Boost site speed and performance with an all-in-one cache and speed optimization plugin. Pass Core Web Vitals with CDN, image optimization, lazy loadi …
23
Score
316
Errors
639
Warnings
+0
Change
Category Scores
Security0
Repo86
Performance100
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Security
642
8 issue groups
Maintainability
253
17 issue groups
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"hash_equals() expects at least 2 parameters, {$argc} given"'.120
- Category
- Security
- Occurrences
- 120
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"hash_equals() expects at least 2 parameters, {$argc} given"'.
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.113
- Category
- Security
- Occurrences
- 113
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityRequest data is not unslashed$_COOKIE[$geotCookie] not unslashed before sanitization. Use wp_unslash() or similar113
- Category
- Security
- Occurrences
- 113
- Severity
- warning
Sample message
$_COOKIE[$geotCookie] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_COOKIE[$geotCookie]111
- Category
- Security
- Occurrences
- 111
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_COOKIE[$geotCookie]
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$CPTOptimization".101
- Category
- Maintainability
- Occurrences
- 101
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$CPTOptimization".
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.99
- Category
- Security
- Occurrences
- 99
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"File not found: $filePath"'.57
- Category
- Security
- Occurrences
- 57
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"File not found: $filePath"'.
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;31
- Category
- Maintainability
- Occurrences
- 31
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
WARNINGSecurityInput is not validatedDetected usage of a possibly undefined superglobal array index: $_GET["nitroWebhook"]. Check that the array index exists before using it.21
- Category
- Security
- Occurrences
- 21
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_GET["nitroWebhook"]. Check that the array index exists before using it.
WARNINGMaintainabilityNon-prefixed functionFunctions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "evaluate_warmup_sitemap".19
- Category
- Maintainability
- Occurrences
- 19
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "evaluate_warmup_sitemap".
Show 15 moreShow less
WARNINGMaintainabilityNon-prefixed hook name19
- Category
- Maintainability
- Occurrences
- 19
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "active_plugins".
ERRORMaintainabilitydate date12
- Category
- Maintainability
- Occurrences
- 12
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
ERRORMaintainabilityunlink unlink11
- Category
- Maintainability
- Occurrences
- 11
- Severity
- error
Sample message
unlink() is discouraged. Use wp_delete_file() to delete a file.
WARNINGMaintainabilityerror log error log10
- Category
- Maintainability
- Occurrences
- 10
- Severity
- warning
Sample message
error_log() found. Debug code should not normally be used in production.
ERRORMaintainabilityparse url parse url10
- Category
- Maintainability
- Occurrences
- 10
- Severity
- error
Sample message
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
ERRORSecurityUnsafe printing function8
- Category
- Security
- Occurrences
- 8
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
ERRORMaintainabilityfile system operations mkdir6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir().
WARNINGMaintainabilityNon-prefixed constant5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- warning
Sample message
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "NITRO_DOING_AJAX_SHORTCODES".
WARNINGMaintainabilityMissing Version5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- warning
Sample message
Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching.
ERRORMaintainabilityPlugin Directory Write4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
Plugin folders are deleted when upgraded. Do not save data to the plugin folder using file_put_contents(). Detected usage of constant WP_CONTENT_DIR. Use wp_upload_dir() to get the uploads directory path or save to the database instead.
WARNINGMaintainabilityDirect Query4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo Caching4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
ERRORMaintainabilityfile system operations fclose4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
ERRORMaintainabilityfile system operations fwrite4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite().
ERRORMaintainabilityfile system operations is writable4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writable().
External Connections
Potential connections found in static code analysis.
