Top Issues by Category
maintainability88
i18n35
repo_compliance3
supply_chain1
Issues Details
135 issues found in latest scan
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$autoloader".
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '__'.
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "EW_DIR_PATH".
unlink() is discouraged. Use wp_delete_file() to delete a file.
The $text parameter must be a single text string literal. Found: sprintf( 'Edit “%s”', $watermark->post_title )
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "ew_load".
Detected usage of meta_key, possible slow query.
Detected usage of meta_query, possible slow query.
Detected usage of meta_value, possible slow query.
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "ew_dochooks_enabled".
trigger_error() found. Debug code should not normally be used in production.
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir().
rename() is discouraged. Use WP_Filesystem::move() to rename a file.
GitHub workflow directory ".github" detected. This directory should not be included in production plugins.
The "/vendor" directory using composer exists, but "composer.json" file is missing.
Tested up to: 6.8 < 7.0. The "Tested up to" value in your plugin is not set to the current version of WordPress. This means your plugin will not show up in searches, as we require plugins to be compatible and documented as tested up to the most recent version of WordPress.
The "Domain Path" header in the plugin file must point to an existing folder. Found: "languages"
One or more tags were ignored. Please limit your plugin to 5 tags.
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$autoloader". | 39 |
| WordPress.WP.I18n.MissingArgDomain | ERROR | Missing $domain parameter in function call to __(). | 32 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 32 |
| WordPress.Security.EscapeOutput.ExceptionNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '__'. | 8 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "EW_DIR_PATH". | 3 |
| WordPress.WP.AlternativeFunctions.unlink_unlink | ERROR | unlink() is discouraged. Use wp_delete_file() to delete a file. | 3 |
| WordPress.WP.I18n.NonSingularStringLiteralText | ERROR | The $text parameter must be a single text string literal. Found: sprintf( 'Edit “%s”', $watermark->post_title ) | 3 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "ew_load". | 2 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_key | WARNING | Detected usage of meta_key, possible slow query. | 1 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_query | WARNING | Detected usage of meta_query, possible slow query. | 1 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_value | WARNING | Detected usage of meta_value, possible slow query. | 1 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "ew_dochooks_enabled". | 1 |
| WordPress.PHP.DevelopmentFunctions.error_log_trigger_error | WARNING | trigger_error() found. Debug code should not normally be used in production. | 1 |
| WordPress.WP.AlternativeFunctions.file_system_operations_mkdir | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir(). | 1 |
| WordPress.WP.AlternativeFunctions.rename_rename | ERROR | rename() is discouraged. Use WP_Filesystem::move() to rename a file. | 1 |
| github_directory | WARNING | GitHub workflow directory ".github" detected. This directory should not be included in production plugins. | 1 |
| hidden_files | ERROR | Hidden files are not permitted. | 1 |
| missing_composer_json_file | WARNING | The "/vendor" directory using composer exists, but "composer.json" file is missing. | 1 |
| outdated_tested_upto_header | ERROR | Tested up to: 6.8 < 7.0. The "Tested up to" value in your plugin is not set to the current version of WordPress. This means your plugin will not show up in searches, as we require plugins to be compatible and documented as tested up to the most recent version of WordPress. | 1 |
| plugin_header_nonexistent_domain_path | WARNING | The "Domain Path" header in the plugin file must point to an existing folder. Found: "languages" | 1 |
| readme_parser_warnings_too_many_tags | WARNING | One or more tags were ignored. Please limit your plugin to 5 tags. | 1 |
Latest Snapshot
Findings
135
Errors
82
Warnings
53
Score History
First score snapshot
First scan completed
v1.0.11 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
v1.0.11
35
Latest
- Findings
- 135
- Errors
- 82
- Warnings
- 53
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Latest | 35 | 135 | 82 | 53 | v1.0.11 | 2.0.0 | 2026.06-mvp-static-v2 |
