How is this different from Plugin Check (PCP)?

Plugin Check runs basic lint-level checks against WordPress coding standards. WP HealthKit goes much deeper: it cross-references known CVEs via Wordfence Intelligence, scans for hardcoded secrets and credentials, checks dependency security via Packagist advisories, verifies PHP version compatibility, runs PHPCS and PHPStan analysis, traces data flows through your code, analyses authentication and authorization logic, checks every REST endpoint for permission gaps, evaluates CSRF/XSS/SQLi vectors, scans for unsafe AI-generated code patterns, validates accessibility compliance, and audits production readiness across 30+ checks. We catch the issues that PCP misses and that wp.org reviewers will flag.

What powers the audits?

Every audit runs through 62 verification layers. First, 58 deterministic scanners check verifiable facts: the Wordfence Intelligence CVE database, WPScan, WPVulnerability/Patchstack advisories, Composer dependency advisories (Packagist + OSV.dev for full GitHub Security Advisory coverage), npm/JS dependencies via OSV.dev, a dependency freshness scanner that flags any bundled release published less than 48 hours before the audit (the highest-risk window for supply-chain attacks), optional Socket.dev behavioural risk scoring (typosquat / install-script / malware / hidden-binary signals), 22 secret detection patterns, PHP version compatibility analysis, WordPress version compatibility, WooCommerce compatibility, plugin conflict detection, malware scanning, hook wiring audit, performance anti-pattern detection, i18n readiness checks, database schema audit, REST API authorization scanning (the #1 exploited WordPress vulnerability class), GDPR compliance, Gutenberg block security, host compatibility scoring across 8 managed WordPress hosts (WP Engine, Kinsta, Flywheel, Cloudways, SiteGround, Pressable, GridPane, Rocket.net), EU CRA compliance checking, multisite compatibility, GPL and license compatibility, CodeCanyon/Envato submission readiness, PHPCS WordPress coding standards, PHPStan level 5 type safety, Semgrep and Psalm static analysis. Then 4 WP-specialised AI engines run in parallel: a Security engine (including AI-generated code safety), a Quality-of-Life engine (9 dimensions of production readiness), an Accessibility engine (WCAG 2.1 AA + EAA compliance), and a Theme engine for theme audits. The 2026 edge runs alongside them: deterministic WCAG 2.2 checks, dynamic REST endpoint probing in a live sandbox, AI agent security (prompt injection, tool overreach), update channel safety, and phone-home detection. Deterministic results are merged, deduplicated, and confidence-scored before AI analysis begins.

Do you check for known CVEs?

Yes. Every audit cross-references your plugin or theme against the Wordfence Intelligence vulnerability database — the broadest, most up-to-date WordPress vulnerability dataset available — plus WPScan and the WPVulnerability advisory feed for triple-source coverage. Known CVEs are flagged with severity, affected versions, and remediation guidance before AI analysis even begins. This is a deterministic check, not an AI guess.

Why is your composite score more trustworthy than other scanners?

Most plugin scanners weight every finding the same. Ours doesn't. Every finding's contribution to the grade is computed as severity × confidence × execution context. Confidence is HIGH when two or more scanners independently surface the same issue, MEDIUM for a single trusted scanner, LOW for an AI-only finding with no corroboration — LOW findings count for half. AI suggestions whose remediation PHP doesn't parse count for a quarter. Execution context multiplies further: an N+1 query inside a GDPR exporter (runs five times in the plugin's lifetime) costs the score 5% of what an N+1 on the frontend-hot path costs. The score reflects how much each finding actually hurts your plugin in production, not how many findings you have.

How do you handle false positives?

Three layers. (1) AI hallucination guard: every AI-engine finding's cited file, line number, code-token presence, and remediation PHP syntax is verified against the actual plugin source. Hallucinated findings are dropped before they reach the report. (2) Cross-file callback resolution: AJAX nonces verified server-side in a different file, REST permission_callbacks defined elsewhere, load_plugin_textdomain called inside a class method — all resolved properly before the scanner flags 'missing' anything. (3) Per-account suppression: review and dismiss any finding once, the suppression persists across re-audits and the score excludes dismissed findings. Agency teams build their own dismissal list.

