Speed up your WordPress site with one-click optimizations like Page Cache, Critical CSS, and Image CDN to improve Core Web Vitals.
Category Scores
Top Issues by Category
i18n583
maintainability234
security73
performance4
Issues Details
895 issues found in latest scan
Mismatched text domain. Expected 'jetpack-boost' but got 'jetpack-admin-ui'.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'jitm_' . $envelope->CTA->hook".
Unescaped parameter $custom_table_name used in $wpdb->get_row()\n$custom_table_name assigned unsafely at line 614.
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Debug: Attempting to create {$this->action} nonce before the user is set."'.
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Detected usage of meta_key, possible slow query.
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$boost_css_concatenate".
Detected usage of meta_value, possible slow query.
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "DONOTCACHEPAGE".
The plugin name includes a restricted term. Your chosen plugin name - "Jetpack Boost - Website Speed, Performance and Critical CSS" - contains the restricted term "jetpack" and cannot be used to begin your plugin name. We disallow the use of certain terms in ways that are abused, or potentially infringe on and/or are misleading with regards to trademarks. You may use the term "jetpack" elsewhere in your plugin name, such as "... for jetpack".
Using exclusionary parameters, like exclude, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.
Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.
Plugin Updater detected. Detected code which may be altering WordPress update routines. Detected: _site_transient_update_plugins
load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.
Plugin folders are deleted when upgraded. Do not save data to the plugin folder using file_put_contents(). Detected usage of constant WP_CONTENT_DIR. Use wp_upload_dir() to get the uploads directory path or save to the database instead.
Plugin name "Jetpack Boost - Website Speed, Performance and Critical CSS" is different from the name declared in plugin header "Jetpack Boost".
The "Domain Path" header in the plugin file must point to an existing folder. Found: "languages"
Plugin Updater detected. These are not permitted in WordPress.org hosted plugins. Detected: site_transient_update_plugins
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.WP.I18n.TextDomainMismatch | ERROR | Mismatched text domain. Expected 'jetpack-boost' but got 'jetpack-admin-ui'. | 582 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'jitm_' . $envelope->CTA->hook". | 61 |
| WordPress.DB.DirectDatabaseQuery.DirectQuery | WARNING | Use of a direct database call is discouraged. | 54 |
| PluginCheck.Security.DirectDB.UnescapedDBParameter | WARNING | Unescaped parameter $custom_table_name used in $wpdb->get_row()\n$custom_table_name assigned unsafely at line 614. | 41 |
| WordPress.DB.DirectDatabaseQuery.NoCaching | WARNING | Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete(). | 37 |
| WordPress.Security.EscapeOutput.ExceptionNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Debug: Attempting to create {$this->action} nonce before the user is set."'. | 32 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 31 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_key | WARNING | Detected usage of meta_key, possible slow query. | 13 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$boost_css_concatenate". | 11 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_value | WARNING | Detected usage of meta_value, possible slow query. | 10 |
| Squiz.PHP.DiscouragedFunctions.Discouraged | WARNING | The use of function ini_set() is discouraged | 5 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "DONOTCACHEPAGE". | 4 |
| trademarked_term | WARNING | The plugin name includes a restricted term. Your chosen plugin name - "Jetpack Boost - Website Speed, Performance and Critical CSS" - contains the restricted term "jetpack" and cannot be used to begin your plugin name. We disallow the use of certain terms in ways that are abused, or potentially infringe on and/or are misleading with regards to trademarks. You may use the term "jetpack" elsewhere in your plugin name, such as "... for jetpack". | 3 |
| WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_exclude | WARNING | Using exclusionary parameters, like exclude, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information. | 2 |
| WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in | WARNING | Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information. | 2 |
| update_modification_detected | WARNING | Plugin Updater detected. Detected code which may be altering WordPress update routines. Detected: _site_transient_update_plugins | 2 |
| PluginCheck.CodeAnalysis.DiscouragedFunctions.load_plugin_textdomainFound | WARNING | load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed. | 1 |
| PluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWrite | ERROR | Plugin folders are deleted when upgraded. Do not save data to the plugin folder using file_put_contents(). Detected usage of constant WP_CONTENT_DIR. Use wp_upload_dir() to get the uploads directory path or save to the database instead. | 1 |
| mismatched_plugin_name | WARNING | Plugin name "Jetpack Boost - Website Speed, Performance and Critical CSS" is different from the name declared in plugin header "Jetpack Boost". | 1 |
| plugin_header_nonexistent_domain_path | WARNING | The "Domain Path" header in the plugin file must point to an existing folder. Found: "languages" | 1 |
| plugin_updater_detected | ERROR | Plugin Updater detected. These are not permitted in WordPress.org hosted plugins. Detected: site_transient_update_plugins | 1 |
Latest Snapshot
Findings
895
Errors
647
Warnings
248
Score History
First score snapshot
First scan completed Jun 19, 2026
v4.6.1 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 19, 2026
v4.6.1
29
Latest
- Findings
- 895
- Errors
- 647
- Warnings
- 248
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 19, 2026Latest | 29 | 895 | 647 | 248 | v4.6.1 | 2.0.0 | 2026.06-mvp-static-v2 |