Know what's in a plugin before it touches your site
Drop in a ZIP or search a WordPress.org slug. No account, no setup. In under 30 seconds you see how many of 125 checks passed, a security score, and every issue pinpointed to the exact file and line number.
As seen on
Why WordPress plugin audits matter
of all WordPress vulnerabilities come from plugins, not themes, not core.
Most WordPress sites have at least one vulnerable plugin installed right now.
Patchstack 2026median time from public disclosure to mass exploitation. Most patches take days longer.
The window to patch closes before most developers even see the advisory.
Patchstack 2026plugins on WordPress.org, each reviewed once on submission, never automatically re-checked.
A plugin that passed review in 2019 can introduce a critical flaw through an update today.
WordPress.org Security Teamincrease in high-threat plugin vulnerabilities in a single year. The risk is accelerating.
The tooling attackers use is improving faster than most plugin teams can keep up.
Wordfence 2024How Can Plugin Auditor Help You?
See the plugin scored, taken apart, traced, and tracked over time, all before it touches your site.
A full security and code-quality audit. 125 automated checks, with an overall score and a score for every category, plus the exact file and line behind each issue.
- Scored 0 to 100. An overall score, and a separate 0 to 100 score for each of the six categories.
- 125 checks across 6 categories. Security, Standards, Performance, Compatibility, Privacy, and Accessibility.
- Every issue pinpointed. The file name and line number for each finding, not vague warnings.
- Fix-it guidance. Plain-language recommendations for every flagged check.
See exactly what is inside the plugin before you trust it on your site.
- Full file breakdown. Every file type, count, and total lines of code.
- Risky files flagged. Symlinks, exposed secrets, and credential files surfaced automatically.
- Dev clutter detected. Build and source files that should not ship to production.
- The real footprint. The true size and shape of the codebase, no guesswork.
Know what a plugin actually does to your site: everything it adds, stores, loads, and connects to.
- What it stores. Custom post types, database tables, options, and metadata it creates.
- What it registers. Blocks, roles, capabilities, and assets it loads.
- Background activity. Scheduled tasks (cron) and the endpoints it exposes.
- Detail on demand. The technical specifics behind every item, one click away.
See how the plugin has held up over time: how actively it is maintained, and how its scores and issues changed across versions.
- Maintenance at a glance. Last updated, release cadence, and total releases since launch.
- Scores across versions. How each category score moved release over release, and whether any regressed.
- Issues over time. Critical, high, medium, and low findings per audited version, so you see what got fixed.
- Adoption and version spread. How many installs still run older, lower-scoring versions.
Know who is behind the plugin, and whether it is a team you can trust.
- See who is behind it. Maintainer, committers, and contributors, each linked to their real WordPress.org profile.
- Team or solo maintainer. How many people actively build the plugin, so you know the bus factor.
- Verified people, not handles. Contributors resolve to genuine WordPress.org accounts.
- Active vs past. Who maintains it today versus who has moved on.
Built for everyone who can't afford surprises
Whether you build sites or run them. One site or a hundred. Every plugin you install is a decision. Make it an informed one.
Scan every plugin across every client site in one session. Get a clear, shareable report to back up every recommendation you make, without spending hours on manual review.
Star ratings don't catch SQL injection. A real code audit does. Know if a plugin is safe before it touches your customer data or takes your site down.
When a plugin brings down a client site, you're the one who takes the call. Scan before you install and know exactly what you're putting on their site.
See your plugin the way a reviewer sees it, before the rejection email arrives. Fix critical issues on your own terms, not someone else's timeline.
See exactly what a scan returns
Every issue flagged with the exact file and line number. No guesswork, no vague warnings.
Plugin Auditor has been very helpful for our team. We use it to roast our own plugin code. Every time we run a Plugin Auditor scan, it shows us more ways to improve.
Free to scan. Free to sign up.
Scan free without an account. Sign up to keep and reuse your work.
- Full 125-check audit
- Full audit report with fixes
- Shareable report link
- 3 scans per day
- 10MB max ZIP upload
- Scan history saved to your account
- Rescan across plugin versions
- Compare plugins side by side
- PDF export for client handoffs
- 30 scans per day, up from 3
- 25MB max ZIP upload, up from 10MB
No card required. Takes 30 seconds.
Why We Built This
Motivation Behind Plugin Auditor
In 2020, a plugin we'd recommended to clients turned out to have a SQL injection flaw that had been sitting in the code for two years. Nobody caught it. Not us, not the plugin team, not WordPress.org. We built Plugin Auditor because we never wanted that call again.
Got questions? We've got answers
Yes. You can scan without an account at 3 scans per day. Create a free account and you get 30 scans per day, plus scan history, rescans, plugin comparison, and PDF export. Full reports and shareable links are included for everyone.
No. Try it with no account at 3 scans per day. A free account raises that to 30 scans per day and unlocks history, rescans, and PDF downloads.
No. Your code is extracted into a temporary sandbox, scanned, and deleted the moment the scan finishes. This is true for every scan, with or without an account. We keep only the findings (your audit score and the list of issues) so you can view and share your report. We never retain, index, or share your source code.
It runs 125 automated checks across six categories: security, coding standards, performance, compatibility, accessibility, and privacy. Every flagged issue includes the exact file name and line number. See the full breakdown on the Features page.
Wordfence and similar tools are runtime tools. They watch your live site for threats after a plugin is already installed and running. Plugin Auditor reads the source code before anything touches your site, so you can make the decision before you install. Think of it as a code review, not an alarm system. It works alongside a firewall, not instead of one.
Any plugin on WordPress.org can be scanned by name or slug. For premium, private, or custom-built plugins, upload the ZIP directly. If it is a WordPress plugin, Plugin Auditor can scan it.