Do you scan for hardcoded secrets?

Yes. Our secret detection scanner checks for 22 patterns covering AWS access keys and secret keys, Stripe publishable and secret keys, Google API keys, Slack tokens, GitHub tokens, database credentials, private RSA/SSH keys, JWT secrets, and more. All detected values are fully redacted in reports — we never store or display your actual credentials.

What PHP versions do you check?

Our PHP compatibility scanner detects PHP 8.0, 8.1, 8.2, 8.3, and 8.4 features used in your code (named arguments, enums, fibers, readonly classes, typed class constants, property hooks, asymmetric visibility, etc.) and warns about deprecated constructs. If your plugin declares a minimum PHP version in its headers but uses features from a higher version, we flag the mismatch. The optional WordPress Playground activation matrix can run your plugin against WP 7.0/6.8 paired with PHP 8.1/8.2/8.3 to catch activation fatals before users see them.

Do you audit themes too?

Yes. When you upload a theme ZIP, WP HealthKit automatically activates a dedicated 7-phase Theme engine in addition to the standard security, quality, and accessibility engines, plus a deterministic theme scanner that validates style.css headers, FSE/block readiness, customizer sanitization, and WooCommerce template overrides. It handles both classic and block-based themes.

Do you check accessibility?

Yes. Our dedicated Accessibility engine checks WCAG 2.1 Level AA compliance and European Accessibility Act (EAA) conformance — mandatory since June 2025. It covers HTML semantics, ARIA patterns, keyboard navigation, form accessibility, color contrast, media accessibility, and admin interface accessibility. You get specific findings and code fixes, not just a pass/fail score.

Is my plugin code kept private?

Yes. Your plugin ZIP is processed in an isolated environment and analysed. The ZIP is stored securely for 30 days to power the Fix Plan and code viewer, then automatically deleted. Only you can access your stored files. The generated report is tied to your account.

How accurate are the findings?

Our deterministic scanners (CVE database, dependency audit, secret detection, PHP compatibility, PHPCS, PHPStan, REST authorization, GDPR, Gutenberg, host compatibility, CRA, multisite, GPL, CodeCanyon, theme) produce verified, factual results with zero false positives. Our AI engines are specifically trained on WordPress security patterns and the wp.org review process. While automated audits complement but do not replace manual penetration testing for critical applications, our users report that WP HealthKit catches the vast majority of issues that wp.org reviewers flag — plus security vulnerabilities that reviewers may not test for.

Can I re-audit after fixing issues?

Absolutely. Re-auditing is the recommended workflow: audit, fix the findings using the provided code examples, then re-audit to verify everything passes. Pro subscribers get re-audits at 50% off, and Agency plan members get 200 tokens per month.

Do you support WooCommerce extensions?

Yes. Our audit includes WooCommerce-specific security checks covering payment gateway security, checkout flow integrity, webhook verification, order amount tampering, session validation, and settings sanitization.

Can I use this for CRA compliance?

Yes. WP HealthKit can generate a complete EU Cyber Resilience Act (CRA) compliance package including a SECURITY.md file, a Vulnerability Disclosure Policy, assessment evidence documentation, and a CycloneDX/SPDX Software Bill of Materials (SBOM) — mandatory under the CRA from September 2026. A dedicated CRA scanner flags missing SECURITY.md, missing VDP contact, and untagged security changelogs ahead of the deadline. Available on Pro and Agency plans.

Is my AI-generated code safe?

That is exactly what our AI Code Safety scanner checks. It detects patterns commonly introduced by AI code generation tools like Copilot and ChatGPT — missing nonces on AJAX handlers, raw $wpdb queries without prepared statements, insufficient capability checks, REST endpoints without permission_callback, and other security gaps that AI assistants frequently produce. It runs automatically as part of every audit.

Can I use this in my CI/CD pipeline?

