Backup, restore or migrate your WordPress website to another host or domain. Schedule backups or run manually. Migrate in minutes.
Category Scores
Top Issues by Category
maintainability420
security94
Issues Details
576 issues found in latest scan
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$accept".
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Function "_load_image_to_edit_path()" requires WordPress 3.4.0, but your plugin minimum supported version is WordPress 3.2.0.
Processing form data without nonce verification.
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
error_log() found. Debug code should not normally be used in production.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "admin_comment_types_dropdown".
Unescaped parameter $escaped_table_name used in $wpdb->query()\n$escaped_table_name assigned unsafely at line 6403.
In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$action".
Use placeholders and $wpdb->prepare(); found interpolated variable $random_table_name at "CREATE TABLE $random_table_name (test INT)"
Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysql_unbuffered_query.
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
current_user_can_for_blog() has been deprecated since WordPress version 6.7.0. Use current_user_can_for_site() instead.
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writable().
rand() is discouraged. Use the far less predictable wp_rand() instead.
Plugin folders are deleted when upgraded. Do not save data to the plugin folder using copy(). Detected usage of constant WP_CONTENT_DIR. Use wp_upload_dir() to get the uploads directory path or save to the database instead.
Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysql_errno.
Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysql_error.
Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysql_query.
Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysql_real_escape_string.
Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysqli_errno.
Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysqli_real_escape_string.
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "APP_GCAL_DISABLE".
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$accept". | 146 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 91 |
| wp_function_not_compatible_with_requires_wp | ERROR | Function "_load_image_to_edit_path()" requires WordPress 3.4.0, but your plugin minimum supported version is WordPress 3.2.0. | 72 |
| WordPress.Security.NonceVerification.Recommended | WARNING | Processing form data without nonce verification. | 44 |
| WordPress.WP.I18n.MissingTranslatorsComment | ERROR | A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders. | 27 |
| WordPress.DB.PreparedSQL.NotPrepared | ERROR | Use placeholders and $wpdb->prepare(); found $query | 26 |
| WordPress.PHP.DevelopmentFunctions.error_log_error_log | WARNING | error_log() found. Debug code should not normally be used in production. | 24 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "admin_comment_types_dropdown". | 21 |
| PluginCheck.Security.DirectDB.UnescapedDBParameter | WARNING | Unescaped parameter $escaped_table_name used in $wpdb->query()\n$escaped_table_name assigned unsafely at line 6403. | 12 |
| WordPress.WP.EnqueuedResourceParameters.NotInFooter | WARNING | In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header. | 12 |
| WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$action". | 7 |
| WordPress.DB.PreparedSQL.InterpolatedNotPrepared | WARNING | Use placeholders and $wpdb->prepare(); found interpolated variable $random_table_name at "CREATE TABLE $random_table_name (test INT)" | 6 |
| WordPress.DB.RestrictedFunctions.mysql_mysql_unbuffered_query | ERROR | Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysql_unbuffered_query. | 6 |
| WordPress.DateTime.RestrictedFunctions.date_date | ERROR | date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead. | 6 |
| WordPress.WP.DeprecatedFunctions.current_user_can_for_blogFound | WARNING | current_user_can_for_blog() has been deprecated since WordPress version 6.7.0. Use current_user_can_for_site() instead. | 6 |
| WordPress.WP.AlternativeFunctions.file_system_operations_is_writable | ERROR | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writable(). | 5 |
| WordPress.WP.AlternativeFunctions.rand_rand | ERROR | rand() is discouraged. Use the far less predictable wp_rand() instead. | 5 |
| PluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWrite | ERROR | Plugin folders are deleted when upgraded. Do not save data to the plugin folder using copy(). Detected usage of constant WP_CONTENT_DIR. Use wp_upload_dir() to get the uploads directory path or save to the database instead. | 4 |
| WordPress.DB.RestrictedFunctions.mysql_mysql_errno | ERROR | Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysql_errno. | 3 |
| WordPress.DB.RestrictedFunctions.mysql_mysql_error | ERROR | Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysql_error. | 3 |
| WordPress.DB.RestrictedFunctions.mysql_mysql_query | ERROR | Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysql_query. | 3 |
| WordPress.DB.RestrictedFunctions.mysql_mysql_real_escape_string | ERROR | Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysql_real_escape_string. | 3 |
| WordPress.DB.RestrictedFunctions.mysql_mysqli_errno | ERROR | Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysqli_errno. | 3 |
| WordPress.DB.RestrictedFunctions.mysql_mysqli_real_escape_string | ERROR | Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysqli_real_escape_string. | 3 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound | WARNING | Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "APP_GCAL_DISABLE". | 3 |
Latest Snapshot
Findings
576
Errors
277
Warnings
299
Score History
First score snapshot
First scan completed Jun 19, 2026
v1.26.5 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 19, 2026
v1.26.5
24
Latest
- Findings
- 576
- Errors
- 277
- Warnings
- 299
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 19, 2026Latest | 24 | 576 | 277 | 299 | v1.26.5 | 2.0.0 | 2026.06-mvp-static-v2 |