Description
Ultimate Auditor connects your site to Plugin Auditor, a plugin analysis service, and audits every plugin installed on your WordPress site. Each plugin gets an overall score from 0 to 100, a score in six categories, and a list of issues pinned to the exact file and line, all without leaving your dashboard.
It is an automated code and standards audit, not a known-vulnerability (CVE) scanner. It reads the plugin’s code and reports where it falls short.
What it audits
Over 100 automated checks across six categories:
- Security: nonces, capability checks, output escaping, input sanitisation, and safe database queries
- Code Quality: WordPress coding standards, deprecated functions, and risky patterns
- Performance: expensive operations, autoloaded options, and asset handling
- Compatibility: PHP and WordPress version support
- Privacy: data handling and external requests
- Accessibility: markup and ARIA practices
It also flags plugins that are abandoned, closed on WordPress.org, or have an update available.
How results are presented
- An overall score from 0 to 100 for each plugin, plus a score for each of the six categories
- Issue counts by severity: Critical, High, Medium, and Low
- Maintenance flags: update available, abandoned, or closed on WordPress.org
- A dashboard with site-wide category scores, the plugins that need attention, and your scan quota
- A link to the full report on pluginauditor.com, with every issue pinned to its file and line
Good to know
- This plugin is a client for Plugin Auditor. A free pluginauditor.com account and API key are required to run scans.
- Scanning is on demand. You trigger each scan; there is no background or scheduled scanning.
- Full reports and version history are viewed on pluginauditor.com.
- There is no WP-CLI interface; everything is done in the WordPress admin.
Features
- One-click scan for any single plugin
- Bulk scan for all or selected plugins
- Scores, category rings, and issue counts shown right on the Plugins page
- A dashboard: site scores across six categories, plugins that need attention, and recent scans
- Real plugin icon, version and update status, and last-scan time per plugin
- A score badge added to each plugin’s row in the WordPress Plugins list
- Works with both WordPress.org-hosted and third-party (custom or premium) plugins
- API key stored in the standard options table, never exposed in the front end
- Connect and disconnect at any time from the Settings page
External Services
This plugin connects to pluginauditor.com, a third-party plugin analysis service, to scan your installed plugins. pluginauditor.com is developed and operated by the same team that publishes this plugin.
Nothing is sent to pluginauditor.com until you enter an API key and click Connect. Once connected, data is transmitted in the following situations:
When you connect your account:
- Your API key, site URL (
home_url()), site name, WordPress version, and this plugin’s version are sent to verify the key and register your site.
When you run a scan (triggered by you):
- For plugins hosted on WordPress.org: the plugin slug and version number only, no files leave your server.
- For third-party or premium plugins: a ZIP archive of the plugin folder is uploaded for analysis, then deleted from their servers after the scan completes.
- Your API key and site URL accompany every scan request for authentication.
Automatically, while connected:
- When any plugin on your site is activated, deactivated, or deleted, the plugin folder name and the new status (along with your API key and site URL) are sent to pluginauditor.com so your dashboard stays in sync. This happens only while an API key is connected.
Inbound requests:
- While connected, the plugin registers REST API endpoints that pluginauditor.com can call to prepare a re-scan, download a plugin ZIP for analysis, or sync your installed-plugin list. These requests are authenticated with your API key (or a short-lived one-time token) before any action is taken.
Disconnecting your API key on the Settings page stops all communication with the service.
Service information:
- Service website: https://pluginauditor.com
- Terms of Use: https://pluginauditor.com/terms
- Privacy Policy: https://pluginauditor.com/privacy
Plugin Languages
The plugin is currently available in English. To help translate it into your language, visit the translation page.
Installation
- Upload the
ultimate-auditorfolder to the/wp-content/plugins/directory, or install via the WordPress Plugins screen. - Activate the plugin through the Plugins screen in WordPress.
- Go to Ultimate Auditor > Settings in your admin menu.
- Create a free account at pluginauditor.com and copy your API key.
- Paste your API key and click Connect.
- Go to Ultimate Auditor > Plugins and start scanning.
FAQ
-
Is it free to use?
-
Yes. Ultimate Auditor is free. It connects to Plugin Auditor, where a free account includes 30 scans per day, with full audit reports and shareable report links. Limits reset daily and may change over time; see the terms of use.
-
What does it check, exactly?
-
Over 100 automated checks across six categories: Security, Code Quality, Performance, Compatibility, Privacy, and Accessibility. Every finding is pinned to the exact file and line. It is a code and standards audit, not a known-vulnerability (CVE) scanner.
-
Does the plugin send my plugin files anywhere?
-
For plugins listed on WordPress.org, only the plugin slug and version number are sent to the API, no files leave your server. For third-party or premium plugins that are not on WordPress.org, a ZIP of the plugin folder is uploaded for analysis and deleted after the scan.
-
What do the scores and severities mean?
-
Each plugin gets an overall score from 0 to 100, plus a score in six categories: Security, Code Quality, Performance, Compatibility, Privacy, and Accessibility. Issues found are grouped by severity (Critical, High, Medium, and Low) so you can prioritise what to fix first. Higher scores are better; a lower score or any Critical or High issues mean the plugin needs attention.
-
How many plugins can I scan?
-
The free plan allows 30 scans per day. Each single-plugin scan counts as one scan; bulk scanning counts one scan per plugin. Limits reset daily and may change.
-
Where can I see the full scan report?
-
After scanning, click the View report link on the plugin’s row. Reports open on pluginauditor.com, where you can see the full breakdown of issues found, each pinned to its file and line.
-
Can I scan plugins that are not from WordPress.org?
-
Yes. Custom and premium plugins are supported. The plugin creates a ZIP of the plugin folder and uploads it to the API for analysis, then it is deleted after the scan.
-
Is my API key stored securely?
-
Your API key is stored in the WordPress database in the standard
wp_optionstable, the same place WordPress stores site settings. It is never exposed in front-end HTML or JavaScript. -
How do I stop the plugin from contacting pluginauditor.com?
-
Go to Ultimate Auditor > Settings and click Disconnect. This removes your API key and stops all communication with the service.
-
Where can I get support?
-
Ask in the support forum.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Ultimate Auditor” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Ultimate Auditor” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.3
- Fixed connecting and scanning on the live service. Update recommended.
1.0.2
- Clearer error messages when connecting a site or running a scan.
1.0.1
- Changed the API key format to
ultauditor_site_followed by 40 hex characters. Reconnect with a new key from your pluginauditor.com account.
1.0.0
- Initial release.
- Single-plugin and bulk scanning through the Plugin Auditor API.
- Per-plugin score from 0 to 100 with six category scores and issue counts by severity.
- Dashboard with site-wide category scores, plugins that need attention, recent scans, and scan quota.
- Score badge and a Settings link in the WordPress Plugins list.
- Connect and disconnect management on the Settings page.
- Support for both WordPress.org-hosted and third-party plugins.
- Help page with frequently asked questions.