Yes. Pro and Agency plan subscribers get access to our GitHub Actions integration via wp-healthkit/audit-action. It runs a full audit on every pull request and fails the check if findings exceed your configured threshold. Agency plan members also get direct API access for custom integrations.

What file size limit do you support?

Plugin and theme ZIP files up to 50 MB are supported. This covers the vast majority of WordPress plugins and themes. If you have a larger package, contact us and we can accommodate it.

CRA deadline · September 202662 verification layersWordPress 7 ready

The compliance layer your WordPress agency is missing.

CRA, GDPR, WCAG, EAA — across every client site, every plugin, every update. 58 deterministic scanners and 4 AI engines run on every audit, with a fleet dashboard that surfaces score drops, new CVEs, and compliance shifts the morning they happen.

See the compliance dashboard Audit a single plugin (free)

Unlimited scans · 1 free AI audit every month · No card required

Now scanningharbor-and-oak.com

[email protected]ZIP · 1.8 MB

Unpacking ZIP
Wordfence CVE DB
Secret scanner (22)
PHP 8.0–8.4 compat
PHPCS WordPress
REST auth scanner
GDPR scanner
AI security engine
AI accessibility

Audits completed

—

live count

Findings flagged

—

across all audits

Plugins graded

—

distinct wp.org plugins

Verification layers

58 deterministic + 4 AI

Audit data sourced fromWordfence IntelligenceWPScanOSV.devPackagist AdvisoriesPHPCSPHPStan L5WCAG 2.1 AAEU CRAWCAG 2.2Dynamic REST probeSARIF

62 verification layers

58 deterministic scanners. 4 AI engines. Zero guesswork.

We verify known facts first — CVEs, secrets, dependency advisories, REST authorization, GDPR, compatibility — before any AI looks at your code.

Deterministic scanners

58 · verifiable facts only

Every finding is cross-checked against a source of truth. If a scanner can't prove it, it doesn't report it.

Wordfence CVE DB412k records

WPScan + WPVulnerabilityadvisory feeds

Composer advisoriescomposer.json

npm / JS depsOSV.dev batch

Secret scanner22 patterns

PHP 8.0–8.4 compatdeprecations

PHPCS WordPresscoding standard

PHPStan level 5type safety

Semgrep + Psalmstatic analysis

REST API authorizationpermission_callback

GDPR scannerconsent + erasure

Gutenberg blocksrender_callback

Host compatibilityWPE / Kinsta / Flywheel

CRA complianceSECURITY.md / VDP

Multisite compatnetwork options

GPL / licenseComposer + npm

CodeCanyon / Envatosubmission rules

Theme scannerFSE / customizer

Hook wiring auditactions/filters

Performance patternsN+1, caching

i18n readinesstranslatable

Database schemamigrations

Malware scannersignature db

Plugin conflictsknown pairs

WooCommerce compatHPOS / blocks

WP version compat5.0–7.0

Dynamic REST auth probewe attack it live

AI agent securityprompt injection

WCAG 2.2EAA mandatory

Update channel safetysupply chain

Phone-home detectortelemetry

Uninstall verifierdata cleanup

ENGINE / 01

Security engine

7 dimensions, AI-code-safety included.

Authn / AuthzREST gapsCSRF / XSS / SQLiAI code patterns

ENGINE / 02

Quality-of-Life engine

9 dimensions of production readiness.

Error handlingSettings UXi18nUpdate hygiene

ENGINE / 03

Accessibility engine

WCAG 2.1 AA + EAA · WCAG 2.2 deterministic.

Semantics · ARIAWCAG 2.2 SC 2.5.8 / 3.3.8Color · contrast

ENGINE / 04

Theme engine

Activates automatically for theme ZIPs.

FSE / block themesCustomizerAsset security

Only on WP HealthKit

Proof, not patterns.

Every scanner on the market pattern-matches your code and guesses. We go further: live sandbox attacks, cross-validated AI, and verdicts you can act on.

