WordPress backup plugin: backups, restore & migration in minutes. Clone or duplicate your site, test updates on a staging copy. 100% unit-tested.
23
Score
1,525
Errors
1,610
Warnings
+0
Change
Category Scores
Security0
Repo89
Performance100
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
1,321
8 issue groups
Maintainability
1,239
14 issue groups
I18n
362
3 issue groups
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$activeClass".717
- Category
- Maintainability
- Occurrences
- 717
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$activeClass".
ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" to negative offset: $offset"'.510
- Category
- Security
- Occurrences
- 510
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" to negative offset: $offset"'.
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.296
- Category
- Security
- Occurrences
- 296
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.282
- Category
- I18n
- Occurrences
- 282
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;192
- Category
- Maintainability
- Occurrences
- 192
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
WARNINGSecurityRequest data is not unslashed$_GET[$numericValue] not unslashed before sanitization. Use wp_unslash() or similar167
- Category
- Security
- Occurrences
- 167
- Severity
- warning
Sample message
$_GET[$numericValue] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_ENV['SSH_AUTH_SOCK']127
- Category
- Security
- Occurrences
- 127
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_ENV['SSH_AUTH_SOCK']
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$advancedSectionStyle'.97
- Category
- Security
- Occurrences
- 97
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$advancedSectionStyle'.
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.89
- Category
- Security
- Occurrences
- 89
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORI18nUnordered Placeholders TextMultiple placeholders in translatable strings should be ordered. Expected "%1$d, %2$d", but got "%d, %d" in 'PHP failed to process this task. We will lower the memory usage and try again... (%d/%d)'.62
- Category
- I18n
- Occurrences
- 62
- Severity
- error
Sample message
Multiple placeholders in translatable strings should be ordered. Expected "%1$d, %2$d", but got "%d, %d" in 'PHP failed to process this task. We will lower the memory usage and try again... (%d/%d)'.
Show 15 moreShow less
WARNINGMaintainabilityDynamic hook name44
- Category
- Maintainability
- Occurrences
- 44
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$actionCallback".
ERRORMaintainabilityunlink unlink44
- Category
- Maintainability
- Occurrences
- 44
- Severity
- error
Sample message
unlink() is discouraged. Use wp_delete_file() to delete a file.
ERRORMaintainabilityfile system operations fclose42
- Category
- Maintainability
- Occurrences
- 42
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
ERRORMaintainabilityfile system operations fopen35
- Category
- Maintainability
- Occurrences
- 35
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().
ERRORMaintainabilityparse url parse url32
- Category
- Maintainability
- Occurrences
- 32
- Severity
- error
Sample message
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
ERRORMaintainabilitydate date24
- Category
- Maintainability
- Occurrences
- 24
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
WARNINGMaintainabilityDirect Query23
- Category
- Maintainability
- Occurrences
- 23
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo Caching23
- Category
- Maintainability
- Occurrences
- 23
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
ERRORMaintainabilityfile system operations is writable22
- Category
- Maintainability
- Occurrences
- 22
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writable().
WARNINGSecurityInterpolated SQL is not prepared21
- Category
- Security
- Occurrences
- 21
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable $idsToDelete at "DELETE FROM $wpdb->options WHERE `option_id` IN ($idsToDelete)"
ERRORI18nNon Singular String Literal Text18
- Category
- I18n
- Occurrences
- 18
- Severity
- error
Sample message
The $text parameter must be a single text string literal. Found: "This clone is incomplete and does not work. Clone or update it again! \n\n" .\n "Important: Keep the browser open until the cloning is finished. \n" .\n "It will not proceed if your browser is not open.\n\n" .\n "If you have an unstable internet connection and cloning breaks due to that, clone again only the folders wp-admin, wp-includes, and all database tables.\n\n" .\n "That will not take much time. Then, you can proceed with the wp-content folder that usually needs the most disk space. " .\n "If it interrupts again, at least it will not break the existing staging site again, and you can repeat and resume the last operation."
WARNINGSecurityDatabase parameter is not escaped14
- Category
- Security
- Occurrences
- 14
- Severity
- warning
Sample message
Unescaped parameter $optionTable used in $wpdb->get_var()\n$optionTable assigned unsafely at line 208.
WARNINGMaintainabilityerror log error log14
- Category
- Maintainability
- Occurrences
- 14
- Severity
- warning
Sample message
error_log() found. Debug code should not normally be used in production.
ERRORMaintainabilityfile system operations fwrite14
- Category
- Maintainability
- Occurrences
- 14
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite().
