WordPress security plugin with malware scanner, IP blocking, audit logs, antivirus scans, firewall, 2FA, brute force login security, and more.
v6.1.0WPMU DEV - Your All-in-One WordPress PlatformUpdated Added 80k+ installs96% rating100% support resolved
24
Score
550
Errors
593
Warnings
+0
Change
Category Scores
Security0
Repo94
Performance95
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Maintainability
587
16 issue groups
Security
430
7 issue groups
I18n
86
1 issue group
Performance
5
1 issue group
WARNINGMaintainabilityNon-prefixed namespaceNamespaces declared by a theme/plugin should start with the theme/plugin prefix. Found: "PHP_CodeSniffer".262
- Category
- Maintainability
- Occurrences
- 262
- Severity
- warning
Sample message
Namespaces declared by a theme/plugin should start with the theme/plugin prefix. Found: "PHP_CodeSniffer".
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" $stackPtr "'.209
- Category
- Security
- Occurrences
- 209
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" $stackPtr "'.
ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Can't __set() $name; setting doesn't exist"'.167
- Category
- Security
- Occurrences
- 167
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Can't __set() $name; setting doesn't exist"'.
WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'wd_2fa_init_provider_' . $slug".95
- Category
- Maintainability
- Occurrences
- 95
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'wd_2fa_init_provider_' . $slug".
ERRORI18nText Domain MismatchMismatched text domain. Expected 'defender-security' but got 'plugin-cross-sell-textdomain'.86
- Category
- I18n
- Occurrences
- 86
- Severity
- error
Sample message
Mismatched text domain. Expected 'defender-security' but got 'plugin-cross-sell-textdomain'.
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$_tests_dir".59
- Category
- Maintainability
- Occurrences
- 59
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$_tests_dir".
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;40
- Category
- Maintainability
- Occurrences
- 40
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
WARNINGMaintainabilityerror log var exportvar_export() found. Debug code should not normally be used in production.24
- Category
- Maintainability
- Occurrences
- 24
- Severity
- warning
Sample message
var_export() found. Debug code should not normally be used in production.
WARNINGSecurityDatabase parameter is not escapedUnescaped parameter $key_column used in $wpdb->query()\n$key_column assigned unsafely at line 423.22
- Category
- Security
- Occurrences
- 22
- Severity
- warning
Sample message
Unescaped parameter $key_column used in $wpdb->query()\n$key_column assigned unsafely at line 423.
WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable $column at \t\t\t\tSET `$column` = '$option_key',\n20
- Category
- Security
- Occurrences
- 20
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable $column at \t\t\t\tSET `$column` = '$option_key',\n
Show 15 moreShow less
WARNINGMaintainabilityDirect Query19
- Category
- Maintainability
- Occurrences
- 19
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo Caching19
- Category
- Maintainability
- Occurrences
- 19
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGMaintainabilityNon-prefixed constant12
- Category
- Maintainability
- Occurrences
- 12
- Severity
- warning
Sample message
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "DONOTCACHEPAGE".
WARNINGMaintainabilityNon-prefixed function11
- Category
- Maintainability
- Occurrences
- 11
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "get_public_suffix".
WARNINGMaintainabilitySchema Change10
- Category
- Maintainability
- Occurrences
- 10
- Severity
- warning
Sample message
Attempting a database schema change is discouraged.
ERRORMaintainabilitybadly named files9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- error
Sample message
File and folder names must not contain spaces or special characters.
ERRORMaintainabilityNot Allowed7
- Category
- Maintainability
- Occurrences
- 7
- Severity
- error
Sample message
Use of heredoc syntax (<<<) is not allowed; use standard strings or inline HTML instead
ERRORMaintainabilityPlugin Directory Write6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- error
Sample message
Plugin folders are deleted when upgraded. Do not save data to the plugin folder using file_put_contents(). Detected usage of constant WPINC. Use wp_upload_dir() to get the uploads directory path or save to the database instead.
WARNINGMaintainabilityprevent path disclosure error reporting6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- warning
Sample message
error_reporting() can lead to full path disclosure.
WARNINGSecurityNonce verification recommended5
- Category
- Security
- Occurrences
- 5
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGPerformancePost Not In exclude5
- Category
- Performance
- Occurrences
- 5
- Severity
- warning
Sample message
Using exclusionary parameters, like exclude, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.
WARNINGMaintainabilityABSPATHDetected4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
Writing files using ABSPATH may be problematic. Consider using wp_upload_dir() instead if storing user data or generated files.
WARNINGMaintainabilityDynamic hook name4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$filter_name".
