WordPress Plugin Auditor
52 security, standards and performance checks over any plugin's source — every finding pinned to a file and line. Free, no sign-up.
What gets checked
52 checks read the plugin's source. Nothing is executed.
Security
Unprepared SQL, missing nonces, unescaped output, capability checks, path traversal, SSRF, open redirects, upload handling, hardcoded secrets, obfuscated code.
Standards
Plugin header, readme.txt validity, licence, function prefixing, deprecated functions, short tags, asset enqueueing, files that should never ship.
Performance
Queries inside loops, unbounded queries, query_posts() replacing the main query.
Compatibility
Syntax newer than the declared PHP requirement, hardcoded paths and URLs.
How the score works
Every plugin starts at 100. A failing check costs its severity — critical 25, high 10, warning 3, notice 1 — plus one point for each repeat, capped at twice the severity. Fifteen unescaped echoes is worse than one and nowhere near fifteen times worse: it is one habit, in one codebase, with one fix. You can add the deductions up yourself, which is the point.