Backup, migrate, and create staging sites with free cloud storage and support.
Category Scores
Top Issues by Category
maintainability1,492
security173
Issues Details
2,074 issues found in latest scan
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$BMI::RESPONSE::SENT".
unlink() is discouraged. Use wp_delete_file() to delete a file.
Namespaces declared by a theme/plugin should start with the theme/plugin prefix. Found: "BMI\Plugin".
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "BASE_PATH".
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite().
Multiple placeholders in translatable strings should be ordered. Expected "%1$d, %2$g, %3$G, %4$h, %5$H, %6$s, %7$h, %8$d", but got "%d, %g, %G, %h, %H, %s, %h, %d" in 'Invalid % character used. Only these are allowed: %Y, %M, %D, %d, %j, %m, %n, %y, %a, %A, %B, %g, %G, %h, %H, %i, %s, %hash, %domain'.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "bmi_ajax_offline".
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: touch().
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir().
Unescaped parameter $query used in $wpdb->get_results()\n$query assigned unsafely at line 259.
error_log() found. Debug code should not normally be used in production.
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
$_GET['backup-migration'] not unslashed before sanitization. Use wp_unslash() or similar
print_r() found. Debug code should not normally be used in production.
Processing form data without nonce verification.
rename() is discouraged. Use WP_Filesystem::move() to rename a file.
Detected usage of a non-sanitized input variable: $_FILES['file_data']
Use placeholders and $wpdb->prepare(); found $options_table
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$BMI::RESPONSE::SENT". | 327 |
| WordPress.WP.AlternativeFunctions.unlink_unlink | ERROR | unlink() is discouraged. Use wp_delete_file() to delete a file. | 237 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedNamespaceFound | WARNING | Namespaces declared by a theme/plugin should start with the theme/plugin prefix. Found: "BMI\Plugin". | 133 |
| WordPress.WP.I18n.MissingTranslatorsComment | ERROR | A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders. | 113 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "BASE_PATH". | 90 |
| WordPress.DB.DirectDatabaseQuery.DirectQuery | WARNING | Use of a direct database call is discouraged. | 64 |
| WordPress.DB.DirectDatabaseQuery.NoCaching | WARNING | Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete(). | 64 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fwrite | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite(). | 60 |
| WordPress.WP.I18n.UnorderedPlaceholdersText | ERROR | Multiple placeholders in translatable strings should be ordered. Expected "%1$d, %2$g, %3$G, %4$h, %5$H, %6$s, %7$h, %8$d", but got "%d, %g, %G, %h, %H, %s, %h, %d" in 'Invalid % character used. Only these are allowed: %Y, %M, %D, %d, %j, %m, %n, %y, %a, %A, %B, %g, %G, %h, %H, %i, %s, %hash, %domain'. | 58 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "bmi_ajax_offline". | 57 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fclose | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose(). | 55 |
| WordPress.WP.AlternativeFunctions.file_system_operations_touch | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: touch(). | 54 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fopen | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen(). | 52 |
| WordPress.WP.AlternativeFunctions.curl_curl_setopt | ERROR | Using cURL functions is highly discouraged. Use wp_remote_get() instead. | 48 |
| WordPress.WP.AlternativeFunctions.file_system_operations_mkdir | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir(). | 48 |
| PluginCheck.Security.DirectDB.UnescapedDBParameter | WARNING | Unescaped parameter $query used in $wpdb->get_results()\n$query assigned unsafely at line 259. | 47 |
| WordPress.PHP.DevelopmentFunctions.error_log_error_log | WARNING | error_log() found. Debug code should not normally be used in production. | 47 |
| WordPress.DateTime.RestrictedFunctions.date_date | ERROR | date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead. | 45 |
| Squiz.PHP.DiscouragedFunctions.Discouraged | WARNING | The use of function ini_set() is discouraged | 44 |
| WordPress.Security.ValidatedSanitizedInput.MissingUnslash | WARNING | $_GET['backup-migration'] not unslashed before sanitization. Use wp_unslash() or similar | 42 |
| WordPress.PHP.DevelopmentFunctions.error_log_print_r | WARNING | print_r() found. Debug code should not normally be used in production. | 41 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 37 |
| WordPress.WP.AlternativeFunctions.rename_rename | ERROR | rename() is discouraged. Use WP_Filesystem::move() to rename a file. | 26 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_FILES['file_data'] | 24 |
| WordPress.DB.PreparedSQL.NotPrepared | ERROR | Use placeholders and $wpdb->prepare(); found $options_table | 23 |
Latest Snapshot
Findings
2,074
Errors
981
Warnings
1,093
Score History
First score snapshot
First scan completed Jun 20, 2026
v2.1.6 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 20, 2026
v2.1.6
21
Latest
- Findings
- 2,074
- Errors
- 981
- Warnings
- 1,093
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 20, 2026Latest | 21 | 2,074 | 981 | 1,093 | v2.1.6 | 2.0.0 | 2026.06-mvp-static-v2 |
