內容簡介
Ultimate Auditor 是一款連接到 Plugin Auditor 的外掛，能夠自動審核您 WordPress 網站上安裝的每個外掛，並提供詳細的評分和問題報告，幫助您提升網站的安全性和效能。
【主要功能】
• 自動化代碼和標準審核
• 提供 0 到 100 的總體評分
• 六個類別的詳細評分
• 標示需要注意的外掛狀態
• 一鍵掃描單一或多個外掛
• 連接和斷開 Plugin Auditor 服務
外掛標籤
開發者團隊
原文外掛簡介
Ultimate Auditor connects your site to Plugin Auditor, a plugin analysis service, and audits every plugin installed on your WordPress site. Each plugin gets an overall score from 0 to 100, a score in six categories, and a list of issues pinned to the exact file and line, all without leaving your dashboard.
It is an automated code and standards audit, not a known-vulnerability (CVE) scanner. It reads the plugin’s code and reports where it falls short.
What it audits
Over 100 automated checks across six categories:
Security: nonces, capability checks, output escaping, input sanitisation, and safe database queries
Code Quality: WordPress coding standards, deprecated functions, and risky patterns
Performance: expensive operations, autoloaded options, and asset handling
Compatibility: PHP and WordPress version support
Privacy: data handling and external requests
Accessibility: markup and ARIA practices
It also flags plugins that are abandoned, closed on WordPress.org, or have an update available.
How results are presented
An overall score from 0 to 100 for each plugin, plus a score for each of the six categories
Issue counts by severity: Critical, High, Medium, and Low
Maintenance flags: update available, abandoned, or closed on WordPress.org
A dashboard with site-wide category scores, the plugins that need attention, and your scan quota
A link to the full report on pluginauditor.com, with every issue pinned to its file and line
Good to know
This plugin is a client for Plugin Auditor. A free pluginauditor.com account and API key are required to run scans.
Scanning is on demand. You trigger each scan; there is no background or scheduled scanning.
Full reports and version history are viewed on pluginauditor.com.
There is no WP-CLI interface; everything is done in the WordPress admin.
Features
One-click scan for any single plugin
Bulk scan for all or selected plugins
Scores, category rings, and issue counts shown right on the Plugins page
A dashboard: site scores across six categories, plugins that need attention, and recent scans
Real plugin icon, version and update status, and last-scan time per plugin
A score badge added to each plugin’s row in the WordPress Plugins list
Works with both WordPress.org-hosted and third-party (custom or premium) plugins
API key stored in the standard options table, never exposed in the front end
Connect and disconnect at any time from the Settings page
External Services
This plugin connects to pluginauditor.com, a third-party plugin analysis service, to scan your installed plugins. pluginauditor.com is developed and operated by the same team that publishes this plugin.
Nothing is sent to pluginauditor.com until you enter an API key and click Connect. Once connected, data is transmitted in the following situations:
When you connect your account:
Your API key, site URL (home_url()), site name, WordPress version, and this plugin’s version are sent to verify the key and register your site.
When you run a scan (triggered by you):
For plugins hosted on WordPress.org: the plugin slug and version number only, no files leave your server.
For third-party or premium plugins: a ZIP archive of the plugin folder is uploaded for analysis, then deleted from their servers after the scan completes.
Your API key and site URL accompany every scan request for authentication.
Automatically, while connected:
When any plugin on your site is activated, deactivated, or deleted, the plugin folder name and the new status (along with your API key and site URL) are sent to pluginauditor.com so your dashboard stays in sync. This happens only while an API key is connected.
Inbound requests:
While connected, the plugin registers REST API endpoints that pluginauditor.com can call to prepare a re-scan, download a plugin ZIP for analysis, or sync your installed-plugin list. These requests are authenticated with your API key (or a short-lived one-time token) before any action is taken.
Disconnecting your API key on the Settings page stops all communication with the service.
Service information:
Service website: https://pluginauditor.com
Terms of Use: https://pluginauditor.com/terms
Privacy Policy: https://pluginauditor.com/privacy
Plugin Languages
The plugin is currently available in English. To help translate it into your language, visit the translation page.
