Take control of your WordPress core XML Sitemap and add a Google News Sitemap.
Category Scores
Top Issues by Category
maintainability310
i18n168
security14
Issues Details
494 issues found in latest scan
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$_errors".
Missing $domain parameter in function call to esc_html__().
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Function "esc_xml()" requires WordPress 5.5.0, but your plugin minimum supported version is WordPress 4.4.0.
Use of the "translate()" function is reserved for low-level API usage.
Mismatched text domain. Expected 'xml-sitemap-feed' but got 'all-in-one-seo-pack'.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "get_firstpostdate".
error_log() found. Debug code should not normally be used in production.
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "_get_post_time".
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$_id'.
Unescaped parameter $field used in $wpdb->get_var()\n$field used without escaping.
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
Sanitization missing for register_setting().
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "DONOTCACHEDB".
print_r() found. Debug code should not normally be used in production.
Processing form data without nonce verification.
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
Missing "License" in Plugin Header. Please update your Plugin Header with a valid GPLv2 (or later) compatible license.
Mismatched Requires at least: 4.6 != 4.4. "Requires at least" needs to be exactly the same with that in your main plugin file's header.
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$_errors". | 140 |
| WordPress.WP.I18n.MissingArgDomain | ERROR | Missing $domain parameter in function call to esc_html__(). | 99 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 75 |
| wp_function_not_compatible_with_requires_wp | ERROR | Function "esc_xml()" requires WordPress 5.5.0, but your plugin minimum supported version is WordPress 4.4.0. | 45 |
| WordPress.WP.I18n.LowLevelTranslationFunction | WARNING | Use of the "translate()" function is reserved for low-level API usage. | 35 |
| WordPress.WP.I18n.TextDomainMismatch | ERROR | Mismatched text domain. Expected 'xml-sitemap-feed' but got 'all-in-one-seo-pack'. | 34 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "get_firstpostdate". | 20 |
| WordPress.PHP.DevelopmentFunctions.error_log_error_log | WARNING | error_log() found. Debug code should not normally be used in production. | 7 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "_get_post_time". | 6 |
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$_id'. | 6 |
| PluginCheck.Security.DirectDB.UnescapedDBParameter | WARNING | Unescaped parameter $field used in $wpdb->get_var()\n$field used without escaping. | 4 |
| WordPress.DB.DirectDatabaseQuery.DirectQuery | WARNING | Use of a direct database call is discouraged. | 4 |
| five_star_reviews_detected | ERROR | Linking directly to 5 stars reviews is not allowed. | 4 |
| WordPress.WP.AlternativeFunctions.parse_url_parse_url | ERROR | parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead. | 3 |
| PluginCheck.CodeAnalysis.SettingSanitization.register_settingMissing | ERROR | Sanitization missing for register_setting(). | 2 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "DONOTCACHEDB". | 2 |
| WordPress.PHP.DevelopmentFunctions.error_log_print_r | WARNING | print_r() found. Debug code should not normally be used in production. | 2 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 2 |
| Squiz.PHP.DiscouragedFunctions.Discouraged | WARNING | The use of function ini_set() is discouraged | 1 |
| WordPress.DB.DirectDatabaseQuery.NoCaching | WARNING | Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete(). | 1 |
| plugin_header_no_license | ERROR | Missing "License" in Plugin Header. Please update your Plugin Header with a valid GPLv2 (or later) compatible license. | 1 |
| readme_mismatched_header_requires | ERROR | Mismatched Requires at least: 4.6 != 4.4. "Requires at least" needs to be exactly the same with that in your main plugin file's header. | 1 |
Latest Snapshot
Findings
494
Errors
270
Warnings
224
Score History
First score snapshot
First scan completed Jun 19, 2026
v5.7.7 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 19, 2026
v5.7.7
47
Latest
- Findings
- 494
- Errors
- 270
- Warnings
- 224
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 19, 2026Latest | 47 | 494 | 270 | 224 | v5.7.7 | 2.0.0 | 2026.06-mvp-static-v2 |
