UpdraftPlus: WP Backup & Migration Plugin

Backup, restore or migrate your WordPress website to another host or domain. Schedule backups or run manually. Migrate in minutes.

v1.26.5David Anderson / Team UpdraftUpdated 2026-06-05Added May 22, 20123m+ installs96% rating85% support resolved
24
Score
277
Errors
299
Warnings
+0
Change

Category Scores

Security0
Repo94
Performance98
Maintainability0

Top Issues by Category

maintainability420
1Non Prefixed Variable FoundWordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFoundWARNING1462missing direct file access protectionmissing_direct_file_access_protectionERROR913wp function not compatible with requires wpwp_function_not_compatible_with_requires_wpERROR724error log error logWordPress.PHP.DevelopmentFunctions.error_log_error_logWARNING245Non Prefixed Hookname FoundWordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFoundWARNING216Not In FooterWordPress.WP.EnqueuedResourceParameters.NotInFooterWARNING127Dynamic Hookname FoundWordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFoundWARNING78mysql mysql unbuffered queryWordPress.DB.RestrictedFunctions.mysql_mysql_unbuffered_queryERROR69date dateWordPress.DateTime.RestrictedFunctions.date_dateERROR610current user can for blog FoundWordPress.WP.DeprecatedFunctions.current_user_can_for_blogFoundWARNING611file system operations is writableWordPress.WP.AlternativeFunctions.file_system_operations_is_writableERROR512rand randWordPress.WP.AlternativeFunctions.rand_randERROR513Plugin Directory WritePluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWriteERROR414mysql mysql errnoWordPress.DB.RestrictedFunctions.mysql_mysql_errnoERROR315mysql mysql errorWordPress.DB.RestrictedFunctions.mysql_mysql_errorERROR316mysql mysql queryWordPress.DB.RestrictedFunctions.mysql_mysql_queryERROR317mysql mysqli errnoWordPress.DB.RestrictedFunctions.mysql_mysqli_errnoERROR318Non Prefixed Constant FoundWordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFoundWARNING3
security94
i18n27

Issues Details

576 issues found in latest scan

WARNING146
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$accept".

ERROR91
missing_direct_file_access_protection

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

ERROR72
wp_function_not_compatible_with_requires_wp

Function "_load_image_to_edit_path()" requires WordPress 3.4.0, but your plugin minimum supported version is WordPress 3.2.0.

WARNING44
WordPress.Security.NonceVerification.Recommended

Processing form data without nonce verification.

ERROR27
WordPress.WP.I18n.MissingTranslatorsComment

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

ERROR26
WordPress.DB.PreparedSQL.NotPrepared

Use placeholders and $wpdb->prepare(); found $query

WARNING24
WordPress.PHP.DevelopmentFunctions.error_log_error_log

error_log() found. Debug code should not normally be used in production.

WARNING21
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "admin_comment_types_dropdown".

WARNING12
PluginCheck.Security.DirectDB.UnescapedDBParameter

Unescaped parameter $escaped_table_name used in $wpdb->query()\n$escaped_table_name assigned unsafely at line 6403.

WARNING12
WordPress.WP.EnqueuedResourceParameters.NotInFooter

In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.

WARNING7
WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$action".

WARNING6
WordPress.DB.PreparedSQL.InterpolatedNotPrepared

Use placeholders and $wpdb->prepare(); found interpolated variable $random_table_name at "CREATE TABLE $random_table_name (test INT)"

ERROR6
WordPress.DB.RestrictedFunctions.mysql_mysql_unbuffered_query

Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysql_unbuffered_query.

ERROR6
WordPress.DateTime.RestrictedFunctions.date_date

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

WARNING6
WordPress.WP.DeprecatedFunctions.current_user_can_for_blogFound

current_user_can_for_blog() has been deprecated since WordPress version 6.7.0. Use current_user_can_for_site() instead.

ERROR5
WordPress.WP.AlternativeFunctions.file_system_operations_is_writable

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writable().

ERROR5
WordPress.WP.AlternativeFunctions.rand_rand

rand() is discouraged. Use the far less predictable wp_rand() instead.

ERROR4
PluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWrite

Plugin folders are deleted when upgraded. Do not save data to the plugin folder using copy(). Detected usage of constant WP_CONTENT_DIR. Use wp_upload_dir() to get the uploads directory path or save to the database instead.

ERROR3
WordPress.DB.RestrictedFunctions.mysql_mysql_errno

Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysql_errno.

ERROR3
WordPress.DB.RestrictedFunctions.mysql_mysql_error

Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysql_error.

ERROR3
WordPress.DB.RestrictedFunctions.mysql_mysql_query

Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysql_query.

ERROR3
WordPress.DB.RestrictedFunctions.mysql_mysql_real_escape_string

Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysql_real_escape_string.

ERROR3
WordPress.DB.RestrictedFunctions.mysql_mysqli_errno

Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysqli_errno.

ERROR3
WordPress.DB.RestrictedFunctions.mysql_mysqli_real_escape_string

Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: mysqli_real_escape_string.

WARNING3
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "APP_GCAL_DISABLE".

Latest Snapshot

Findings

576

Errors

277

Warnings

299

Score History

First score snapshot

First scan completed Jun 19, 2026

v1.26.5 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2

Jun 19, 2026

v1.26.5

24

Latest

Findings
576
Errors
277
Warnings
299
Plugin Check
2.0.0
Model
2026.06-mvp-static-v2

Related Plugins