Two-factor authentication, passkeys, social login, magic login, limit login attempts, file change scanning and audit logs for WordPress.
28
Score
277
Errors
288
Warnings
+0
Change
Category Scores
Security0
Repo100
Performance100
Maintainability13
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
I18n
208
3 issue groups
Security
178
10 issue groups
Maintainability
162
12 issue groups
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.177
- Category
- I18n
- Occurrences
- 177
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.63
- Category
- Security
- Occurrences
- 63
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.37
- Category
- Security
- Occurrences
- 37
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.35
- Category
- Maintainability
- Occurrences
- 35
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "allow_password_reset".34
- Category
- Maintainability
- Occurrences
- 34
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "allow_password_reset".
ERRORMaintainabilitydate datedate() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.30
- Category
- Maintainability
- Occurrences
- 30
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().29
- Category
- Maintainability
- Occurrences
- 29
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGSecurityRequest data is not unslashed$_COOKIE['__fls_auth_client_id'] not unslashed before sanitization. Use wp_unslash() or similar26
- Category
- Security
- Occurrences
- 26
- Severity
- warning
Sample message
$_COOKIE['__fls_auth_client_id'] not unslashed before sanitization. Use wp_unslash() or similar
ERRORI18nUnordered Placeholders TextMultiple placeholders in translatable strings should be ordered. Expected "%1$1s, %2$2s", but got "%1s, %2s" in '%1s They belong to %2s people, so tell them first.'.22
- Category
- I18n
- Occurrences
- 22
- Severity
- error
Sample message
Multiple placeholders in translatable strings should be ordered. Expected "%1$1s, %2$2s", but got "%1s, %2s" in '%1s They belong to %2s people, so tell them first.'.
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_COOKIE['fs_intent_redirect']12
- Category
- Security
- Occurrences
- 12
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_COOKIE['fs_intent_redirect']
Show 15 moreShow less
WARNINGSecurityInterpolated SQL is not prepared10
- Category
- Security
- Occurrences
- 10
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable $table at "SELECT 1 FROM $table LIMIT 1"
ERRORI18nMissing Singular Placeholder9
- Category
- I18n
- Occurrences
- 9
- Severity
- error
Sample message
Missing singular placeholder, needed for some languages. See https://codex.wordpress.org/I18n_for_WordPress_Developers#Plurals
WARNINGSecurityDatabase parameter is not escaped8
- Category
- Security
- Occurrences
- 8
- Severity
- warning
Sample message
Unescaped parameter $table used in $wpdb->get_var()\n$table assigned unsafely at line 168.
ERRORSecurityException output is not escaped8
- Category
- Security
- Occurrences
- 8
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$additional'.
ERRORMaintainabilityunlink unlink7
- Category
- Maintainability
- Occurrences
- 7
- Severity
- error
Sample message
unlink() is discouraged. Use wp_delete_file() to delete a file.
WARNINGMaintainabilityNon-prefixed global variable6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$appPermission".
WARNINGSecuritywp redirect wp redirect6
- Category
- Security
- Occurrences
- 6
- Severity
- warning
Sample message
wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.
ERRORMaintainabilityfile system operations is writable6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writable().
WARNINGSecurityInput is not validated5
- Category
- Security
- Occurrences
- 5
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_GET['page']. Check that the array index exists before using it.
ERRORMaintainabilityparse url parse url5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- error
Sample message
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
ERRORSecurityDatabase parameter is not escaped3
- Category
- Security
- Occurrences
- 3
- Severity
- error
Sample message
Unescaped parameter $from used in $wpdb->get_col()\n$from assigned unsafely at line 189.
WARNINGMaintainabilitySchema Change3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
Attempting a database schema change is discouraged.
ERRORMaintainabilityrand mt rand3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- error
Sample message
mt_rand() is discouraged. Use the far less predictable wp_rand() instead.
WARNINGMaintainabilityDiscouraged PHP function2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
The use of function set_time_limit() is discouraged
WARNINGMaintainabilityerror log var export2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
var_export() found. Debug code should not normally be used in production.
External Connections
Potential connections found in static code analysis.
Outbound calls
111
External assets
1
Incoming endpoints
15
Notable Domains
fluentauth.com6 · outbound
stackoverflow.com3 · outbound
api.github.com2 · outbound
artima.com2 · outbound
dash.fluentauth.com2 · outbound
graph.facebook.com2 · outbound
Platform / Reference Domains
github.com60 · platform/reference
w3.org8 · platform/reference
downloads.wordpress.org4 · platform/reference
api.wordpress.org1 · platform/reference
gnu.org1 · platform/reference
plugins.svn.wordpress.org1 · platform/reference
themes.svn.wordpress.org1 · platform/reference
wordpress.org1 · platform/reference
External Asset Domains
accounts.google.com2 · asset + outbound
Incoming Endpoints
wp_ajax_nopriv_public
wp_ajax
wp_ajax_nopriv_fls_magic_send_magic_emailpublic
wp_ajax
wp_ajax_nopriv_fluent_auth_loginpublic
wp_ajax
wp_ajax_nopriv_fluent_auth_rppublic
wp_ajax
wp_ajax_nopriv_fluent_auth_signuppublic
wp_ajax
wp_ajax_nopriv_fluent_security_google_one_tap_loginpublic
wp_ajax
Admin AJAX endpoints7
wp_ajax_fluent_auth_passkey_deleteauthenticated
wp_ajax
wp_ajax_fluent_auth_passkey_optionsauthenticated
wp_ajax
wp_ajax_fluent_auth_passkey_registerauthenticated
wp_ajax
wp_ajax_fluent_auth_passkey_renameauthenticated
wp_ajax
wp_ajax_fluent_auth_totp_disableauthenticated
wp_ajax
wp_ajax_fluent_auth_totp_recoveryauthenticated
wp_ajax
wp_ajax_fluent_security_google_one_tap_loginauthenticated
wp_ajax
Score History
4 score snapshots
v3.0.3
28
Latest
- Findings
- 565
- Errors
- 277
- Warnings
- 288
- Check
- 2.1.0
v3.0.2
28
Score
- Findings
- 560
- Errors
- 276
- Warnings
- 284
- Check
- 2.1.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 28 | 565 | 277 | 288 | v3.0.3 | 2.1.0 |
| 28 | 560 | 276 | 284 | v3.0.2 | 2.1.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Category
Issue
Domain
Related
Wordfence Security – Firewall, Malware Scan, and Login Security21 scoreWooCommerce22 scoreAll-in-One WP Migration and Backup34 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreLiteSpeed Cache35 scoreAkismet Anti-spam: Spam Protection35 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreWPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager88 scoreHostinger Tools82 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreWPS Hide Login42 score
Author
Category
Issue
Domain
Related
Wordfence Security – Firewall, Malware Scan, and Login Security21 scoreWooCommerce22 scoreAll-in-One WP Migration and Backup34 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreLiteSpeed Cache35 scoreAkismet Anti-spam: Spam Protection35 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreWPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager88 scoreHostinger Tools82 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreWPS Hide Login42 score
Related Plugins
User Role Editor
700k+ active installs
100
Stop User Enumeration
50k+ active installs
100
Login as User: See the Site as Any User
30k+ active installs
100
Social Login, Social Sharing by miniOrange
10k+ active installs
100
Login Security Captcha
10k+ active installs
100
Stop XML-RPC Attacks
6k+ active installs
100