Ultimate Auditor

Ultimate Auditor connects your site to Plugin Auditor, a plugin analysis service, and audits every plugin installed on your WordPress site. Each plugin gets an overall score from 0 to 100, a score in six categories, and a list of issues pinned to the exact file and line, all without leaving your dashboard.

It is an automated code and standards audit, not a known-vulnerability (CVE) scanner. It reads the plugin’s code and reports where it falls short.

What it audits

Over 100 automated checks across six categories:

• Security: nonces, capability checks, output escaping, input sanitisation, and safe database queries
• Code Quality: WordPress coding standards, deprecated functions, and risky patterns
• Performance: expensive operations, autoloaded options, and asset handling
• Compatibility: PHP and WordPress version support
• Privacy: data handling and external requests
• Accessibility: markup and ARIA practices

It also flags plugins that are abandoned, closed on WordPress.org, or have an update available.

How results are presented

• An overall score from 0 to 100 for each plugin, plus a score for each of the six categories
• Issue counts by severity: Critical, High, Medium, and Low
• Maintenance flags: update available, abandoned, or closed on WordPress.org
• A dashboard with site-wide category scores, the plugins that need attention, and your scan quota
• A link to the full report on pluginauditor.com, with every issue pinned to its file and line

Good to know

• This plugin is a client for Plugin Auditor. A free pluginauditor.com account and API key are required to run scans.
• Scanning is on demand. You trigger each scan; there is no background or scheduled scanning.
• Full reports and version history are viewed on pluginauditor.com.
• There is no WP-CLI interface; everything is done in the WordPress admin.

Features

• One-click scan for any single plugin
• Bulk scan for all or selected plugins
• Scores, category rings, and issue counts shown right on the Plugins page
• A dashboard: site scores across six categories, plugins that need attention, and recent scans
• Real plugin icon, version and update status, and last-scan time per plugin
• A score badge added to each plugin’s row in the WordPress Plugins list
• Works with both WordPress.org-hosted and third-party (custom or premium) plugins
• API key stored in the standard options table, never exposed in the front end
• Connect and disconnect at any time from the Settings page

External Services

This plugin connects to pluginauditor.com, a third-party plugin analysis service, to scan your installed plugins. pluginauditor.com is developed and operated by the same team that publishes this plugin.

Nothing is sent to pluginauditor.com until you enter an API key and click Connect. Once connected, data is transmitted in the following situations:

When you connect your account:

• Your API key, site URL (home_url()), site name, WordPress version, and this plugin’s version are sent to verify the key and register your site.

When you run a scan (triggered by you):

• For plugins hosted on WordPress.org: the plugin slug and version number only, no files leave your server.
• For third-party or premium plugins: a ZIP archive of the plugin folder is uploaded for analysis, then deleted from their servers after the scan completes.
• Your API key and site URL accompany every scan request for authentication.

Automatically, while connected:

• When any plugin on your site is activated, deactivated, or deleted, the plugin folder name and the new status (along with your API key and site URL) are sent to pluginauditor.com so your dashboard stays in sync. This happens only while an API key is connected.

Inbound requests:

• While connected, the plugin registers REST API endpoints that pluginauditor.com can call to prepare a re-scan, download a plugin ZIP for analysis, or sync your installed-plugin list. These requests are authenticated with your API key (or a short-lived one-time token) before any action is taken.

Disconnecting your API key on the Settings page stops all communication with the service.

Service information:

• Service website: https://pluginauditor.com
• Terms of Use: https://pluginauditor.com/terms
• Privacy Policy: https://pluginauditor.com/privacy

Plugin Languages

The plugin is currently available in English. To help translate it into your language, visit the translation page.