PROOF / 01Dynamic REST probeWe boot your plugin in a live WordPress sandbox and fire unauthenticated write requests at every REST route. Open endpoints are proven, not suspected.How it works →PROOF / 02Triple-model validationPremium audits run three frontier models independently. Findings 2+ models catch get HIGH confidence; single-model claims are marked for review.See the benchmarks →PROOF / 03Refactor plansWhen the same bug appears 12 times, you get ONE coordinated plan — root cause, shared abstraction, ordered files — not a dozen patches.Fix Plan v2 →PROOF / 04Update-safety verdictsEvery audited version pair gets a public safe / caution / risky verdict with the rule inputs behind it — before you hit update.See a live verdict →

Living Audits · Powered by Reverify

Your audit was true on Tuesday. Is it still true today?

A security audit is a snapshot — but the facts it rests on keep moving. Living Audits re-verifies your report's claims of safety and currency against ground truth, forever.

LIVING / 01Findings born with a whyEvery CRITICAL and HIGH finding carries a structured rationale: the evidence that grounds it, why it earned its severity, what was assumed, and what would change the assessment.

LIVING / 02Claims re-verified foreverYour minimum PHP, tested-up-to WordPress, and every pinned dependency are re-checked against OSV, endoflife.date, wp.org, and library docs on a decay-aware cadence.

LIVING / 03Challenges, never rewritesWhen a PHP version EOLs or a CVE lands in a library you bundle, a signed challenge with quoted evidence attaches to your report. The original audit is never edited.

How Living Audits works →

Report card

One grade for every buyer. Four grades for every reviewer.

Every audit produces an A–D letter across Security, Standards, Quality and Compatibility — plus an embeddable Submission Readiness badge.

HarborStripe@3.4.1

Submission-ready

/ 100 overall

Verified 4 minutes ago

Security

A · 96

Standards

A- · 91

Quality

B+ · 86

A11y

B · 82

wphealthkitA · 96submissionreadyCVEs0 / 412kembed · auto-updates

Ship with proof

embeddable badges

wphealthkitA · 96submissionreadyCVEs0 / 412k

<a href="https://wphealthkit.com/r/hs-341">
  <img src=".../badge/hs-341.svg"
       alt="Production-ready · Grade A" />
</a>

Live-updates on every re-audit — your wp.org listing never goes stale. Every grade links back to the public report it came from.

Free tools

Useful before you ever sign up.

All 5 tools →

Plugin security checkGrade any wp.org plugin in 30 seconds — grade, findings, receipt.Check a plugin →Security quizYour site's risk profile in 90 seconds, with the next step for each answer.Take the quiz →Breach cost calculatorWhat a compromised plugin actually costs your business, in £.Run the numbers →Conflict analyzerWill two plugins fight on your site? Known collisions, instantly.Check a pair →PHP compatibility checkIs that plugin ready for your PHP version? Deprecations in one click.Check compatibility →CRA readinessThe September deadline bundle: audit, SBOM, OpenVEX, receipt, templates.Get the bundle →

Pricing · GBP

Audits that used to cost thousands. One free AI audit a month.

Deterministic scans are unlimited on every plan — you only spend tokens when the AI engines read your code.

Free

£0forever

The most generous free tier in WordPress security.

Unlimited deterministic audits
1 AI audit/mo · all 58 scanners
Report card (A–D) + directory listing

Start free

Pro

£29/ month

For active plugin & theme authors.

30 full audits a month
Fix Plan with every audit
Site monitoring (1 site) · GitHub Actions + CLI

Start 14-day trial

Enterprise

£999/ month

For platforms and hosts running WordPress at scale.

Unlimited Standard + Advanced audits · fastest queue < 2 min
25 team seats + 500 monitored sites
Dedicated success manager + SLA

Talk to us

Ship with the receipts. Not with your fingers crossed.

Your next audit is two minutes away — upload a ZIP, get a verifiable grade, and put the badge where your buyers can see it. Every audit mints a signed provenance receipt anyone can verify.

Audit your plugin free See pricing

62 verification layers · 58 deterministic scanners + 4 AI engines · Results in ~2 minutes