WordPress multi-level security scanner detecting malware, 0-day threats, brute-force attacks, bot attacks, and unauthorized admin changes.
25
Score
335
Errors
471
Warnings
+0
Change
Category Scores
Security0
Repo97
Performance100
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Maintainability
486
17 issue groups
Security
244
7 issue groups
I18n
20
1 issue group
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$a".129
- Category
- Maintainability
- Occurrences
- 129
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$a".
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"$argv[1] is not a file or dir\n"'.108
- Category
- Security
- Occurrences
- 108
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"$argv[1] is not a file or dir\n"'.
ERRORMaintainabilitywp function not compatible with requires wpFunction "sanitize_textarea_field()" requires WordPress 4.7.0, but your plugin minimum supported version is WordPress 3.3.2.59
- Category
- Maintainability
- Occurrences
- 59
- Severity
- error
Sample message
Function "sanitize_textarea_field()" requires WordPress 4.7.0, but your plugin minimum supported version is WordPress 3.3.2.
WARNINGMaintainabilityNon-prefixed functionFunctions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "clean_db_scan_hook".42
- Category
- Maintainability
- Occurrences
- 42
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "clean_db_scan_hook".
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.40
- Category
- Security
- Occurrences
- 40
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityRequest data is not unslashed$_GET['page'] not unslashed before sanitization. Use wp_unslash() or similar37
- Category
- Security
- Occurrences
- 37
- Severity
- warning
Sample message
$_GET['page'] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGMaintainabilityNon-prefixed classClasses declared by a theme/plugin should start with the theme/plugin prefix. Found: "CQtrAdminUsersMonitor".35
- Category
- Maintainability
- Occurrences
- 35
- Severity
- warning
Sample message
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "CQtrAdminUsersMonitor".
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;32
- Category
- Maintainability
- Occurrences
- 32
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.30
- Category
- Maintainability
- Occurrences
- 30
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().29
- Category
- Maintainability
- Occurrences
- 29
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
Show 15 moreShow less
WARNINGMaintainabilityNon-prefixed constant24
- Category
- Maintainability
- Occurrences
- 24
- Severity
- warning
Sample message
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "ALARM_BODY_PREVIEW_LENGTH".
WARNINGSecurityInput is not sanitized23
- Category
- Security
- Occurrences
- 23
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_GET['page']
ERRORI18nMissing Arg Domain20
- Category
- I18n
- Occurrences
- 20
- Severity
- error
Sample message
Missing $domain parameter in function call to __().
WARNINGSecurityInterpolated SQL is not prepared17
- Category
- Security
- Occurrences
- 17
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable {$alarms_table} at "DROP TABLE IF EXISTS `{$alarms_table}`"
ERRORMaintainabilitydate date17
- Category
- Maintainability
- Occurrences
- 17
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
ERRORMaintainabilityfile system operations fclose17
- Category
- Maintainability
- Occurrences
- 17
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
WARNINGMaintainabilityDiscouraged PHP function16
- Category
- Maintainability
- Occurrences
- 16
- Severity
- warning
Sample message
The use of function ini_set() is discouraged
ERRORMaintainabilityNon Enqueued Script16
- Category
- Maintainability
- Occurrences
- 16
- Severity
- error
Sample message
Scripts must be registered/enqueued via wp_enqueue_script()
WARNINGSecurityNonce verification recommended14
- Category
- Security
- Occurrences
- 14
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORMaintainabilityfile system operations fopen14
- Category
- Maintainability
- Occurrences
- 14
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().
WARNINGMaintainabilityNon-prefixed hook name8
- Category
- Maintainability
- Occurrences
- 8
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "qtr_bf_allowlist_cidrs".
ERRORMaintainabilitycurl curl setopt6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
ERRORMaintainabilityfile system operations fread6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fread().
ERRORMaintainabilityfile system operations fwrite6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite().
WARNINGSecurityDatabase parameter is not escaped5
- Category
- Security
- Occurrences
- 5
- Severity
- warning
Sample message
Unescaped parameter $alarms_table used in $wpdb->query()\n$alarms_table assigned unsafely at line 638.