WARNINGMaintainabilityerror log print r13
- Category
- Maintainability
- Occurrences
- 13
- Severity
- warning
Sample message
print_r() found. Debug code should not normally be used in production.
External Connections
Potential connections found in static code analysis.
Outbound calls
193
External assets
0
Incoming endpoints
100
Notable Domains
wp-staging.com81 · outbound
en.wikipedia.org10 · outbound
apple.com4 · outbound
bugs.php.net4 · outbound
google.com4 · outbound
blog.domain.com2 · outbound
Platform / Reference Domains
github.com36 · platform/reference
wordpress.org8 · platform/reference
developer.wordpress.org6 · platform/reference
codex.wordpress.org2 · platform/reference
gnu.org1 · platform/reference
validator.w3.org1 · platform/reference
w3.org1 · platform/reference
External Asset Domains
No external asset domains detected.
Incoming Endpoints
wp_ajax_nopriv_public
wp_ajax
wp_ajax_nopriv_raw_wpstg--login-urlpublic
wp_ajax
wp_ajax_nopriv_wpstg_check_user_is_authenticatedpublic
wp_ajax
wp_ajax_nopriv_wpstg_http_auth_pingpublic
wp_ajax
wp_ajax_nopriv_wpstg_log_event_failurepublic
wp_ajax
wp_ajax_nopriv_wpstg_log_event_successpublic
wp_ajax
Admin AJAX endpoints89
admin_post_wpstg_download_restorerauthenticated
admin_post
admin_post_wpstg_download_sysinfoauthenticated
admin_post
admin_post_wpstg--backups--logsauthenticated
admin_post
wp_ajax_raw_wpstg--login-urlauthenticated
wp_ajax
wp_ajax_wpstg_activate_proauthenticated
wp_ajax
wp_ajax_wpstg_backup_plugin_notice_closeauthenticated
wp_ajax
wp_ajax_wpstg_backup_plugin_notice_remind_meauthenticated
wp_ajax
wp_ajax_wpstg_calculate_backup_speed_indexauthenticated
wp_ajax
wp_ajax_wpstg_cancel_cloneauthenticated
wp_ajax
wp_ajax_wpstg_cancel_updateauthenticated
wp_ajax
wp_ajax_wpstg_check_cloneauthenticated
wp_ajax
wp_ajax_wpstg_check_user_is_authenticatedauthenticated
wp_ajax
77 more hidden
Score History
7 score snapshots
v4.9.5
23
Latest
- Findings
- 3,135
- Errors
- 1,525
- Warnings
- 1,610
- Check
- 2.0.0
v4.9.4
23
Score
- Findings
- 3,116
- Errors
- 1,508
- Warnings
- 1,608
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 23 | 3,135 | 1,525 | 1,610 | v4.9.5 | 2.0.0 |
| 23 | 3,116 | 1,508 | 1,608 | v4.9.4 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Issue
Non-prefixed global variable717 findingsException output is not escaped510 findingsMissing nonce verification296 findingsMissing Translators Comment282 findingsMissing direct file access protection192 findingsRequest data is not unslashed167 findingsInput is not sanitized127 findingsOutput is not escaped97 findings
Domain
Related
Jetpack – WP Security, Backup, Speed, & Growth22 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce21 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreLiteSpeed Cache35 scoreAkismet Anti-spam: Spam Protection35 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreAll-in-One WP Migration and Backup34 scoreUpdraftPlus: WP Backup & Migration Plugin59 scoreDuplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More21 scoreManageWP Worker23 score
Author
Issue
Non-prefixed global variable717 findingsException output is not escaped510 findingsMissing nonce verification296 findingsMissing Translators Comment282 findingsMissing direct file access protection192 findingsRequest data is not unslashed167 findingsInput is not sanitized127 findingsOutput is not escaped97 findings
Domain
Related
Jetpack – WP Security, Backup, Speed, & Growth22 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce21 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreLiteSpeed Cache35 scoreAkismet Anti-spam: Spam Protection35 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreAll-in-One WP Migration and Backup34 scoreUpdraftPlus: WP Backup & Migration Plugin59 scoreDuplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More21 scoreManageWP Worker23 score
Related Plugins
Export Media as ZIP
2k+ active installs
100
Aruba Migration Tool
600 active installs
100
Glow: maintenance & support management for agencies
700 active installs
99
Menu Backup & Restore + Import/Export
400 active installs
99
Exclude Image Thumbnails From UpdraftPlus Backups
4k+ active installs
98
Remote Website Management by Watchful
3k+ active installs
97