Accept all major payment methods in WooCommerce today. Credit cards, iDEAL and more! Fast, safe and intuitive.
Category Scores
Top Issues by Category
maintainability109
security44
i18n35
supply_chain1
Issues Details
193 issues found in latest scan
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$this->dataHelper->getPluginId() . '_payment_object_metadata'".
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
Processing form data without nonce verification.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "inpsyde.feature-flags.mollie-woocommerce.alma_enabled".
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$button'.
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Mismatched text domain. Expected 'mollie-payments-for-woocommerce' but got 'ddev-wordpress-plugin-example'.
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Invalid strategy for type: {$type}"'.
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "checkIndexExistOrDefault".
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$finders".
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "M4W_FILE".
Processing form data without nonce verification.
Detected usage of meta_key, possible slow query.
Detected usage of meta_value, possible slow query.
trigger_error() found. Debug code should not normally be used in production.
Attempting a database schema change is discouraged.
The "inpsyde.feature_flags.mollie" prefix is not a valid namespace/function/class/variable/constant prefix in PHP.
In footer ($in_footer) is not set explicitly wp_register_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.
Translatable string should not be wrapped in HTML. Found: '<p>The appearance of the Apple Pay button can be controlled in the <a href="%1$s">Checkout page editor</a>.</p>'
The "/vendor" directory using composer exists, but "composer.json" file is missing.
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$this->dataHelper->getPluginId() . '_payment_object_metadata'". | 52 |
| WordPress.WP.I18n.MissingTranslatorsComment | ERROR | A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders. | 22 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 19 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "inpsyde.feature-flags.mollie-woocommerce.alma_enabled". | 12 |
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$button'. | 12 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 12 |
| WordPress.WP.I18n.TextDomainMismatch | ERROR | Mismatched text domain. Expected 'mollie-payments-for-woocommerce' but got 'ddev-wordpress-plugin-example'. | 11 |
| WordPress.Security.EscapeOutput.ExceptionNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Invalid strategy for type: {$type}"'. | 10 |
| WordPress.DB.DirectDatabaseQuery.DirectQuery | WARNING | Use of a direct database call is discouraged. | 6 |
| WordPress.DB.DirectDatabaseQuery.NoCaching | WARNING | Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete(). | 5 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "checkIndexExistOrDefault". | 4 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$finders". | 4 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "M4W_FILE". | 3 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 3 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_key | WARNING | Detected usage of meta_key, possible slow query. | 2 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_value | WARNING | Detected usage of meta_value, possible slow query. | 2 |
| WordPress.PHP.DevelopmentFunctions.error_log_trigger_error | WARNING | trigger_error() found. Debug code should not normally be used in production. | 2 |
| WordPress.DB.DirectDatabaseQuery.SchemaChange | WARNING | Attempting a database schema change is discouraged. | 1 |
| WordPress.NamingConventions.PrefixAllGlobals.InvalidPrefixPassed | WARNING | The "inpsyde.feature_flags.mollie" prefix is not a valid namespace/function/class/variable/constant prefix in PHP. | 1 |
| WordPress.WP.EnqueuedResourceParameters.NotInFooter | WARNING | In footer ($in_footer) is not set explicitly wp_register_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header. | 1 |
| WordPress.WP.I18n.MissingArgDomain | ERROR | Missing $domain parameter in function call to __(). | 1 |
| WordPress.WP.I18n.NoHtmlWrappedStrings | WARNING | Translatable string should not be wrapped in HTML. Found: '<p>The appearance of the Apple Pay button can be controlled in the <a href="%1$s">Checkout page editor</a>.</p>' | 1 |
| application_detected | ERROR | Application files are not permitted. | 1 |
| hidden_files | ERROR | Hidden files are not permitted. | 1 |
| missing_composer_json_file | WARNING | The "/vendor" directory using composer exists, but "composer.json" file is missing. | 1 |
Latest Snapshot
Findings
193
Errors
70
Warnings
123
Score History
First score snapshot
First scan completed Jun 20, 2026
v8.1.7 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 20, 2026
v8.1.7
33
Latest
- Findings
- 193
- Errors
- 70
- Warnings
- 123
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 20, 2026Latest | 33 | 193 | 70 | 123 | v8.1.7 | 2.0.0 | 2026.06-mvp-static-v2 |
