Built by two developers who got tired of finding out a plugin was broken after it was already live.
Security is not leverage for developers to make money. It's a responsibility.
It started with a client site getting hacked.
Mahesh and I worked together for 10 years at the same company. Same team, same Slack channels, same late nights debugging production at 2am. Developer friendships don't start with small talk. They start with shared war stories and a mutual understanding of what it feels like when something breaks at 2am.
In 2024, one of those war stories became real. A client site I managed got compromised. A hacker exploited a known vulnerability in an outdated plugin to inject code that opened access to the site root. It wasn't a sophisticated attack. It was just a plugin that hadn't been updated. The cleanup took days.
I told Mahesh. His response was immediate. He'd seen the same pattern before.
What followed was the kind of conversation developers have when a problem refuses to leave them alone. Every plugin update felt like a gamble. Cross-referencing Patchstack and WPScan. Reading changelogs line by line. Installing a plugin with 500K downloads and five stars and still not knowing whether $wpdb->query() on line 247 was wrapped in prepare(). Good ratings don't tell you that. Nothing did.
So we started building the checklist we wished existed. The checklist became a script. The script became a proper tool. I built the scanning engine. Mahesh built the infrastructure that makes every result come back in seconds. Plugin Auditor came out of those conversations. That's usually how the best tools get built.
This is one of the tools the WordPress community has needed for a while. And we're just getting started. There's more in the pipeline we're excited to ship.
Meet the Minds behind Plugin Auditor
Mayank Majeji
Co-founder
I've been building in WordPress since 2012, starting in my college days, and turned professional in 2015. Over a decade working with agencies, freelance clients, and the WordPress community across custom themes, plugins, WooCommerce, and multisite. More recently I have been focused on modern WordPress development using AI tools like Claude and Cursor to improve development workflows, automations, and productivity.
I'm a WordPress Core contributor, plugin author, and WordCamp volunteer. I architected UnmaskWP, a WordPress theme and plugin detector, with Mahesh as the development brain behind it. That was our first product together. Plugin Auditor is the second.
I built it because I needed it. And because every agency developer, freelancer, and site owner I know needs it too.
Mahesh Pawar
Co-founder
I spent 10 years building and scaling SaaS products and none of it was WordPress. Backend systems, API architecture, database performance, and infrastructure were my world. I worked alongside Mayank for all of it, which is where the friendship started. When he brought me into UnmaskWP, I was the development brain behind it. My first WordPress project, built on a decade of non-WordPress engineering.
On Plugin Auditor I handle performance, database architecture, and the API infrastructure that keeps every scan fast and reliable. If the tool responds in under 30 seconds, that's the part of the work I care about most.
Ten years of solving hard backend problems together makes it easy to know who to build something with.
Plugin reviews should be accessible, not intimidating.
Useful plugin reviews should not depend on having hours of spare time, deep audit experience, or vague reports that are hard to act on.
Plugin reviews should be:
- Clear enough for site owners to understand
- Detailed enough for developers to act on
- Fast enough to fit into real workflows
- Practical enough to help before problems spread
That's exactly what Plugin Auditor is built to do.