Enable SSL/TLS (https://) to redirect all pages to SSL/TLS and load all resources over SSL/TLS.
Category Scores
Top Issues by Category
security159
maintainability22
i18n15
Issues Details
198 issues found in latest scan
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$certinfo['domain']'.
$_GET['page'] not unslashed before sanitization. Use wp_unslash() or similar
Detected usage of a non-sanitized input variable: $_GET['page']
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$basic_auth_required".
Detected usage of a possibly undefined superglobal array index: $_SERVER['REMOTE_ADDR']. Check that the array index exists before using it.
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "do_meta_boxes".
Processing form data without nonce verification.
wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.
Mismatched text domain. Expected 'one-click-ssl' but got 'slideshow-gallery'.
Processing form data without nonce verification.
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "DS".
error_log() found. Debug code should not normally be used in production.
print_r() found. Debug code should not normally be used in production.
The $text parameter must be a single text string literal. Found: 'By turning on SSL, your server/hosting must support SSL (https://) or this could make your website inaccessible.' . "\r\n\r\n" . 'Upon clicking OK, you will be asked to log in to your WordPress dashboard again if the protocol changes.' . "\r\n\r\n" . 'If you are uncertain, click Cancel below.'
Multiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$s, %3$s, %4$s", but got "%s, %s, %s, %s" in 'You have been using %s for some time. Please consider to %s on %s. We appreciate it very much! %s'.
Missing "License" in Plugin Header. Please update your Plugin Header with a valid GPLv2 (or later) compatible license.
One or more tags were ignored. Please limit your plugin to 5 tags.
Function "wp_doing_ajax()" requires WordPress 4.7.0, but your plugin minimum supported version is WordPress 4.6.0.
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.Security.EscapeOutput.UnsafePrintingFunction | ERROR | All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'. | 77 |
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$certinfo['domain']'. | 37 |
| WordPress.Security.ValidatedSanitizedInput.MissingUnslash | WARNING | $_GET['page'] not unslashed before sanitization. Use wp_unslash() or similar | 16 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_GET['page'] | 11 |
| WordPress.WP.I18n.MissingTranslatorsComment | ERROR | A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders. | 10 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$basic_auth_required". | 9 |
| WordPress.Security.ValidatedSanitizedInput.InputNotValidated | WARNING | Detected usage of a possibly undefined superglobal array index: $_SERVER['REMOTE_ADDR']. Check that the array index exists before using it. | 8 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 5 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "do_meta_boxes". | 4 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 4 |
| WordPress.Security.SafeRedirect.wp_redirect_wp_redirect | WARNING | wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed. | 4 |
| WordPress.WP.I18n.TextDomainMismatch | ERROR | Mismatched text domain. Expected 'one-click-ssl' but got 'slideshow-gallery'. | 3 |
| WordPress.Security.NonceVerification.Missing | WARNING | Processing form data without nonce verification. | 2 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "DS". | 1 |
| WordPress.PHP.DevelopmentFunctions.error_log_error_log | WARNING | error_log() found. Debug code should not normally be used in production. | 1 |
| WordPress.PHP.DevelopmentFunctions.error_log_print_r | WARNING | print_r() found. Debug code should not normally be used in production. | 1 |
| WordPress.WP.I18n.NonSingularStringLiteralText | ERROR | The $text parameter must be a single text string literal. Found: 'By turning on SSL, your server/hosting must support SSL (https://) or this could make your website inaccessible.' . "\r\n\r\n" . 'Upon clicking OK, you will be asked to log in to your WordPress dashboard again if the protocol changes.' . "\r\n\r\n" . 'If you are uncertain, click Cancel below.' | 1 |
| WordPress.WP.I18n.UnorderedPlaceholdersText | ERROR | Multiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$s, %3$s, %4$s", but got "%s, %s, %s, %s" in 'You have been using %s for some time. Please consider to %s on %s. We appreciate it very much! %s'. | 1 |
| plugin_header_no_license | ERROR | Missing "License" in Plugin Header. Please update your Plugin Header with a valid GPLv2 (or later) compatible license. | 1 |
| readme_parser_warnings_too_many_tags | WARNING | One or more tags were ignored. Please limit your plugin to 5 tags. | 1 |
| wp_function_not_compatible_with_requires_wp | ERROR | Function "wp_doing_ajax()" requires WordPress 4.7.0, but your plugin minimum supported version is WordPress 4.6.0. | 1 |
Latest Snapshot
Findings
198
Errors
136
Warnings
62
Score History
First score snapshot
First scan completed Jun 20, 2026
v1.7.8 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 20, 2026
v1.7.8
40
Latest
- Findings
- 198
- Errors
- 136
- Warnings
- 62
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 20, 2026Latest | 40 | 198 | 136 | 62 | v1.7.8 | 2.0.0 | 2026.06-mvp-static-v2 |