Outbound calls
101
External assets
1
Incoming endpoints
52
Notable Domains
support.nitropack.io16 · outbound
app.nitropack.io7 · outbound
nitropack.io5 · outbound
developer.mozilla.org2 · outbound
en.wikipedia.org2 · outbound
getflywheel.com2 · outbound
Platform / Reference Domains
w3.org30 · platform/reference
github.com7 · platform/reference
opensource.org2 · platform/reference
gnu.org1 · platform/reference
make.wordpress.org1 · platform/reference
External Asset Domains
cdnjs.cloudflare.com2 · asset + outbound
Incoming Endpoints
/wp-json/nitropack/math_captchaREST
register_rest_route
wp_ajax_nopriv_nitro_shortcode_ajaxpublic
wp_ajax
wp_ajax_nopriv_nitropack_gf_block_output_ajaxpublic
wp_ajax
wp_ajax_nopriv_nitropack_gf_shortcode_output_ajaxpublic
wp_ajax
wp_ajax_nopriv_nitropack_widget_output_ajaxpublic
wp_ajax
Admin AJAX endpoints47
wp_ajax_nitro_shortcode_ajaxauthenticated
wp_ajax
wp_ajax_nitropack_archive_logs_ajaxauthenticated
wp_ajax
wp_ajax_nitropack_clear_residual_cacheauthenticated
wp_ajax
wp_ajax_nitropack_conflict_plugin_deactivateauthenticated
wp_ajax
wp_ajax_nitropack_connectauthenticated
wp_ajax
wp_ajax_nitropack_cookie_path_ajaxauthenticated
wp_ajax
wp_ajax_nitropack_disable_safemodeauthenticated
wp_ajax
wp_ajax_nitropack_disable_warmupauthenticated
wp_ajax
wp_ajax_nitropack_disconnectauthenticated
wp_ajax
wp_ajax_nitropack_dismiss_hosting_noticeauthenticated
wp_ajax
wp_ajax_nitropack_dismiss_notification_by_transientauthenticated
wp_ajax
wp_ajax_nitropack_dismiss_permanently_notificationauthenticated
wp_ajax
35 more hidden
Score History
2 score snapshots
v1.19.8
23
Latest
- Findings
- 955
- Errors
- 316
- Warnings
- 639
- Check
- 2.0.0
v1.19.7
23
Score
- Findings
- 946
- Errors
- 315
- Warnings
- 631
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 23 | 955 | 316 | 639 | v1.19.8 | 2.0.0 |
| 23 | 946 | 315 | 631 | v1.19.7 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Category
Issue
Output is not escaped120 findingsMissing nonce verification113 findingsRequest data is not unslashed113 findingsInput is not sanitized111 findingsNon-prefixed global variable101 findingsNonce verification recommended99 findingsException output is not escaped57 findingsMissing direct file access protection31 findings
Domain
Related
WooCommerce22 scoreAkismet Anti-spam: Spam Protection35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreContact Form 769 scoreClassic Editor63 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreLiteSpeed Cache35 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreImage Optimization – Compress Images and Convert to WebP or AVIF87 scoreManageWP Worker22 scoreSpeed Optimizer – The All-In-One Performance-Boosting Plugin36 scoreWP Fastest Cache – WordPress Cache Plugin24 score
Author
Category
Issue
Output is not escaped120 findingsMissing nonce verification113 findingsRequest data is not unslashed113 findingsInput is not sanitized111 findingsNon-prefixed global variable101 findingsNonce verification recommended99 findingsException output is not escaped57 findingsMissing direct file access protection31 findings
Domain
Related
WooCommerce22 scoreAkismet Anti-spam: Spam Protection35 scoreAll-in-One WP Migration and Backup34 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreContact Form 769 scoreClassic Editor63 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreLiteSpeed Cache35 scoreJetpack – WP Security, Backup, Speed, & Growth22 scoreImage Optimization – Compress Images and Convert to WebP or AVIF87 scoreManageWP Worker22 scoreSpeed Optimizer – The All-In-One Performance-Boosting Plugin36 scoreWP Fastest Cache – WordPress Cache Plugin24 score
Related Plugins
Automatic Cache Flusher for W3 Total Cache
4k+ active installs
100
DietPress
2k+ active installs
100
Disable Emojis (GDPR friendly)
60k+ active installs
100
Embed Optimizer
50k+ active installs
100
Image Placeholders
60k+ active installs
100
Leverage Browser Caching
10k+ active installs
100