This security plugin helps you quickly audit, harden, and secure your WordPress website.
34
Score
193
Errors
164
Warnings
+0
Change
Category Scores
Security0
Repo94
Performance100
Maintainability47
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
152
12 issue groups
I18n
108
4 issue groups
Maintainability
89
9 issue groups
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.98
- Category
- I18n
- Occurrences
- 98
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.44
- Category
- Security
- Occurrences
- 44
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.25
- Category
- Maintainability
- Occurrences
- 25
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().21
- Category
- Maintainability
- Occurrences
- 21
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
ERRORMaintainabilitydate datedate() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.21
- Category
- Maintainability
- Occurrences
- 21
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
WARNINGSecurityRequest data is not unslashed$_POST['ip'] not unslashed before sanitization. Use wp_unslash() or similar21
- Category
- Security
- Occurrences
- 21
- Severity
- warning
Sample message
$_POST['ip'] not unslashed before sanitization. Use wp_unslash() or similar
ERRORSecuritySQL query is not preparedUse placeholders and $wpdb->prepare(); found $query19
- Category
- Security
- Occurrences
- 19
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $query
ERRORSecurityUnsupported Identifier PlaceholderThe %i modifier is only supported in WP 6.2 or higher. Found: "%i".18
- Category
- Security
- Occurrences
- 18
- Severity
- error
Sample message
The %i modifier is only supported in WP 6.2 or higher. Found: "%i".
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$enctype'.14
- Category
- Security
- Occurrences
- 14
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$enctype'.
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.11
- Category
- Security
- Occurrences
- 11
- Severity
- warning
Sample message
Processing form data without nonce verification.
Show 15 moreShow less
WARNINGSecurityReplacements Wrong Number10
- Category
- Security
- Occurrences
- 10
- Severity
- warning
Sample message
Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 11.
WARNINGSecurityInput is not sanitized9
- Category
- Security
- Occurrences
- 9
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_FILES['import-file']
ERRORMaintainabilityfile system operations chmod9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: chmod().
ERRORI18nUnordered Placeholders Text7
- Category
- I18n
- Occurrences
- 7
- Severity
- error
Sample message
Multiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$s", but got "%s, %s" in '%s: All content policies are disabled. You can enable them at the top of <a href="%s">Content Settings</a>.'.
WARNINGMaintainabilityNon-prefixed constant5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- warning
Sample message
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "DONOTCACHEDB".
WARNINGMaintainabilityNon-prefixed global variable4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$Janitor".
WARNINGSecurityInterpolated SQL is not prepared2
- Category
- Security
- Occurrences
- 2
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable $ids at "DELETE FROM $table WHERE ID IN ( $ids )"
WARNINGSecurityInput is not validated2
- Category
- Security
- Occurrences
- 2
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_FILES['import-file']. Check that the array index exists before using it.
ERRORMaintainabilityNon Enqueued Script2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
Scripts must be registered/enqueued via wp_enqueue_script()
WARNINGI18nNo Html Wrapped Strings2
- Category
- I18n
- Occurrences
- 2
- Severity
- warning
Sample message
Translatable string should not be wrapped in HTML. Found: '<i>NOTICE: Files which cannot be modified are hidden. <a href="%s" style="text-decoration: underline;">Show all files</a>.</i>'
WARNINGI18nDiscouraged text-domain loading1
- Category
- I18n
- Occurrences
- 1
- Severity
- warning
Sample message
load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.
WARNINGSecurityDatabase parameter is not escaped1
- Category
- Security
- Occurrences
- 1
- Severity
- warning
Sample message
Unescaped parameter $table used in $wpdb->query()\n$table assigned unsafely at line 209.
ERRORSecurityDatabase parameter is not escaped1
- Category
- Security
- Occurrences
- 1
- Severity
- error
Sample message
Unescaped parameter $query used in $wpdb->get_results()\n$query assigned unsafely at line 162.
WARNINGMaintainabilityNon-prefixed hook name1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "security_safe_loaded".
WARNINGMaintainabilityNon-prefixed global variable1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "$slug".
External Connections
Potential connections found in static code analysis.
Outbound calls
207
External assets
3
Incoming endpoints
3
Notable Domains
freemius.com8 · outbound
php.net7 · outbound
cdnjs.cloudflare.com3 · outbound
benalman.com2 · outbound
checkout.freemius-local.com2 · outbound
checkout.freemius.com2 · outbound
Platform / Reference Domains
gnu.org112 · platform/reference
wordpress.org13 · platform/reference
w3.org11 · platform/reference
developer.wordpress.org4 · platform/reference
github.com4 · platform/reference
api.wordpress.org2 · platform/reference
make.wordpress.org2 · platform/reference
codex.wordpress.org1 · platform/reference
core.trac.wordpress.org1 · platform/reference
External Asset Domains
No external asset domains detected.
Incoming Endpoints
No public endpoints detected.
Admin AJAX endpoints3
admin_post_fs_clone_resolutionauthenticated
admin_post
wp_ajax_fs_dismiss_notice_action_{$ajax_action_suffix}authenticated
wp_ajax
wp_ajax_fs_toggle_debug_modeauthenticated
wp_ajax
Score History
First score snapshot
v3.0.1
34
Latest
- Findings
- 357
- Errors
- 193
- Warnings
- 164
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 34 | 357 | 193 | 164 | v3.0.1 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Plugin
Category
Issue
Domain
Related
Wordfence Security – Firewall, Malware Scan, and Login Security21 scoreWooCommerce21 scoreAll-in-One WP Migration and Backup34 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreLiteSpeed Cache35 scoreAkismet Anti-spam: Spam Protection35 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreWPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager88 scoreAll-In-One Security (AIOS) – Security and Firewall24 scoreLimit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention25 scoreSecurity Optimizer – The All-In-One Protection Plugin35 scoreSucuri Security – Auditing, Malware Scanner and Security Hardening82 score
Plugin
Category
Issue
Domain
Related
Wordfence Security – Firewall, Malware Scan, and Login Security21 scoreWooCommerce21 scoreAll-in-One WP Migration and Backup34 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreLiteSpeed Cache35 scoreAkismet Anti-spam: Spam Protection35 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreWPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager88 scoreAll-In-One Security (AIOS) – Security and Firewall24 scoreLimit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention25 scoreSecurity Optimizer – The All-In-One Protection Plugin35 scoreSucuri Security – Auditing, Malware Scanner and Security Hardening82 score
Related Plugins
Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…
1k+ active installs
100
WEDOS | Protection & Cache Performance
500 active installs
100
Site Lockdown Security
400 active installs
100
BotBlocker Security – Firewall & Bot Protection
3k+ active installs
99
Login Lockdown & Protection
100k+ active installs
94
Snitch
800 active installs
87