Optimize pages for faster load and render in the browser.
Category Scores
Top Issues by Category
maintainability44
security40
repo_compliance1
Issues Details
111 issues found in latest scan
The $domain parameter must be a single text string literal. Found: page_optimize_get_text_domain()
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
Processing form data without nonce verification.
parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "css_do_concat".
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Detected usage of a non-sanitized input variable: $_GET['load-mode-js']
$_GET['load-mode-js'] not unslashed before sanitization. Use wp_unslash() or similar
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$inline_after'.
Detected usage of a possibly undefined superglobal array index: $_SERVER['REQUEST_METHOD']. Check that the array index exists before using it.
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "ALLOW_GZIP_COMPRESSION".
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$_tests_dir".
error_log() found. Debug code should not normally be used in production.
Scripts must be registered/enqueued via wp_enqueue_script()
Stylesheets must be registered/enqueued via wp_enqueue_style()
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "_manually_load_plugin".
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fread().
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writable().
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir().
unlink() is discouraged. Use wp_delete_file() to delete a file.
Missing "License" in Plugin Header. Please update your Plugin Header with a valid GPLv2 (or later) compatible license.
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.WP.I18n.NonSingularStringLiteralDomain | ERROR | The $domain parameter must be a single text string literal. Found: page_optimize_get_text_domain() | 25 |
| WordPress.Security.EscapeOutput.UnsafePrintingFunction | ERROR | All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'. | 11 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 9 |
| WordPress.WP.AlternativeFunctions.parse_url_parse_url | ERROR | parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead. | 9 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "css_do_concat". | 8 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 8 |
| WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | WARNING | Detected usage of a non-sanitized input variable: $_GET['load-mode-js'] | 6 |
| WordPress.Security.ValidatedSanitizedInput.MissingUnslash | WARNING | $_GET['load-mode-js'] not unslashed before sanitization. Use wp_unslash() or similar | 6 |
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$inline_after'. | 4 |
| WordPress.Security.ValidatedSanitizedInput.InputNotValidated | WARNING | Detected usage of a possibly undefined superglobal array index: $_SERVER['REQUEST_METHOD']. Check that the array index exists before using it. | 4 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "ALLOW_GZIP_COMPRESSION". | 2 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$_tests_dir". | 2 |
| WordPress.PHP.DevelopmentFunctions.error_log_error_log | WARNING | error_log() found. Debug code should not normally be used in production. | 2 |
| WordPress.WP.EnqueuedResources.NonEnqueuedScript | ERROR | Scripts must be registered/enqueued via wp_enqueue_script() | 2 |
| WordPress.WP.EnqueuedResources.NonEnqueuedStylesheet | ERROR | Stylesheets must be registered/enqueued via wp_enqueue_style() | 2 |
| Squiz.PHP.DiscouragedFunctions.Discouraged | WARNING | The use of function ini_set() is discouraged | 1 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | WARNING | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "_manually_load_plugin". | 1 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fclose | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose(). | 1 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fopen | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen(). | 1 |
| WordPress.WP.AlternativeFunctions.file_system_operations_fread | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fread(). | 1 |
| WordPress.WP.AlternativeFunctions.file_system_operations_is_writable | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writable(). | 1 |
| WordPress.WP.AlternativeFunctions.file_system_operations_mkdir | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir(). | 1 |
| WordPress.WP.AlternativeFunctions.unlink_unlink | ERROR | unlink() is discouraged. Use wp_delete_file() to delete a file. | 1 |
| application_detected | ERROR | Application files are not permitted. | 1 |
| plugin_header_no_license | ERROR | Missing "License" in Plugin Header. Please update your Plugin Header with a valid GPLv2 (or later) compatible license. | 1 |
Latest Snapshot
Findings
111
Errors
70
Warnings
41
Score History
First score snapshot
First scan completed Jun 19, 2026
v0.6.3 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 19, 2026
v0.6.3
35
Latest
- Findings
- 111
- Errors
- 70
- Warnings
- 41
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 19, 2026Latest | 35 | 111 | 70 | 41 | v0.6.3 | 2.0.0 | 2026.06-mvp-static-v2 |