Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate.
19
Score
536
Errors
379
Warnings
+0
Change
Category Scores
Security0
Repo58
Performance100
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Maintainability
321
14 issue groups
Security
297
7 issue groups
I18n
145
3 issue groups
Supply Chain
11
1 issue group
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.95
- Category
- I18n
- Occurrences
- 95
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$checked_attribute'.70
- Category
- Security
- Occurrences
- 70
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$checked_attribute'.
ERRORMaintainabilitycurl curl setoptUsing cURL functions is highly discouraged. Use wp_remote_get() instead.68
- Category
- Maintainability
- Occurrences
- 68
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.65
- Category
- Security
- Occurrences
- 65
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityRequest data is not unslashed$_GET['_wpnonce'] not unslashed before sanitization. Use wp_unslash() or similar63
- Category
- Security
- Occurrences
- 63
- Severity
- warning
Sample message
$_GET['_wpnonce'] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET['_wpnonce']58
- Category
- Security
- Occurrences
- 58
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_GET['_wpnonce']
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$autoloader".43
- Category
- Maintainability
- Occurrences
- 43
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$autoloader".
ERRORMaintainabilityfile system operations is writableFile operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writable().35
- Category
- Maintainability
- Occurrences
- 35
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writable().
ERRORI18nUnordered Placeholders TextMultiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$d", but got "%s, %d" in 'Reached %s, but received an error response code: %d. HTTPS is not properly configured.'.32
- Category
- I18n
- Occurrences
- 32
- Severity
- error
Sample message
Multiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$d", but got "%s, %d" in 'Reached %s, but received an error response code: %d. HTTPS is not properly configured.'.
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;30
- Category
- Maintainability
- Occurrences
- 30
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Show 15 moreShow less
WARNINGMaintainabilityNon-prefixed hook name25
- Category
- Maintainability
- Occurrences
- 25
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "login_body_class".
ERRORI18nMissing Arg Domain18
- Category
- I18n
- Occurrences
- 18
- Severity
- error
Sample message
Missing $domain parameter in function call to __().
ERRORMaintainabilityunlink unlink17
- Category
- Maintainability
- Occurrences
- 17
- Severity
- error
Sample message
unlink() is discouraged. Use wp_delete_file() to delete a file.
WARNINGMaintainabilityDirect Query16
- Category
- Maintainability
- Occurrences
- 16
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
ERRORSecurityException output is not escaped16
- Category
- Security
- Occurrences
- 16
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Email address \"$email\" not valid in "'.
ERRORSecurityUnsafe printing function16
- Category
- Security
- Occurrences
- 16
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
ERRORMaintainabilityfile system operations fclose15
- Category
- Maintainability
- Occurrences
- 15
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
ERRORMaintainabilityShort PHP open tag found14
- Category
- Maintainability
- Occurrences
- 14
- Severity
- error
Sample message
Short PHP opening tag used with echo; expected "<?php echo $this ..." but found "<?= $this ..."
WARNINGMaintainabilityerror log error log14
- Category
- Maintainability
- Occurrences
- 14
- Severity
- warning
Sample message
error_log() found. Debug code should not normally be used in production.
WARNINGMaintainabilityNo Caching13
- Category
- Maintainability
- Occurrences
- 13
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGMaintainabilityslow db query meta query12
- Category
- Maintainability
- Occurrences
- 12
- Severity
- warning
Sample message
Detected usage of meta_query, possible slow query.
ERRORSupply ChainHidden files included11
- Category
- Supply Chain
- Occurrences
- 11
- Severity
- error
Sample message
Hidden files are not permitted.
ERRORMaintainabilityfile system operations mkdir10
- Category
- Maintainability
- Occurrences
- 10
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir().
WARNINGSecurityInput is not validated9
- Category
- Security
- Occurrences
- 9
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_SERVER['HTTP_HOST']. Check that the array index exists before using it.
ERRORMaintainabilityparse url parse url9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- error
Sample message
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
External Connections
Potential connections found in static code analysis.
Outbound calls
236
External assets
2
Incoming endpoints
13
Notable Domains
really-simple-ssl.com75 · outbound
complianz.io7 · outbound
api.ssllabs.com6 · outbound
php-fig.org4 · outbound
google.com3 · outbound
fb.me2 · outbound
Platform / Reference Domains
w3.org59 · platform/reference
wordpress.org11 · platform/reference
github.com10 · platform/reference
gnu.org5 · platform/reference
codex.wordpress.org1 · platform/reference
developer.wordpress.org1 · platform/reference
External Asset Domains
downloads.really-simple-security.com2 · asset
Incoming Endpoints
/wp-json/really-simple-security/v1/do_action/(?P<action>[a-z\_\-]+)REST
register_rest_route
/wp-json/really-simple-security/v1/fields/getREST
register_rest_route
/wp-json/really-simple-security/v1/fields/setREST
register_rest_route
/wp-json/really-simple-security/v1/tests/(?P<test>[a-z\_\-]+)REST
register_rest_route
Admin AJAX endpoints9
wp_ajax_change_method_to_emailauthenticated
wp_ajax
wp_ajax_resend_email_code_profileauthenticated
wp_ajax
wp_ajax_rsp_upgrade_activate_licenseauthenticated
wp_ajax
wp_ajax_rsp_upgrade_activate_pluginauthenticated
wp_ajax
wp_ajax_rsp_upgrade_destination_clearauthenticated
wp_ajax
wp_ajax_rsp_upgrade_install_pluginauthenticated
wp_ajax
wp_ajax_rsp_upgrade_package_informationauthenticated
wp_ajax
wp_ajax_rsssl_force_confirm_emailauthenticated
wp_ajax
wp_ajax_rsssl_resend_verification_emailauthenticated
wp_ajax
Score History
3 score snapshots
v9.7.0
19
Latest
- Findings
- 915
- Errors
- 536
- Warnings
- 379
- Check
- 2.0.0
v9.6.1
19
Score
- Findings
- 929
- Errors
- 540
- Warnings
- 389
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 19 | 915 | 536 | 379 | v9.7.0 | 2.0.0 |
| 19 | 929 | 540 | 389 | v9.6.1 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Issue
Domain
Related
Wordfence Security – Firewall, Malware Scan, and Login Security21 scoreWooCommerce22 scoreAll-in-One WP Migration and Backup34 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreClassic Editor63 scoreLiteSpeed Cache35 scoreAkismet Anti-spam: Spam Protection35 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreWPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager88 scoreHostinger Tools82 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreAll-In-One Security (AIOS) – Security and Firewall24 scoreLimit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention25 score
Issue
Domain
Related
Wordfence Security – Firewall, Malware Scan, and Login Security21 scoreWooCommerce22 scoreAll-in-One WP Migration and Backup34 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreClassic Editor63 scoreLiteSpeed Cache35 scoreAkismet Anti-spam: Spam Protection35 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreWPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager88 scoreHostinger Tools82 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreAll-In-One Security (AIOS) – Security and Firewall24 scoreLimit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention25 score
Related Plugins
Login Security Captcha
10k+ active installs
100
Stop XML-RPC Attacks
6k+ active installs
100
Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…
2k+ active installs
100
Dam Spam
2k+ active installs
100
Compromise Scanner for wp2shell
2k+ active installs
100
Remove XML-RPC Methods
1k+ active installs
100