Protect your Contact Form 7 forms with GDPR-compliant Double Opt-In. Ensure valid emails, prevent fake signups, and stay compliant.
22
Score
352
Errors
492
Warnings
+0
Change
Category Scores
Security0
Repo83
Performance100
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
425
11 issue groups
Maintainability
370
12 issue groups
I18n
20
2 issue groups
ERRORSecuritySQL query is not preparedUse placeholders and $wpdb->prepare(); found $action176
- Category
- Security
- Occurrences
- 176
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $action
WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'f12_cf7_doubleoptin_do_sanitize_key_'.$key".164
- Category
- Maintainability
- Occurrences
- 164
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'f12_cf7_doubleoptin_do_sanitize_key_'.$key".
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$L".61
- Category
- Maintainability
- Occurrences
- 61
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$L".
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.56
- Category
- Security
- Occurrences
- 56
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable {$budget} at \t\t\t\t budget_attempts = {$budget},\n55
- Category
- Security
- Occurrences
- 55
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable {$budget} at \t\t\t\t budget_attempts = {$budget},\n
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.42
- Category
- Maintainability
- Occurrences
- 42
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().40
- Category
- Maintainability
- Occurrences
- 40
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.22
- Category
- Security
- Occurrences
- 22
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityRequest data is not unslashed$_GET['keyword'] not unslashed before sanitization. Use wp_unslash() or similar22
- Category
- Security
- Occurrences
- 22
- Severity
- warning
Sample message
$_GET['keyword'] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.21
- Category
- Security
- Occurrences
- 21
- Severity
- warning
Sample message
Processing form data without nonce verification.
Show 15 moreShow less
ERRORSecurityDatabase parameter is not escaped19
- Category
- Security
- Occurrences
- 19
- Severity
- error
Sample message
Unescaped parameter $budget used in $wpdb->query()\n$budget assigned unsafely at line 129.
WARNINGSecurityInput is not sanitized18
- Category
- Security
- Occurrences
- 18
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_GET['_wpnonce']
ERRORSecurityOutput is not escaped17
- Category
- Security
- Occurrences
- 17
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$autoDetected'.
ERRORMaintainabilityNot Allowed16
- Category
- Maintainability
- Occurrences
- 16
- Severity
- error
Sample message
Use of heredoc syntax (<<<) is not allowed; use standard strings or inline HTML instead
ERRORI18nMissing Translators Comment16
- Category
- I18n
- Occurrences
- 16
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
WARNINGSecurityDatabase parameter is not escaped14
- Category
- Security
- Occurrences
- 14
- Severity
- warning
Sample message
Unescaped parameter $table used in $wpdb->get_results()
ERRORMaintainabilitydate date13
- Category
- Maintainability
- Occurrences
- 13
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
WARNINGMaintainabilityupgrade notice limit9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- warning
Sample message
The upgrade notice for "3.2.0" exceeds the limit of 300 characters.
ERRORMaintainabilityrand mt rand8
- Category
- Maintainability
- Occurrences
- 8
- Severity
- error
Sample message
mt_rand() is discouraged. Use the far less predictable wp_rand() instead.
ERRORMaintainabilityunlink unlink6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- error
Sample message
unlink() is discouraged. Use wp_delete_file() to delete a file.
ERRORSecurityException output is not escaped5
- Category
- Security
- Occurrences
- 5
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Cannot resolve parameter {$param->getName()} for {$class}"'.
WARNINGMaintainabilityNon-prefixed constant4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "F12_DEBUG".
ERRORMaintainabilityrename rename4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
rename() is discouraged. Use WP_Filesystem::move() to rename a file.
ERRORI18nMissing Arg Domain4
- Category
- I18n
- Occurrences
- 4
- Severity
- error
Sample message
Missing $domain parameter in function call to _e().
WARNINGMaintainabilitySchema Change3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
Attempting a database schema change is discouraged.
External Connections
Potential connections found in static code analysis.
Outbound calls
18
External assets
1
Incoming endpoints
13
Notable Domains
php-fig.org2 · outbound
api.forge12.com1 · outbound
colorzilla.com1 · outbound
getcomposer.org1 · outbound
highlightjs.org1 · outbound
silentshield.forge12.com1 · outbound
Platform / Reference Domains
github.com3 · platform/reference
developer.wordpress.org1 · platform/reference
w3.org1 · platform/reference
wordpress.org1 · platform/reference
External Asset Domains
forge12.com6 · asset + outbound
Incoming Endpoints
wp_ajax_nopriv_doi_check_submission_errorpublic
wp_ajax
Admin AJAX endpoints11
wp_ajax_f12_doi_templateloaderauthenticated
wp_ajax
wp_ajax_doi_check_submission_errorauthenticated
wp_ajax
wp_ajax_doi_export_consentauthenticated
wp_ajax
wp_ajax_doi_get_all_formsauthenticated
wp_ajax
wp_ajax_doi_get_form_settingsauthenticated
wp_ajax
wp_ajax_doi_resend_optin_mailauthenticated
wp_ajax
wp_ajax_doi_save_form_settingsauthenticated
wp_ajax
wp_ajax_doi_toggle_formauthenticated
wp_ajax
wp_ajax_f12_doi_avada_dismissauthenticated
wp_ajax
wp_ajax_f12_doi_detailsauthenticated
wp_ajax
wp_ajax_f12_doi_dismiss_surveyauthenticated
wp_ajax
Score History
11 score snapshots
v5.6.3
22
Latest
- Findings
- 844
- Errors
- 352
- Warnings
- 492
- Check
- 2.1.0
v5.6.0
22
Score
- Findings
- 843
- Errors
- 352
- Warnings
- 491
- Check
- 2.1.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 22 | 844 | 352 | 492 | v5.6.3 | 2.1.0 |
| 22 | 843 | 352 | 491 | v5.6.0 | 2.1.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Issue
Domain
Related
Yoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce22 scoreAkismet Anti-spam: Spam Protection35 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder38 scoreLiteSpeed Cache35 scoreAll-in-One WP Migration and Backup34 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreRank Math SEO – AI SEO Tools to Dominate SEO Rankings29 scoreComplianz GDPR/CCPA Cookie Consent Banner24 scoreCookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice)87 scoreCookie Compliance for WordPress – Cookie Consent, GDPR & CCPA29 scoreDatabase Addon for Contact Form 7 – CFDB739 scoreCookieAdmin – Cookie Consent Banner37 score
Issue
Domain
Related
Yoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce22 scoreAkismet Anti-spam: Spam Protection35 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder38 scoreLiteSpeed Cache35 scoreAll-in-One WP Migration and Backup34 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreRank Math SEO – AI SEO Tools to Dominate SEO Rankings29 scoreComplianz GDPR/CCPA Cookie Consent Banner24 scoreCookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice)87 scoreCookie Compliance for WordPress – Cookie Consent, GDPR & CCPA29 scoreDatabase Addon for Contact Form 7 – CFDB739 scoreCookieAdmin – Cookie Consent Banner37 score
Related Plugins
Ultra Addons for Contact Form 7
60k+ active installs
100
Disable Emojis (GDPR friendly)
60k+ active installs
100
WF Cookie Consent
10k+ active installs
100
WS Form LITE – Drag & Drop Contact Form Builder
10k+ active installs
100
DS CF7 Math Captcha
10k+ active installs
100
miniOrange OTP Login, Verification and SMS Notifications
5k+ active installs
100