When we launched Plugin Auditor, every WordPress plugin audit ran 72 checks. Today, it runs 125, and that’s only part of the story.
Over the last few months, we’ve made the scanner sharper, added a way to put two plugins head-to-head, built a public page for popular plugins, and made the whole report easier to read.
Here’s everything new, and why it matters when you’re deciding whether a plugin is safe to install.
1. A bigger, sharper scanner: 72 → 125 checks
The heart of Plugin Auditor is the scan, and we have expanded what it looks for.
Here’s how that growth breaks down:
| Category | Before | Now | Added |
|---|---|---|---|
| Security | 22 | 37 | +15 |
| Coding Standards | 30 | 61 | +31 |
| Performance | 9 | 12 | +3 |
| Compatibility | 4 | 6 | +2 |
| Privacy | 1 | 3 | +2 |
| Accessibility | 6 | 6 | — |
| Total | 72 | 125 | +53 |
Here are some of the new check highlights:
- Vulnerable JavaScript libraries
- Third-party dependency vulnerabilities
- Sensitive and unexpected files
- Exposed credentials and environment information
- Additional WordPress coding and quality patterns
We have also improved existing checks based on what we see in real plugins and published vulnerabilities. Our goal is not simply to run more checks. It’s to give you a clearer picture of what’s inside a plugin before you decide whether it’s the right choice for your site.
2. Introducing Scanning Engine Versioning
This is one of the most important changes we have made in Plugin Auditor.
Every report is now tied to the version of the Plugin Auditor scanning engine that generated it.
Why does that matter and how does it affect you?
It matters because Plugin Auditor keeps evolving.
New checks are added, existing checks improve, and detection logic changes as we learn from more plugins. A report generated today may therefore contain insights that an older report couldn’t have detected.
Scanning Engine Versioning gives us a clear way to distinguish between reports generated by different generations of the scanner and helps us keep historical audit data meaningful as Plugin Auditor improves.
You’ll now see the scanning engine version directly in the report header.
3. See more than just the audit findings
A plugin is more than the issues found in its source code.
Plugin Auditor reports now give you different ways to explore what’s actually inside a plugin and what it may do on a WordPress site.
Code
The Code view gives you a higher-level picture of the plugin’s codebase, including its size, file composition, lines of code, PHP footprint, and other useful code-level context.
Behavior
The Behavior view shows the footprint a plugin can create on your site.
That can include things such as database activity, scheduled jobs, custom post types, cookies, external connections, scripts, styles, and other behaviors detected during analysis.
We’ve also simplified this view so you only see sections that actually apply to the plugin.
The idea is simple: audit findings tell you what Plugin Auditor detected, while Code and Behavior help you understand the plugin itself.
4. Reports now have dedicated views
As the amount of information in Plugin Auditor grew, keeping everything on one long report page stopped making sense.
Reports are now organized into dedicated tabs:
- Audit — findings across Security, Coding Standards, Performance, Compatibility, Privacy, and Accessibility
- Code — information about the plugin’s codebase and files
- Behavior — what the plugin creates, stores, loads, or connects to
- History — how the plugin’s scores, issues, releases, and maintenance have changed over time
- Community — ratings, support activity, contributors, and other WordPress.org signals
Instead of scrolling through everything, you can jump directly to the part of the plugin you want to understand.
5. Compare two WordPress plugins side by side
One of the biggest additions is Plugin Compare.
If you’re choosing between two plugins, you can now put them side by side and compare their audit results and other important signals from one screen.
The comparison includes things such as:
- audit scores and issues
- code and plugin size
- behavior
- popularity and ratings
- update information
- vulnerable libraries and other notable findings
A radar chart also gives you a quick visual comparison across Plugin Auditor’s six audit categories.
You can compare plugins from WordPress.org, ZIP uploads, or your recent scans.
No more opening two reports and jumping back and forth trying to work out which plugin looks better for your needs.
6. Public pages for WordPress plugins
We are also making Plugin Auditor useful before you even start a new scan.
WordPress.org plugins now have their own public Plugin pages, bringing together audit data and useful information about the plugin in one place.
You can explore things such as:
- the latest audit
- category scores
- top issues
- ratings and active installations
- version history
- historical audit data
Individual reports also have their own shareable URLs, making it easier to send an audit to a colleague, client, or plugin developer.
These pages will continue to evolve as new plugin versions are released and the Plugin Auditor scanning engine improves.
7. A clearer, smoother report experience
We’ve made a number of smaller improvements across the reporting experience too.
Reports now include a category radar chart for a quick overview of the six audit areas.
We’ve improved the experience while scans are running so results appear more smoothly instead of leaving you looking at an empty screen.
And we’ve continued refining the experience for guests and signed-in users so it’s easier to start exploring Plugin Auditor without unnecessary friction.
Individually, these are smaller changes. Together, they make Plugin Auditor much easier to use.
A lot has changed
Going from 72 checks to 125 is the easiest part of this update to quantify. But the bigger change is what Plugin Auditor is becoming.
It’s no longer just about running checks against a ZIP file.
Audit a plugin. Understand its code and behavior. Explore its history. Compare it with another plugin. And research plugins before you even scan them.
There’s still a lot more we’re building. But for now, we’d rather let you explore the changes yourself.
Try the latest Plugin Auditor on the Scanner Page and run a WordPress plugin audit.
No account is required to get started.
