Protect your Contact Form 7 forms with GDPR-compliant Double Opt-In. Ensure valid emails, prevent fake signups, and stay compliant.
24
Score
233
Errors
441
Warnings
+0
Change
Category Scores
Security0
Repo91
Performance100
Maintainability4
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Maintainability
333
11 issue groups
Security
296
12 issue groups
I18n
21
2 issue groups
WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'f12_cf7_doubleoptin_do_sanitize_key_'.$key".146
- Category
- Maintainability
- Occurrences
- 146
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'f12_cf7_doubleoptin_do_sanitize_key_'.$key".
ERRORSecuritySQL query is not preparedUse placeholders and $wpdb->prepare(); found $countQuery61
- Category
- Security
- Occurrences
- 61
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $countQuery
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$L".60
- Category
- Maintainability
- Occurrences
- 60
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$L".
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.56
- Category
- Security
- Occurrences
- 56
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.38
- Category
- Maintainability
- Occurrences
- 38
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().36
- Category
- Maintainability
- Occurrences
- 36
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable {$catTable} at \t\t\t FROM {$catTable} c\n36
- Category
- Security
- Occurrences
- 36
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable {$catTable} at \t\t\t FROM {$catTable} c\n
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.26
- Category
- Security
- Occurrences
- 26
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityRequest data is not unslashed$_GET['keyword'] not unslashed before sanitization. Use wp_unslash() or similar23
- Category
- Security
- Occurrences
- 23
- Severity
- warning
Sample message
$_GET['keyword'] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.20
- Category
- Security
- Occurrences
- 20
- Severity
- warning
Sample message
Processing form data without nonce verification.
Show 15 moreShow less
ERRORSecurityOutput is not escaped19
- Category
- Security
- Occurrences
- 19
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$autoDetected'.
WARNINGSecurityInput is not sanitized18
- Category
- Security
- Occurrences
- 18
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_GET['_wpnonce']
ERRORI18nMissing Translators Comment17
- Category
- I18n
- Occurrences
- 17
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
ERRORMaintainabilityNot Allowed16
- Category
- Maintainability
- Occurrences
- 16
- Severity
- error
Sample message
Use of heredoc syntax (<<<) is not allowed; use standard strings or inline HTML instead
ERRORSecurityDatabase parameter is not escaped16
- Category
- Security
- Occurrences
- 16
- Severity
- error
Sample message
Unescaped parameter $catTable used in $wpdb->get_results()\n$catTable assigned unsafely at line 1658.
ERRORMaintainabilitydate date13
- Category
- Maintainability
- Occurrences
- 13
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
WARNINGSecurityDatabase parameter is not escaped12
- Category
- Security
- Occurrences
- 12
- Severity
- warning
Sample message
Unescaped parameter $table used in $wpdb->get_results()
ERRORMaintainabilityrand mt rand8
- Category
- Maintainability
- Occurrences
- 8
- Severity
- error
Sample message
mt_rand() is discouraged. Use the far less predictable wp_rand() instead.
ERRORSecurityException output is not escaped5
- Category
- Security
- Occurrences
- 5
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Cannot resolve parameter {$param->getName()} for {$class}"'.
ERRORMaintainabilityunlink unlink5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- error
Sample message
unlink() is discouraged. Use wp_delete_file() to delete a file.
WARNINGMaintainabilityNon-prefixed constant4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "F12_DEBUG".
WARNINGSecurityInput is not validated4
- Category
- Security
- Occurrences
- 4
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_GET['optin']. Check that the array index exists before using it.
ERRORI18nMissing Arg Domain4
- Category
- I18n
- Occurrences
- 4
- Severity
- error
Sample message
Missing $domain parameter in function call to _e().
WARNINGMaintainabilityupgrade notice limit4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
The upgrade notice for "3.2.0" exceeds the limit of 300 characters.
ERRORMaintainabilityrename rename3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- error
Sample message
rename() is discouraged. Use WP_Filesystem::move() to rename a file.
External Connections
Potential connections found in static code analysis.
Outbound calls
17
External assets
1
Incoming endpoints
12
Notable Domains
php-fig.org2 · outbound
api.forge12.com1 · outbound
colorzilla.com1 · outbound
getcomposer.org1 · outbound
highlightjs.org1 · outbound
silentshield.forge12.com1 · outbound
Platform / Reference Domains
github.com3 · platform/reference
developer.wordpress.org1 · platform/reference
w3.org1 · platform/reference
wordpress.org1 · platform/reference
External Asset Domains
forge12.com5 · asset + outbound
Incoming Endpoints
wp_ajax_nopriv_doi_check_submission_errorpublic
wp_ajax
Admin AJAX endpoints10
wp_ajax_f12_doi_templateloaderauthenticated
wp_ajax
wp_ajax_doi_check_submission_errorauthenticated
wp_ajax
wp_ajax_doi_export_consentauthenticated
wp_ajax
wp_ajax_doi_get_all_formsauthenticated
wp_ajax
wp_ajax_doi_get_form_settingsauthenticated
wp_ajax
wp_ajax_doi_resend_optin_mailauthenticated
wp_ajax
wp_ajax_doi_save_form_settingsauthenticated
wp_ajax
wp_ajax_doi_toggle_formauthenticated
wp_ajax
wp_ajax_f12_doi_avada_dismissauthenticated
wp_ajax
wp_ajax_f12_doi_detailsauthenticated
wp_ajax
Score History
5 score snapshots
v5.1.6
24
Latest
- Findings
- 674
- Errors
- 233
- Warnings
- 441
- Check
- 2.0.0
v5.1.5
24
Score
- Findings
- 674
- Errors
- 233
- Warnings
- 441
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 24 | 674 | 233 | 441 | v5.1.6 | 2.0.0 |
| 24 | 674 | 233 | 441 | v5.1.5 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Issue
Domain
Related
Yoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce22 scoreAkismet Anti-spam: Spam Protection35 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreLiteSpeed Cache35 scoreAll-in-One WP Migration and Backup34 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreRank Math SEO – AI SEO Tools to Dominate SEO Rankings30 scoreComplianz – GDPR/CCPA Cookie Consent24 scoreCookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice)87 scoreCompliance by Hu-manity.co32 scoreDatabase Addon for Contact Form 7 – CFDB739 scoreCookieAdmin – Cookie Consent Banner37 score
Issue
Domain
Related
Yoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce22 scoreAkismet Anti-spam: Spam Protection35 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreLiteSpeed Cache35 scoreAll-in-One WP Migration and Backup34 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreRank Math SEO – AI SEO Tools to Dominate SEO Rankings30 scoreComplianz – GDPR/CCPA Cookie Consent24 scoreCookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice)87 scoreCompliance by Hu-manity.co32 scoreDatabase Addon for Contact Form 7 – CFDB739 scoreCookieAdmin – Cookie Consent Banner37 score
Related Plugins
Disable Emojis (GDPR friendly)
60k+ active installs
100
WF Cookie Consent
10k+ active installs
100
WS Form LITE – Drag & Drop Contact Form Builder
10k+ active installs
100
DS CF7 Math Captcha
10k+ active installs
100
Message Bridge for Contact Form 7 and Telegram
10k+ active installs
100
HTML Editor for Contact Form 7
2k+ active installs
100