Make plugin reviews faster, clearer, and easier to act on.
Plugin Auditor runs 125 automated checks across security, code quality, performance, compatibility, accessibility, and privacy, then returns a clear report with the issues that matter most.
What the scan covers
125 checks across 6 categories. Every flagged issue includes the file name and line number.
Security
Finds vulnerabilities and risky patterns that can expose WordPress sites to attack.
- SQL injection & XSS risks
- Nonce verification & capability checks
- Hardcoded secrets & API keys
- Insecure deserialization & file includes
Standards
Checks code quality and WordPress best practices that affect maintainability and review readiness.
- Deprecated functions & hook naming
- i18n / l10n & GPL license
- Activation hooks & uninstall routines
- Block editor compatibility
Performance
Flags patterns that can slow down sites or create unnecessary load in production.
- Unbounded queries & queries in loops
- Transient & remote request caching
- Asset size & footer enqueueing
- WP Cron intervals
Compatibility
Checks whether the plugin is likely to behave well across PHP versions, multisite setups, and hosting environments.
- PHP version compatibility
- Multisite compatibility
- Hardcoded URLs
- wp_options autoload usage
Accessibility
Reviews plugin output for common accessibility issues that affect usability and baseline WCAG compliance.
- Image alt text & form labels
- ARIA attributes
- Keyboard accessibility
- Heading structure & link text
Privacy
Flags privacy-related issues that can create risk around data handling and user trust.
- Privacy policy & GDPR hook registration
Everything you need beyond the scan.
Beyond the scan. Reports, integrations, and tools built for people who rely on WordPress plugins.
PDF Export
Download a full audit report as a polished PDF, ready to share with clients or keep on file.
Shareable Reports
Every scan gets a public link. Send a link to your client or team. No login required to view.
Batch Scanning
Scan an entire plugin list in one request. Built for agencies auditing client sites at scale.
Scan History
7 days of scan history saved. Track how a plugin's score changes across versions over time. Spot regressions before they hit production.
WordPress Plugin
Connect your WordPress site and audit installed plugins without leaving the dashboard.
See the WordPress pluginMost tools catch problems after install. We catch them before.
Live-site scanners watch for threats once a plugin is already running. Plugin Auditor reads the source code first, so the decision happens before anything touches your site.
Monitor the live site
- Plugin is already installed and running
- Watches traffic for known attack signatures
- You find out when something already went wrong
Read the source first
- Analyse the code before it touches your site
- 125 checks across security, standards, and more
- Every issue pinned to the exact file and line
Not a replacement for a firewall. A check you run before you ever need one.
Torn between two plugins? Compare them.
Put two plugins side by side and weigh their scores, issues, size, and behavior before you commit to one.
Plugin Auditor has been very helpful for our team. We use it to roast our own plugin code. Every time we run a Plugin Auditor scan, it shows us more ways to improve.
Free to scan. Free to sign up.
Scan free without an account. Sign up to keep and reuse your work.
- Full 125-check audit
- Full audit report with fixes
- Shareable report link
- 3 scans per day
- 10MB max ZIP upload
- Scan history saved to your account
- Rescan across plugin versions
- Compare plugins side by side
- PDF export for client handoffs
- 30 scans per day, up from 3
- 25MB max ZIP upload, up from 10MB
No card required. Takes 30 seconds.
Got questions? We've got answers
125 automated checks across six categories: security (SQL injection, XSS, nonce and capability checks, hardcoded secrets), coding standards, performance, compatibility, accessibility, and privacy. Every issue is flagged with the exact file name and line number.
Each check carries a weighted severity score, so critical issues like SQL injection or a missing nonce affect the score far more than a minor warning. Scores run from 0 to 100 and reflect the plugin's overall risk profile across all 125 checks.
The rules are the same ones we have run manually on the plugins we have built and maintained over the past decade, refined across hundreds of scans to cut noise. Static analysis cannot execute code, so it will occasionally flag a pattern that is safe in context. We intentionally err toward caution. A false positive costs you a minute to review. A missed vulnerability can cost a client their site.
Yes. Every scan gets a public link that never expires, and no login is needed to view it. Registered users can also export a polished PDF to include in a proposal, audit, or handoff document.
Most scans finish in under 30 seconds. Larger plugins with hundreds of files can take a little longer, but you will have a full report with your audit score and every flagged issue within about a minute.
Yes. Upload a ZIP to scan any premium, private, or custom-built plugin. The code is extracted to a temporary sandbox and deleted immediately after the scan. We never store your source.
The PDF includes the plugin's audit score, a category breakdown, every flagged issue with its file and line number, and recommended fixes. It is formatted to share with clients or include in a project handoff. PDF export is available to registered users.