External Connections
Potential connections found in static code analysis.
Outbound calls
126
External assets
1
Incoming endpoints
31
Notable Domains
quttera.com32 · outbound
getbootstrap.com17 · outbound
wp.quttera.com4 · outbound
threats.quttera.com3 · outbound
cdn.rawgit.com2 · outbound
blog.alexmaccaw.com1 · outbound
Platform / Reference Domains
w3.org43 · platform/reference
github.com18 · platform/reference
api.wordpress.org2 · platform/reference
External Asset Domains
cdn.jsdelivr.net1 · asset
Incoming Endpoints
No public endpoints detected.
Admin AJAX endpoints31
wp_ajax_scanner-acknowledge_alarmauthenticated
wp_ajax
wp_ajax_scanner-clean_files_whitelistauthenticated
wp_ajax
wp_ajax_scanner-clean_ignore_listauthenticated
wp_ajax
wp_ajax_scanner-clean_logauthenticated
wp_ajax
wp_ajax_scanner-clean_threats_whitelistauthenticated
wp_ajax
wp_ajax_scanner-clear-all-bot-protection-blocked-ipsauthenticated
wp_ajax
wp_ajax_scanner-clear-all-bruteforce-blocked-ipsauthenticated
wp_ajax
wp_ajax_scanner-get_detected_threatsauthenticated
wp_ajax
wp_ajax_scanner-get_file_reportauthenticated
wp_ajax
wp_ajax_scanner-get_ignored_threatsauthenticated
wp_ajax
wp_ajax_scanner-get_log_linesauthenticated
wp_ajax
wp_ajax_scanner-get_statsauthenticated
wp_ajax
19 more hidden
Score History
12 score snapshots
v4.1.0.25
25
Latest
- Findings
- 806
- Errors
- 335
- Warnings
- 471
- Check
- 2.0.0
v4.1.0.24
25
Score
- Findings
- 806
- Errors
- 335
- Warnings
- 471
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 25 | 806 | 335 | 471 | v4.1.0.25 | 2.0.0 |
| 25 | 806 | 335 | 471 | v4.1.0.24 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Category
Issue
Non-prefixed global variable129 findingsOutput is not escaped108 findingswp function not compatible with requires wp59 findingsNon-prefixed function42 findingsMissing nonce verification40 findingsRequest data is not unslashed37 findingsNon-prefixed class35 findingsMissing direct file access protection32 findings
Domain
Related
Security Optimizer – The All-In-One Protection Plugin35 scoreMalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall82 scoreMalcure Malware Shield — Removal, Repair, Monitor99 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce21 scoreAkismet Anti-spam: Spam Protection35 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreClassic Editor63 scoreLiteSpeed Cache35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreDefender Security – Malware Scanner, Login Security & Firewall24 scoreBulletProof Security0 score
Author
Category
Issue
Non-prefixed global variable129 findingsOutput is not escaped108 findingswp function not compatible with requires wp59 findingsNon-prefixed function42 findingsMissing nonce verification40 findingsRequest data is not unslashed37 findingsNon-prefixed class35 findingsMissing direct file access protection32 findings
Domain
Related
Security Optimizer – The All-In-One Protection Plugin35 scoreMalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall82 scoreMalcure Malware Shield — Removal, Repair, Monitor99 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce21 scoreAkismet Anti-spam: Spam Protection35 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreClassic Editor63 scoreLiteSpeed Cache35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreDefender Security – Malware Scanner, Login Security & Firewall24 scoreBulletProof Security0 score
Related Plugins
Site Lockdown Security
400 active installs
100
Malcure Malware Shield — Removal, Repair, Monitor
10k+ active installs
99
MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall
200k+ active installs
82
WebDefender Security – Protection & AntiSpam
1k+ active installs
70
Virusdie | One-click website security
2k+ active installs
39
Security Optimizer – The All-In-One Protection Plugin
1m+ active installs
35