Backup, Restore and Migrate your sites with XCloner

XCloner is a backup plugin that allows you to safely back up and restore your WordPress sites. You can send site backups to SFTP, Dropbox, Amazon, Goo …

v4.8.7watchfulUpdated 2026-05-26Added Sep 28, 201010k+ installs84% rating
25
Score
238
Errors
864
Warnings
+0
Change

Category Scores

Security0
Repo97
Performance100
Maintainability0

Top Issues by Category

security804
maintainability271
1Non Prefixed Variable FoundWordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFoundWARNING962file system operations fopenWordPress.WP.AlternativeFunctions.file_system_operations_fopenERROR283file system operations fcloseWordPress.WP.AlternativeFunctions.file_system_operations_fcloseERROR224Missing VersionWordPress.WP.EnqueuedResourceParameters.MissingVersionWARNING205file system operations freadWordPress.WP.AlternativeFunctions.file_system_operations_freadERROR186file system operations fwriteWordPress.WP.AlternativeFunctions.file_system_operations_fwriteERROR147file system operations is writeableWordPress.WP.AlternativeFunctions.file_system_operations_is_writeableERROR128file system operations chmodWordPress.WP.AlternativeFunctions.file_system_operations_chmodERROR109Not In FooterWordPress.WP.EnqueuedResourceParameters.NotInFooterWARNING810missing direct file access protectionmissing_direct_file_access_protectionERROR711error log var exportWordPress.PHP.DevelopmentFunctions.error_log_var_exportWARNING612file system operations is writableWordPress.WP.AlternativeFunctions.file_system_operations_is_writableERROR613file system operations mkdirWordPress.WP.AlternativeFunctions.file_system_operations_mkdirERROR614badly named filesbadly_named_filesERROR615Non Prefixed Function FoundWordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFoundWARNING416curl curl setoptWordPress.WP.AlternativeFunctions.curl_curl_setoptERROR417file system operations touchWordPress.WP.AlternativeFunctions.file_system_operations_touchERROR4
i18n2

Issues Details

1,102 issues found in latest scan

WARNING186
WordPress.Security.ValidatedSanitizedInput.InputNotSanitized

Detected usage of a non-sanitized input variable: $_FILES['blob']['tmp_name']

WARNING184
WordPress.Security.NonceVerification.Missing

Processing form data without nonce verification.

WARNING178
WordPress.Security.ValidatedSanitizedInput.MissingUnslash

$_GET['id'] not unslashed before sanitization. Use wp_unslash() or similar

WARNING132
WordPress.Security.ValidatedSanitizedInput.InputNotValidated

Detected usage of a possibly undefined superglobal array index: $_FILES['blob']['tmp_name']. Check that the array index exists before using it.

WARNING96
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$available_storages".

ERROR54
WordPress.Security.EscapeOutput.OutputNotEscaped

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$backup_name'.

WARNING38
WordPress.Security.NonceVerification.Recommended

Processing form data without nonce verification.

ERROR32
WordPress.Security.EscapeOutput.ExceptionNotEscaped

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Could not create directory '{$outdir}'"'.

ERROR28
WordPress.WP.AlternativeFunctions.file_system_operations_fopen

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().

ERROR22
WordPress.WP.AlternativeFunctions.file_system_operations_fclose

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().

WARNING20
WordPress.WP.EnqueuedResourceParameters.MissingVersion

Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching.

ERROR18
WordPress.WP.AlternativeFunctions.file_system_operations_fread

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fread().

ERROR14
WordPress.WP.AlternativeFunctions.file_system_operations_fwrite

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite().

ERROR12
WordPress.WP.AlternativeFunctions.file_system_operations_is_writeable

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writeable().

ERROR10
WordPress.WP.AlternativeFunctions.file_system_operations_chmod

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: chmod().

WARNING8
WordPress.WP.EnqueuedResourceParameters.NotInFooter

In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.

ERROR7
missing_direct_file_access_protection

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

WARNING6
WordPress.PHP.DevelopmentFunctions.error_log_var_export

var_export() found. Debug code should not normally be used in production.

ERROR6
WordPress.WP.AlternativeFunctions.file_system_operations_is_writable

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writable().

ERROR6
WordPress.WP.AlternativeFunctions.file_system_operations_mkdir

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir().

ERROR6
badly_named_files

File and folder names must not contain spaces or special characters.

WARNING4
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "buildCleanupHtml".

ERROR4
WordPress.WP.AlternativeFunctions.curl_curl_setopt

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

ERROR4
WordPress.WP.AlternativeFunctions.file_system_operations_touch

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: touch().

WARNING2
PluginCheck.CodeAnalysis.DiscouragedFunctions.load_plugin_textdomainFound

load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.

Latest Snapshot

Findings

1,102

Errors

238

Warnings

864

Score History

First score snapshot

First scan completed Jun 20, 2026

v4.8.7 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2

Jun 20, 2026

v4.8.7

25

Latest

Findings
1,102
Errors
238
Warnings
864
Plugin Check
2.0.0
Model
2026.06-mvp-static-v2

Related Plugins