The original Google Fonts self-hosting plugin. Automagically caches your fonts locally — no configuration (or brains) required!
31
Score
213
Errors
62
Warnings
-1
Change
Category Scores
Security0
Repo67
Performance97
Maintainability58
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
152
8 issue groups
I18n
73
4 issue groups
Maintainability
37
10 issue groups
Supply Chain
5
1 issue group
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"#$handle"'.99
- Category
- Security
- Occurrences
- 99
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"#$handle"'.
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.58
- Category
- I18n
- Occurrences
- 58
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.18
- Category
- Security
- Occurrences
- 18
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGMaintainabilityDynamic hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$name . '_' . $option . '_setting_disabled'".14
- Category
- Maintainability
- Occurrences
- 14
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$name . '_' . $option . '_setting_disabled'".
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.13
- Category
- Security
- Occurrences
- 13
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
ERRORI18nUnordered Placeholders TextMultiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$d, %3$s", but got "%s, %d, %s" in '%s detected · %d subsets loading on every page · %s impact'.12
- Category
- I18n
- Occurrences
- 12
- Severity
- error
Sample message
Multiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$d, %3$s", but got "%s, %d, %s" in '%s detected · %d subsets loading on every page · %s impact'.
WARNINGSecurityRequest data is not unslashed$_GET['omgf_optimize'] not unslashed before sanitization. Use wp_unslash() or similar9
- Category
- Security
- Occurrences
- 9
- Severity
- warning
Sample message
$_GET['omgf_optimize'] not unslashed before sanitization. Use wp_unslash() or similar
ERRORMaintainabilityunlink unlinkunlink() is discouraged. Use wp_delete_file() to delete a file.8
- Category
- Maintainability
- Occurrences
- 8
- Severity
- error
Sample message
unlink() is discouraged. Use wp_delete_file() to delete a file.
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_COOKIE[$cookie_name]7
- Category
- Security
- Occurrences
- 7
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_COOKIE[$cookie_name]
ERRORSupply ChainHidden files includedHidden files are not permitted.5
- Category
- Supply Chain
- Occurrences
- 5
- Severity
- error
Sample message
Hidden files are not permitted.
Show 15 moreShow less
WARNINGSecurityInput is not validated4
- Category
- Security
- Occurrences
- 4
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_GET['PageSpeed']. Check that the array index exists before using it.
WARNINGMaintainabilityNon-prefixed hook name3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "apply_omgf_pro_promo".
ERRORMaintainabilityfile system operations rmdir3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: rmdir().
ERRORMaintainabilityparse url parse url3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- error
Sample message
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
WARNINGMaintainabilityerror log error log2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
error_log() found. Debug code should not normally be used in production.
ERRORI18nMissing Arg Domain2
- Category
- I18n
- Occurrences
- 2
- Severity
- error
Sample message
Missing $domain parameter in function call to __().
WARNINGPerformancePost Not In exclude2
- Category
- Performance
- Occurrences
- 2
- Severity
- warning
Sample message
Using exclusionary parameters, like exclude, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.
ERRORSecuritySetting is missing a sanitization callback1
- Category
- Security
- Occurrences
- 1
- Severity
- error
Sample message
Sanitization missing for register_setting().
WARNINGSecuritywp redirect wp redirect1
- Category
- Security
- Occurrences
- 1
- Severity
- warning
Sample message
wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.
ERRORMaintainabilityfile system operations readfile1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: readfile().
ERRORMaintainabilityrename rename1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
rename() is discouraged. Use WP_Filesystem::move() to rename a file.
ERRORI18nNon Singular String Literal Domain1
- Category
- I18n
- Occurrences
- 1
- Severity
- error
Sample message
The $domain parameter must be a single text string literal. Found: $this->plugin_text_domain
ERRORMaintainabilityapplication detected1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
Application files are not permitted.
ERRORMaintainabilitybadly named files1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- error
Sample message
File and folder names must not contain spaces or special characters.
ERRORRepo Compliancelicense mismatch1
- Category
- Repo Compliance
- Occurrences
- 1
- Severity
- error
Sample message
Your plugin has a different license declared in the readme file and plugin header. Please update your readme with a valid GPL license identifier.
External Connections
Potential connections found in static code analysis.
Outbound calls
107
External assets
0
Incoming endpoints
6
Notable Domains
daan.dev89 · outbound
fonts.googleapis.com2 · outbound
php-fig.org2 · outbound
assets.mailerlite.com1 · outbound
cdn.mydomain.com1 · outbound
getcomposer.org1 · outbound
Platform / Reference Domains
wordpress.org5 · platform/reference
github.com2 · platform/reference
core.trac.wordpress.org1 · platform/reference
External Asset Domains
No external asset domains detected.
Incoming Endpoints
No public endpoints detected.
Admin AJAX endpoints6
wp_ajax_omgf_delete_logauthenticated
wp_ajax
wp_ajax_omgf_download_logauthenticated
wp_ajax
wp_ajax_omgf_empty_dirauthenticated
wp_ajax
wp_ajax_omgf_hide_noticeauthenticated
wp_ajax
wp_ajax_omgf_refresh_cacheauthenticated
wp_ajax
wp_ajax_omgf_remove_stylesheet_from_dbauthenticated
wp_ajax
Score History
2 score snapshots
v6.3.8
31
Latest
- Findings
- 275
- Errors
- 213
- Warnings
- 62
- Check
- 2.0.0
v6.3.7
32
Score
- Findings
- 275
- Errors
- 211
- Warnings
- 64
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 31 | 275 | 213 | 62 | v6.3.8 | 2.0.0 |
| 32 | 275 | 211 | 64 | v6.3.7 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Issue
Domain
Related
WooCommerce22 scoreAll-in-One WP Migration and Backup34 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreClassic Editor63 scoreLiteSpeed Cache35 scoreAkismet Anti-spam: Spam Protection35 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreWPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager88 scoreComplianz – GDPR/CCPA Cookie Consent24 scoreCookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice)87 scoreWP Fastest Cache – WordPress Cache Plugin24 scoreWP Super Cache25 score
Author
Issue
Domain
Related
WooCommerce22 scoreAll-in-One WP Migration and Backup34 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreClassic Editor63 scoreLiteSpeed Cache35 scoreAkismet Anti-spam: Spam Protection35 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreWPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager88 scoreComplianz – GDPR/CCPA Cookie Consent24 scoreCookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice)87 scoreWP Fastest Cache – WordPress Cache Plugin24 scoreWP Super Cache25 score
Related Plugins
Automatic Cache Flusher for W3 Total Cache
4k+ active installs
100
Disable Emojis (GDPR friendly)
60k+ active installs
100
EU Withdrawal Compliance
900 active installs
100
Khattat – Arabic Fonts
500 active installs
100
Show Me The Cookies
500 active installs
100
WEDOS | Protection & Cache Performance
800 active installs
100