Speed up your WordPress site by adding high-performance keys (database indexes) to your MariaDB / MySQL database tables.
Category Scores
Top Issues by Category
security256
maintainability186
Issues Details
505 issues found in latest scan
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<!--[if IE]><style type='text/css' id='internal-style-ie-{$_sID}' class='index-wp-mysql-for-speed-form-ie-style'>"'.
Use of heredoc syntax (<<<) is not allowed; use standard strings or inline HTML instead
$_GET['page'] not unslashed before sanitization. Use wp_unslash() or similar
Processing form data without nonce verification.
Detected usage of a non-sanitized input variable: $_FILES['__import']
Processing form data without nonce verification.
Detected usage of meta_key, possible slow query.
Detected usage of a possibly undefined superglobal array index: $_FILES['__import']. Check that the array index exists before using it.
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
Detected usage of meta_value, possible slow query.
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$_apf_sub_menus_to_sort".
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Unescaped parameter $this used in $wpdb->get_results()
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "add_meta_boxes_{$_sCurrentScreenID}".
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Table $name invalid state $hasFastIndexes $hasStandardIndexes $hasOldIndexes"'.
unlink() is discouraged. Use wp_delete_file() to delete a file.
Unescaped parameter $q used in $wpdb->get_results()\n$q assigned unsafely at line 11.
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "Health".
print_r() found. Debug code should not normally be used in production.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "get_class($this) . '-' . $_sScreenID".
trigger_error() found. Debug code should not normally be used in production.
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<!--[if IE]><style type='text/css' id='internal-style-ie-{$_sID}' class='index-wp-mysql-for-speed-form-ie-style'>"'. | 75 |
| PluginCheck.CodeAnalysis.Heredoc.NotAllowed | ERROR | Use of heredoc syntax (<<<) is not allowed; use standard strings or inline HTML instead | 50 |
| WordPress.DB.PreparedSQL.NotPrepared | ERROR | Use placeholders and $wpdb->prepare(); found $explainq | 38 |
| WordPress.Security.ValidatedSanitizedInput.MissingUnslash | WARNING | $_GET['page'] not unslashed before sanitization. Use wp_unslash() or similar | 26 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 25 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_FILES['__import'] | 25 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 24 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_key | WARNING | Detected usage of meta_key, possible slow query. | 23 |
| WordPress.Security.ValidatedSanitizedInput.InputNotValidated | WARNING | Detected usage of a possibly undefined superglobal array index: $_FILES['__import']. Check that the array index exists before using it. | 20 |
| WordPress.DB.DirectDatabaseQuery.DirectQuery | WARNING | Use of a direct database call is discouraged. | 19 |
| WordPress.DB.DirectDatabaseQuery.NoCaching | WARNING | Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete(). | 17 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_value | WARNING | Detected usage of meta_value, possible slow query. | 13 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$_apf_sub_menus_to_sort". | 12 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 11 |
| PluginCheck.Security.DirectDB.UnescapedDBParameter | WARNING | Unescaped parameter $this used in $wpdb->get_results() | 8 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "add_meta_boxes_{$_sCurrentScreenID}". | 8 |
| WordPress.Security.EscapeOutput.ExceptionNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Table $name invalid state $hasFastIndexes $hasStandardIndexes $hasOldIndexes"'. | 8 |
| WordPress.WP.AlternativeFunctions.unlink_unlink | ERROR | unlink() is discouraged. Use wp_delete_file() to delete a file. | 8 |
| PluginCheck.Security.DirectDB.UnescapedDBParameter | ERROR | Unescaped parameter $q used in $wpdb->get_results()\n$q assigned unsafely at line 11. | 7 |
| WordPress.DateTime.RestrictedFunctions.date_date | ERROR | date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead. | 7 |
| WordPress.WP.I18n.MissingArgDomain | ERROR | Missing $domain parameter in function call to __(). | 7 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound | WARNING | Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "Health". | 5 |
| WordPress.PHP.DevelopmentFunctions.error_log_print_r | WARNING | print_r() found. Debug code should not normally be used in production. | 5 |
| WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "get_class($this) . '-' . $_sScreenID". | 4 |
| WordPress.PHP.DevelopmentFunctions.error_log_trigger_error | WARNING | trigger_error() found. Debug code should not normally be used in production. | 4 |
Latest Snapshot
Findings
505
Errors
250
Warnings
255
Score History
First score snapshot
First scan completed Jun 20, 2026
v1.5.7 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 20, 2026
v1.5.7
25
Latest
- Findings
- 505
- Errors
- 250
- Warnings
- 255
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 20, 2026Latest | 25 | 505 | 250 | 255 | v1.5.7 | 2.0.0 | 2026.06-mvp-static-v2 |