638
- Errors
- 1,044
- Warnings
- 1,594
- Check
- 2.0.0
v1.6.3.9
24
Score
- Findings
- 2,651
- Errors
- 1,057
- Warnings
- 1,594
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 24 | 2,638 | 1,044 | 1,594 | v1.6.4.0 | 2.0.0 |
| 24 | 2,651 | 1,057 | 1,594 | v1.6.3.9 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Issue
Domain
Related
Akismet Anti-spam: Spam Protection35 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce21 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreClassic Editor63 scoreLiteSpeed Cache35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreDatabase Addon for Contact Form 7 – CFDB739 scoreSucuri Security – Auditing, Malware Scanner and Security Hardening82 scoreWP Mail Logging34 scoreReCaptcha v2 for Contact Form 744 scoreRedirection for Contact Form 727 score
Author
Issue
Domain
Related
Akismet Anti-spam: Spam Protection35 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce21 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreClassic Editor63 scoreLiteSpeed Cache35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreDatabase Addon for Contact Form 7 – CFDB739 scoreSucuri Security – Auditing, Malware Scanner and Security Hardening82 scoreWP Mail Logging34 scoreReCaptcha v2 for Contact Form 744 scoreRedirection for Contact Form 727 score
Related Plugins
DS CF7 Math Captcha
10k+ active installs
100
Message Bridge for Contact Form 7 and Telegram
10k+ active installs
100
Simply Disable Comments
7k+ active installs
100
Simply Show Hooks
2k+ active installs
100
Dam Spam
2k+ active installs
100
Style Contact Form 7
1k+ active installs
100