Persistent Login keeps users logged into your website, limits the number of active logins allowed at one time and alerts users of new devices logging …
38
Score
337
Errors
114
Warnings
+1
Change
Category Scores
Security0
Repo88
Performance100
Maintainability72
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
392
12 issue groups
Maintainability
40
9 issue groups
I18n
15
4 issue groups
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.201
- Category
- Security
- Occurrences
- 201
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$button'.103
- Category
- Security
- Occurrences
- 103
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$button'.
WARNINGSecurityRequest data is not unslashed$_COOKIE["wppl_device_id"] not unslashed before sanitization. Use wp_unslash() or similar25
- Category
- Security
- Occurrences
- 25
- Severity
- warning
Sample message
$_COOKIE["wppl_device_id"] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_COOKIE["wppl_device_id"]22
- Category
- Security
- Occurrences
- 22
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_COOKIE["wppl_device_id"]
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.15
- Category
- Maintainability
- Occurrences
- 15
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.13
- Category
- Security
- Occurrences
- 13
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.11
- Category
- I18n
- Occurrences
- 11
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGSecurityInput is not validatedDetected usage of a possibly undefined superglobal array index: $_POST['_wp_http_referer']. Check that the array index exists before using it.9
- Category
- Security
- Occurrences
- 9
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_POST['_wp_http_referer']. Check that the array index exists before using it.
ERRORSecuritySQL query is not preparedUse placeholders and $wpdb->prepare(); found $sql7
- Category
- Security
- Occurrences
- 7
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $sql
Show 15 moreShow less
WARNINGSecurityInterpolated SQL is not prepared5
- Category
- Security
- Occurrences
- 5
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable $history_table at "SELECT COUNT(*) FROM $history_table WHERE user_id = %d AND device_id = %s"
ERRORMaintainabilityMissing direct file access protection5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
ERRORSecurityDatabase parameter is not escaped2
- Category
- Security
- Occurrences
- 2
- Severity
- error
Sample message
Unescaped parameter $sql used in $wpdb->get_results()\n$sql assigned unsafely at line 255.
WARNINGMaintainabilitySchema Change2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
Attempting a database schema change is discouraged.
WARNINGMaintainabilityslow db query meta key2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
Detected usage of meta_key, possible slow query.
ERRORMaintainabilitydate date2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
WARNINGMaintainabilityerror log error log2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- warning
Sample message
error_log() found. Debug code should not normally be used in production.
WARNINGSecurityMissing nonce verification2
- Category
- Security
- Occurrences
- 2
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecuritywp redirect wp redirect2
- Category
- Security
- Occurrences
- 2
- Severity
- warning
Sample message
wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.
ERRORMaintainabilityNon Enqueued Stylesheet2
- Category
- Maintainability
- Occurrences
- 2
- Severity
- error
Sample message
Stylesheets must be registered/enqueued via wp_enqueue_style()
ERRORI18nUnordered Placeholders Text2
- Category
- I18n
- Occurrences
- 2
- Severity
- error
Sample message
Multiple placeholders in translatable strings should be ordered. Expected "%1$d, %2$s, %3$s", but got "%d, %s, %s" in '%d %s %s being kept logged into your website.'.
WARNINGI18nDiscouraged text-domain loading1
- Category
- I18n
- Occurrences
- 1
- Severity
- warning
Sample message
load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.
WARNINGSecurityDatabase parameter is not escaped1
- Category
- Security
- Occurrences
- 1
- Severity
- warning
Sample message
Unescaped parameter $history_table used in $wpdb->get_var()\n$history_table assigned unsafely at line 174.
WARNINGMaintainabilityNot In Footer1
- Category
- Maintainability
- Occurrences
- 1
- Severity
- warning
Sample message
In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.
ERRORI18nNon Singular String Literal Text1
- Category
- I18n
- Occurrences
- 1
- Severity
- error
Sample message
The $text parameter must be a single text string literal. Found: 'Persistent Login: Every ' . $new_interval . 's to avoid '. WP_CRON_LOCK_TIMEOUT .'s WP_CRON_LOCK_TIMEOUT'
External Connections
Potential connections found in static code analysis.
Outbound calls
284
External assets
5
Incoming endpoints
11
Notable Domains
freemius.com10 · outbound
php.net6 · outbound
play.google.com5 · outbound
en.wikipedia.org4 · outbound
apps.apple.com3 · outbound
api.whichbrowser.net2 · outbound
Platform / Reference Domains
gnu.org112 · platform/reference
github.com13 · platform/reference
wordpress.org7 · platform/reference
w3.org5 · platform/reference
api.wordpress.org2 · platform/reference
make.wordpress.org2 · platform/reference
core.trac.wordpress.org1 · platform/reference
External Asset Domains
fonts.googleapis.com2 · asset
fonts.gstatic.com1 · asset
Incoming Endpoints
wp_ajax_nopriv_wppl_send_inactivity_test_emailpublic
wp_ajax
wp_ajax_nopriv_wppl_send_test_emailpublic
wp_ajax
Admin AJAX endpoints9
admin_post_fs_clone_resolutionauthenticated
admin_post
admin_post_wppl_empty_login_history_tableauthenticated
admin_post
wp_ajax_fs_dismiss_notice_action_{$ajax_action_suffix}authenticated
wp_ajax
wp_ajax_fs_toggle_debug_modeauthenticated
wp_ajax
wp_ajax_wppl_get_user_count_statusauthenticated
wp_ajax
wp_ajax_wppl_send_inactivity_test_emailauthenticated
wp_ajax
wp_ajax_wppl_send_test_emailauthenticated
wp_ajax
wp_ajax_wppl_stop_user_countauthenticated
wp_ajax
wp_ajax_wppl_toggle_featureauthenticated
wp_ajax
Score History
2 score snapshots
v3.1.0
38
Latest
- Findings
- 451
- Errors
- 337
- Warnings
- 114
- Check
- 2.0.0
v3.0.5
37
Score
- Findings
- 446
- Errors
- 338
- Warnings
- 108
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 38 | 451 | 337 | 114 | v3.1.0 | 2.0.0 |
| 37 | 446 | 338 | 108 | v3.0.5 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Plugin
Author
Category
Issue
Domain
Related
Classic Editor63 scoreWooCommerce21 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreAkismet Anti-spam: Spam Protection35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreDuplicate Page40 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreWordPress Importer25 scoreWPS Hide Login41 scoreLoginizer25 scoreSecurity Optimizer – The All-In-One Protection Plugin35 scoreLimit Login Attempts40 score
Plugin
Author
Category
Issue
Domain
Related
Classic Editor63 scoreWooCommerce21 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreAkismet Anti-spam: Spam Protection35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreDuplicate Page40 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreWordPress Importer25 scoreWPS Hide Login41 scoreLoginizer25 scoreSecurity Optimizer – The All-In-One Protection Plugin35 scoreLimit Login Attempts40 score
Related Plugins
Login Security Captcha
10k+ active installs
100
Loggedin – Session Manager, Limit Concurrent Logins & Force Logout
8k+ active installs
100
Simple Login Log
5k+ active installs
100
Shibboleth
3k+ active installs
100
Logged-in-only
700 active installs
100
Protect Login
600 active installs
100