Track live WordPress visitors in real time with visitor journeys, referrers, profiles, heatmaps, WooCommerce context, and live chat.
34
Score
410
Errors
322
Warnings
+0
Change
Category Scores
Security0
Repo94
Performance100
Maintainability49
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
610
8 issue groups
Maintainability
112
12 issue groups
I18n
9
4 issue groups
Repo Compliance
1
1 issue group
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$after_title'.334
- Category
- Security
- Occurrences
- 334
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$after_title'.
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.90
- Category
- Security
- Occurrences
- 90
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_COOKIE['comment_author_'.md5( get_option("siteurl"))]59
- Category
- Security
- Occurrences
- 59
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_COOKIE['comment_author_'.md5( get_option("siteurl"))]
WARNINGSecurityRequest data is not unslashed$_COOKIE['comment_author_'.md5( get_option("siteurl"))] not unslashed before sanitization. Use wp_unslash() or similar59
- Category
- Security
- Occurrences
- 59
- Severity
- warning
Sample message
$_COOKIE['comment_author_'.md5( get_option("siteurl"))] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGSecurityInput is not validatedDetected usage of a possibly undefined superglobal array index: $_POST['_hs_data_output_visitor_base']. Check that the array index exists before using it.52
- Category
- Security
- Occurrences
- 52
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_POST['_hs_data_output_visitor_base']. Check that the array index exists before using it.
ERRORMaintainabilitywp function not compatible with requires wpFunction "esc_attr()" requires WordPress 2.8.0, but your plugin minimum supported version is WordPress 2.7.0.42
- Category
- Maintainability
- Occurrences
- 42
- Severity
- error
Sample message
Function "esc_attr()" requires WordPress 2.8.0, but your plugin minimum supported version is WordPress 2.7.0.
WARNINGMaintainabilityNon-prefixed functionFunctions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "_hits_gf_before_email".25
- Category
- Maintainability
- Occurrences
- 25
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "_hits_gf_before_email".
WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "automatic_updates_complete".14
- Category
- Maintainability
- Occurrences
- 14
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "automatic_updates_complete".
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.13
- Category
- Security
- Occurrences
- 13
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$_hitsteps_jetpack_init".10
- Category
- Maintainability
- Occurrences
- 10
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$_hitsteps_jetpack_init".
Show 15 moreShow less
ERRORMaintainabilityMissing direct file access protection7
- Category
- Maintainability
- Occurrences
- 7
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
ERRORMaintainabilityNon Enqueued Script4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
Scripts must be registered/enqueued via wp_enqueue_script()
WARNINGMaintainabilityDeprecated function: get_currentuserinfo3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
get_currentuserinfo() has been deprecated since WordPress version 4.5.0. Use wp_get_current_user() instead.
ERRORI18nMissing Arg Domain3
- Category
- I18n
- Occurrences
- 3
- Severity
- error
Sample message
Missing $domain parameter in function call to __().
WARNINGI18nNo Html Wrapped Strings3
- Category
- I18n
- Occurrences
- 3
- Severity
- warning
Sample message
Translatable string should not be wrapped in HTML. Found: "<h2>Nonce is not valid.</h2>"
ERRORMaintainabilityForbidden PHP function found2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
The use of function create_function() is forbidden
WARNINGMaintainabilityNon-prefixed class2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "hst_STATS".
WARNINGSecurityNonce verification recommended2
- Category
- Security
- Occurrences
- 2
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORI18nMissing Translators Comment2
- Category
- I18n
- Occurrences
- 2
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
WARNINGSecurityPlugin menu slug uses __FILE__1
- Category
- Security
- Occurrences
- 1
- Severity
- warning
Sample message
Using __FILE__ for menu slugs risks exposing filesystem structure.
ERRORMaintainabilityrand mt rand1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
mt_rand() is discouraged. Use the far less predictable wp_rand() instead.
WARNINGI18nDeprecated parameter: load_plugin_textdomain parameter 21
- Category
- I18n
- Occurrences
- 1
- Severity
- warning
Sample message
The parameter "FALSE" at position #2 of load_plugin_textdomain() has been deprecated since WordPress version 2.7.0. Use "" instead.
WARNINGMaintainabilityNot In Footer1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.
ERRORMaintainabilityfive star reviews detected1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
Linking directly to 5 stars reviews is not allowed.
ERRORRepo Complianceplugin header no license1
- Category
- Repo Compliance
- Occurrences
- 1
- Severity
- error
Sample message
Missing "License" in Plugin Header. Please update your Plugin Header with a valid GPLv2 (or later) compatible license.
External Connections
Potential connections found in static code analysis.
Outbound calls
39
External assets
8
Incoming endpoints
0
Notable Domains
144.76.44.1111 · outbound
46.4.176.1511 · outbound
addons.mozilla.org1 · outbound
apps.apple.com1 · outbound
chrome.google.com1 · outbound
play.google.com1 · outbound
Platform / Reference Domains
wordpress.org1 · platform/reference
External Asset Domains
hitsteps.com27 · asset + outbound
edgecdnplus.com9 · asset + outbound
hitsteps.pro3 · asset + outbound
hitsteps.net1 · asset
Incoming Endpoints
No public endpoints detected.
Score History
4 score snapshots
v5.96
34
Latest
- Findings
- 732
- Errors
- 410
- Warnings
- 322
- Check
- 2.0.0
v5.95
34
Score
- Findings
- 732
- Errors
- 410
- Warnings
- 322
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 34 | 732 | 410 | 322 | v5.96 | 2.0.0 |
| 34 | 732 | 410 | 322 | v5.95 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Category
Issue
Domain
Related
Aurora Heatmap35 scoreUserHeat Plugin39 scoreNelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization92 scoreAffiliateWP – Affiliate Info79 scoreheatmap for WordPress – Realtime analytics40 scoreWooCommerce22 scoreAkismet Anti-spam: Spam Protection35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreContact Form 769 scoreClassic Editor63 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreQA Assistants – Driven by data30 score
Author
Category
Issue
Domain
Related
Aurora Heatmap35 scoreUserHeat Plugin39 scoreNelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization92 scoreAffiliateWP – Affiliate Info79 scoreheatmap for WordPress – Realtime analytics40 scoreWooCommerce22 scoreAkismet Anti-spam: Spam Protection35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreContact Form 769 scoreClassic Editor63 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreQA Assistants – Driven by data30 score
Related Plugins
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
4k+ active installs
92
AffiliateWP – Affiliate Info
1k+ active installs
79
heatmap for WordPress – Realtime analytics
1k+ active installs
40
UserHeat Plugin
5k+ active installs
39
39
Aurora Heatmap
20k+ active installs
35