Broken Link Checker helps you catch broken links & images fast, before they hurt your SEO or UX. Scan and bulk-fix issues from one easy dashboard.
Category Scores
Top Issues by Category
maintainability488
security461
Issues Details
1,327 issues found in latest scan
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" (<span class='current-link-count'>{$current_filter['count']}</span>)"'.
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
Mismatched text domain. Expected 'broken-link-checker' but got 'brocken-link-checker'.
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "TransactionManager".
All output should be run through an escaping function (like echo esc_html_x() or echo esc_attr_x()), found '_ex'.
Processing form data without nonce verification.
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$activation_start".
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Detected usage of a non-sanitized input variable: $_COOKIE[$cookie_name]
$_COOKIE[$cookie_name] not unslashed before sanitization. Use wp_unslash() or similar
Unescaped parameter $db_name used in $wpdb->get_var()\n$db_name assigned unsafely at line 152.
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "add_screen_meta_link".
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "BLC_ACTIVE".
Function "rest_is_field_included()" requires WordPress 5.3.0, but your plugin minimum supported version is WordPress 5.2.0.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'blc-module-settings-' . $module_id".
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
trigger_error() found. Debug code should not normally be used in production.
Processing form data without nonce verification.
Detected usage of a possibly undefined superglobal array index: $_POST['check_threshold']. Check that the array index exists before using it.
Use placeholders and $wpdb->prepare(); found $current_instance_ids
The use of function set_time_limit() is discouraged
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" (<span class='current-link-count'>{$current_filter['count']}</span>)"'. | 186 |
| WordPress.WP.I18n.MissingTranslatorsComment | ERROR | A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders. | 116 |
| WordPress.WP.I18n.TextDomainMismatch | ERROR | Mismatched text domain. Expected 'broken-link-checker' but got 'brocken-link-checker'. | 103 |
| WordPress.DB.DirectDatabaseQuery.DirectQuery | WARNING | Use of a direct database call is discouraged. | 85 |
| WordPress.DB.DirectDatabaseQuery.NoCaching | WARNING | Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete(). | 85 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound | WARNING | Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "TransactionManager". | 68 |
| WordPress.Security.EscapeOutput.UnsafePrintingFunction | ERROR | All output should be run through an escaping function (like echo esc_html_x() or echo esc_attr_x()), found '_ex'. | 68 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 67 |
| WordPress.WP.I18n.MissingArgDomain | ERROR | Missing $domain parameter in function call to __(). | 64 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$activation_start". | 43 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 43 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_COOKIE[$cookie_name] | 41 |
| WordPress.Security.ValidatedSanitizedInput.MissingUnslash | WARNING | $_COOKIE[$cookie_name] not unslashed before sanitization. Use wp_unslash() or similar | 37 |
| PluginCheck.Security.DirectDB.UnescapedDBParameter | WARNING | Unescaped parameter $db_name used in $wpdb->get_var()\n$db_name assigned unsafely at line 152. | 29 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "add_screen_meta_link". | 29 |
| WordPress.WP.AlternativeFunctions.parse_url_parse_url | ERROR | parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead. | 25 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "BLC_ACTIVE". | 24 |
| wp_function_not_compatible_with_requires_wp | ERROR | Function "rest_is_field_included()" requires WordPress 5.3.0, but your plugin minimum supported version is WordPress 5.2.0. | 24 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'blc-module-settings-' . $module_id". | 23 |
| WordPress.WP.AlternativeFunctions.curl_curl_setopt | ERROR | Using cURL functions is highly discouraged. Use wp_remote_get() instead. | 20 |
| WordPress.PHP.DevelopmentFunctions.error_log_trigger_error | WARNING | trigger_error() found. Debug code should not normally be used in production. | 13 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 12 |
| WordPress.Security.ValidatedSanitizedInput.InputNotValidated | WARNING | Detected usage of a possibly undefined superglobal array index: $_POST['check_threshold']. Check that the array index exists before using it. | 11 |
| WordPress.DB.PreparedSQL.NotPrepared | ERROR | Use placeholders and $wpdb->prepare(); found $current_instance_ids | 10 |
| Squiz.PHP.DiscouragedFunctions.Discouraged | WARNING | The use of function set_time_limit() is discouraged | 6 |
Latest Snapshot
Findings
1,327
Errors
727
Warnings
600
Score History
First score snapshot
First scan completed Jun 19, 2026
v2.4.8 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 19, 2026
v2.4.8
25
Latest
- Findings
- 1,327
- Errors
- 727
- Warnings
- 600
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 19, 2026Latest | 25 | 1,327 | 727 | 600 | v2.4.8 | 2.0.0 | 2026.06-mvp-static-v2 |