Effective Date: July 1, 2026 Last Updated: July 1, 2026
What Is Plugin Auditor
Plugin Auditor is a security grading and code analysis service for WordPress plugins, operated at pluginauditor.com. It analyses plugin source code and returns a grade, score, and list of flagged issues.
Plugin Auditor is currently offered as a beta service. Features are still being developed and results may be incomplete or may contain errors. You should use it with that in mind.
Grades are advisory only. We do not claim or guarantee that any plugin is one hundred percent secure. We try our best to surface the most relevant issues our automated checks can detect, but a passing grade does not guarantee a plugin is free of vulnerabilities, and a failing grade does not by itself mean a plugin is unsafe. The grade reflects what our automated checks found at the time of the scan, and only what is detectable by static analysis.
We analyse a specific version of a plugin at a specific moment. We cannot and do not make any promise about future releases of that plugin, and we are not responsible for changes introduced in later versions. The decision about what to install on your own or your clients’ sites remains yours; you are best placed to judge what is right for your situation.
Our findings are automated, good-faith technical observations. We do not intend to defame, disparage, or damage the reputation of any plugin, plugin author, company, agency, or website. If you believe a finding is inaccurate, we would genuinely like to know. Contact us at contact@pluginauditor.com, and we will review it.
The service is intended to supplement, not replace, a professional security review.
Pricing and Future Changes
Plugin Auditor is currently free to use. We do not currently offer paid plans. We may introduce paid plans or paid features in the future, and we do not guarantee that the service, or any particular feature, will remain free indefinitely. If we introduce paid plans, we will give registered users reasonable notice by email before any change that would affect them.
Acceptance of Terms
By creating an account, connecting your API key, or using the Plugin Auditor web app or WordPress plugin, you agree to these Terms of Service and our Privacy Policy. If you do not agree, do not use the service.
By connecting your API key in the WordPress plugin, you explicitly consent to your site URL, plugin data, and any uploaded plugin files being transmitted to our servers for the purpose of running a security scan. This is the consent moment required for the service to function.
Your Account
You are responsible for keeping your API key secure. Do not share it publicly or commit it to version-controlled repositories. If you believe your API key has been compromised, regenerate it immediately from your account dashboard.
You must provide accurate information when creating an account. Accounts are for individual use.
Using the Service
You may only use Plugin Auditor to scan:
- Plugins available in the public WordPress.org repository.
- Plugins installed on WordPress sites you own.
- Plugins on sites where you have explicit permission from the site owner to conduct security testing.
You may not use Plugin Auditor to:
- Scan plugins on sites you do not own or have no authorisation to test.
- Attempt to reverse-engineer, scrape, or systematically extract data from the service.
- Use automated tools to exceed your scan limits.
- Resell or redistribute scan reports as your own commercial product without written permission.
Scanning Third-Party and Premium Plugins
When you upload a plugin ZIP that is not available on WordPress.org, you confirm that:
- You have the legal right to share that code with our service for the purpose of analysis.
- You understand the plugin may contain proprietary or commercially licensed code.
- You acknowledge that Plugin Auditor extracts the code in a temporary sandbox, analyses it, and deletes both the extracted files and the original ZIP immediately after the scan completes.
- Plugin Auditor does not redistribute, copy, retain, or share your uploaded plugin code with any third party.
Re-Scanning
We delete your uploaded code immediately after each scan, so we keep nothing to re-scan from. As a result:
- Scans of WordPress.org plugins can be re-run, because we fetch the plugin again from the repository.
- Scans triggered from a connected WordPress site can be re-run, because we fetch the plugin again from your site.
- A scan you ran by uploading a ZIP in the web dashboard cannot be re-run automatically. To scan it again, upload the plugin again.
Scan Limits
Without an account: you may run up to three scans per day. Each individual plugin scan counts as one scan.
Free registered account: you may run up to thirty scans per day. In a batch scan, each plugin in the batch counts as one scan.
We may adjust these limits to keep the service available and prevent abuse. If we introduce paid plans in the future, their limits will be stated at that time.
Connecting and Disconnecting the WordPress Plugin
When you connect the Plugin Auditor WordPress plugin to your account, your site URL and API key are sent to our servers to establish the site association. When you deactivate or uninstall the plugin, a notification is sent to our servers to release that association. This is described in our Privacy Policy.
Service Availability
The service is provided on an as-is basis. We do not guarantee uninterrupted availability. We will make reasonable efforts to maintain uptime but are not liable for downtime, data loss, or service interruptions.
Disclaimers and Limitation of Liability
Scan results and grades are informational tools only. Plugin Auditor is not responsible for any security breach, data loss, site compromise, or other harm that occurs, regardless of what grade a plugin received. You remain responsible for your own security decisions.
To the maximum extent permitted by law:
- The service is provided without warranty of any kind, express or implied, and is currently a beta service.
- If you use the service for free, our total aggregate liability to you for any claim arising from your use of the service shall not exceed fifty US dollars (USD 5).
- If you are on a paid plan in the future, our total aggregate liability shall not exceed fifty percent (50%) of the fees you paid us in the twelve months preceding the claim, whether or not you ran any scans in that period.
- We are not liable for indirect, incidental, special, or consequential damages of any kind.
Account Suspension and Termination
We reserve the right to suspend or terminate accounts that exceed scan limits through automated or abusive usage, scan sites without authorisation, attempt to circumvent rate limiting or access controls, or otherwise materially violate these terms. We will make reasonable efforts to notify you before suspension unless the violation requires immediate action.
You may delete your account at any time. On deletion, associated scan data, site associations, and personal information are removed from our active systems as described in the Privacy Policy.
Changes to the Service
We reserve the right to modify, limit, or discontinue any part of the service. For changes that materially affect registered users, we will provide reasonable notice by email.
Governing Law
These terms are governed by the laws of the Indian Jurisdiction. Any disputes shall be resolved in the courts of the Indian Jurisdiction.
Contact
For questions about these terms: contact@pluginauditor.com. For privacy requests: privacy@pluginauditor.com.