Simple secure login and user management through your Google Workspace for WordPress (using oAuth2 and MFA if enabled).
Category Scores
Top Issues by Category
security110
maintainability99
Issues Details
224 issues found in latest scan
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"($name) missing required param: '$paramName'"'.
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Processing form data without nonce verification.
Processing form data without nonce verification.
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "gal_avatar_source_desc".
Detected usage of a non-sanitized input variable: $_POST[$this->get_options_name()]
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "Basic_Google_Apps_Login".
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "gal_basic_google_apps_login".
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
mt_rand() is discouraged. Use the far less predictable wp_rand() instead.
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().
Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching.
set_error_handler() found. Debug code should not normally be used in production.
Detected usage of a possibly undefined superglobal array index: $_SERVER['HTTP_HOST']. Check that the array index exists before using it.
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: chmod().
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite().
unlink() is discouraged. Use wp_delete_file() to delete a file.
The plugin name includes a restricted term. Your chosen plugin name - "Google Apps Login" - contains the restricted term "google" and cannot be used to begin your plugin name. We disallow the use of certain terms in ways that are abused, or potentially infringe on and/or are misleading with regards to trademarks. You may use the term "google" elsewhere in your plugin name, such as "... for google".
load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$gal_core_already_exists".
error_log() found. Debug code should not normally be used in production.
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.Security.EscapeOutput.ExceptionNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"($name) missing required param: '$paramName'"'. | 57 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 38 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 30 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 15 |
| WordPress.WP.AlternativeFunctions.curl_curl_setopt | ERROR | Using cURL functions is highly discouraged. Use wp_remote_get() instead. | 12 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "gal_avatar_source_desc". | 10 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_POST[$this->get_options_name()] | 6 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound | WARNING | Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "Basic_Google_Apps_Login". | 4 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "gal_basic_google_apps_login". | 4 |
| WordPress.WP.AlternativeFunctions.parse_url_parse_url | ERROR | parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead. | 4 |
| WordPress.WP.AlternativeFunctions.rand_mt_rand | ERROR | mt_rand() is discouraged. Use the far less predictable wp_rand() instead. | 4 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fopen | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen(). | 3 |
| WordPress.WP.EnqueuedResourceParameters.MissingVersion | WARNING | Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching. | 3 |
| WordPress.PHP.DevelopmentFunctions.error_log_set_error_handler | WARNING | set_error_handler() found. Debug code should not normally be used in production. | 2 |
| WordPress.Security.ValidatedSanitizedInput.InputNotValidated | WARNING | Detected usage of a possibly undefined superglobal array index: $_SERVER['HTTP_HOST']. Check that the array index exists before using it. | 2 |
| WordPress.WP.AlternativeFunctions.curl_curl_getinfo | ERROR | Using cURL functions is highly discouraged. Use wp_remote_get() instead. | 2 |
| WordPress.WP.AlternativeFunctions.file_system_operations_chmod | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: chmod(). | 2 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fclose | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose(). | 2 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fwrite | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite(). | 2 |
| WordPress.WP.AlternativeFunctions.unlink_unlink | ERROR | unlink() is discouraged. Use wp_delete_file() to delete a file. | 2 |
| trademarked_term | WARNING | The plugin name includes a restricted term. Your chosen plugin name - "Google Apps Login" - contains the restricted term "google" and cannot be used to begin your plugin name. We disallow the use of certain terms in ways that are abused, or potentially infringe on and/or are misleading with regards to trademarks. You may use the term "google" elsewhere in your plugin name, such as "... for google". | 2 |
| PluginCheck.CodeAnalysis.DiscouragedFunctions.load_plugin_textdomainFound | WARNING | load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed. | 1 |
| WordPress.DateTime.RestrictedFunctions.date_date | ERROR | date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead. | 1 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$gal_core_already_exists". | 1 |
| WordPress.PHP.DevelopmentFunctions.error_log_error_log | WARNING | error_log() found. Debug code should not normally be used in production. | 1 |
Latest Snapshot
Findings
224
Errors
139
Warnings
85
Score History
First score snapshot
First scan completed Jun 20, 2026
v3.5.2 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 20, 2026
v3.5.2
27
Latest
- Findings
- 224
- Errors
- 139
- Warnings
- 85
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 20, 2026Latest | 27 | 224 | 139 | 85 | v3.5.2 | 2.0.0 | 2026.06-mvp-static-v2 |