WARNINGSecurityInput is not sanitized4
- Category
- Security
- Occurrences
- 4
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_ENV[$variableName]
ERRORSecurityDatabase parameter is not escaped3
- Category
- Security
- Occurrences
- 3
- Severity
- error
Sample message
Unescaped parameter $column used in $wpdb->query()\n$column assigned unsafely at line 154.
External Connections
Potential connections found in static code analysis.
Outbound calls
265
External assets
10
Incoming endpoints
25
Notable Domains
wpmudev.com60 · outbound
tools.ietf.org16 · outbound
en.wikipedia.org8 · outbound
php.net6 · outbound
uri.thephpleague.com5 · outbound
incsub.com4 · outbound
Platform / Reference Domains
github.com42 · platform/reference
w3.org19 · platform/reference
wordpress.org13 · platform/reference
api.wordpress.org3 · platform/reference
downloads.wordpress.org2 · platform/reference
plugins.svn.wordpress.org2 · platform/reference
core.svn.wordpress.org1 · platform/reference
developer.wordpress.org1 · platform/reference
make.wordpress.org1 · platform/reference
opensource.org1 · platform/reference
profiles.wordpress.org1 · platform/reference
translate.wordpress.org1 · platform/reference
External Asset Domains
Incoming Endpoints
wp_ajax_nopriv_public
wp_ajax
wp_ajax_nopriv_defender_process_scanpublic
wp_ajax
wp_ajax_nopriv_defender_webauthn_create_challengepublic
wp_ajax
wp_ajax_nopriv_defender_webauthn_get_optionpublic
wp_ajax
wp_ajax_nopriv_defender_webauthn_remove_authenticatorpublic
wp_ajax
wp_ajax_nopriv_defender_webauthn_rename_authenticatorpublic
wp_ajax
Admin AJAX endpoints13
wp_ajax_defender_ip_detection_notice_dismissauthenticated
wp_ajax
wp_ajax_defender_ip_detection_switch_to_xffauthenticated
wp_ajax
wp_ajax_defender_process_scanauthenticated
wp_ajax
wp_ajax_defender_track_deactivateauthenticated
wp_ajax
wp_ajax_defender_webauthn_create_challengeauthenticated
wp_ajax
wp_ajax_defender_webauthn_disable_user_handle_match_failed_noticeauthenticated
wp_ajax
wp_ajax_defender_webauthn_get_optionauthenticated
wp_ajax
wp_ajax_defender_webauthn_remove_authenticatorauthenticated
wp_ajax
wp_ajax_defender_webauthn_rename_authenticatorauthenticated
wp_ajax
wp_ajax_defender_webauthn_verify_challengeauthenticated
wp_ajax
wp_ajax_defender_webauthn_verify_responseauthenticated
wp_ajax
wp_ajax_wpdef_check_hub_sync_statusauthenticated
wp_ajax
1 more hidden
Score History
3 score snapshots
v6.1.0
24
Latest
- Findings
- 1,143
- Errors
- 550
- Warnings
- 593
- Check
- 2.0.0
v6.0.1
24
Score
- Findings
- 1,141
- Errors
- 547
- Warnings
- 594
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 24 | 1,143 | 550 | 593 | v6.1.0 | 2.0.0 |
| 24 | 1,141 | 547 | 594 | v6.0.1 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Category
Issue
Domain
Related
Yoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreClassic Editor63 scoreWooCommerce22 scoreAkismet Anti-spam: Spam Protection35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreAdvanced Custom Fields (ACF®)23 scoreUltimate Addons for Elementor33 scoreWordPress Importer25 scoreStarter Templates – AI-Powered Templates for Elementor & Gutenberg24 scoreSmash Balloon Social Photo Feed – Easy Social Feeds Plugin25 scoreSpectra Legacy – Gutenberg Blocks25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreJetpack – WP Security, Backup, Speed, & Growth22 score
Category
Issue
Domain
Related
Yoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreClassic Editor63 scoreWooCommerce22 scoreAkismet Anti-spam: Spam Protection35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreAdvanced Custom Fields (ACF®)23 scoreUltimate Addons for Elementor33 scoreWordPress Importer25 scoreStarter Templates – AI-Powered Templates for Elementor & Gutenberg24 scoreSmash Balloon Social Photo Feed – Easy Social Feeds Plugin25 scoreSpectra Legacy – Gutenberg Blocks25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreJetpack – WP Security, Backup, Speed, & Growth22 score
Related Plugins
Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…
2k+ active installs
100
Compromise Scanner for wp2shell
2k+ active installs
100
Block wp-login
600 active installs
100
Site Lockdown Security
500 active installs
100
WEDOS | Protection & Cache Performance
400 active installs
100
AntiVirus
30k+ active installs
99