93% 2fas-light

Code Review | 2FAS Prime — Two Factor Authentication

WordPress plugin 2FAS Prime — Two Factor Authentication scored 93% from 54 tests.

About plugin

  • Plugin page: 2fas-light
  • Plugin version: 3.3.1
  • PHP compatiblity: 7.2+
  • PHP version: 7.4.16
  • WordPress compatibility: 5.0-5.8
  • WordPress version: 5.9.2
  • First release: Dec 22, 2016
  • Latest release: Sep 20, 2021
  • Number of updates: 36
  • Update frequency: every 48.0 days
  • Top authors: 2fas (100%)

Code review

54 tests

User reviews

31 reviews

Install metrics

3,000+ active / 51,656 total downloads
Download (14.80 MB)

Benchmarks

Plugin footprint Passed 16 tests

Installer Passed 1 test

🔺 Critical test (weight: 50) | All plugins must install correctly, without throwing any errors, warnings, or notices
The plugin installed successfully, without throwing any errors or notices

Server metrics [RAM: ▲0.73MB] [CPU: ▼289.05ms] Passed 4 tests

An overview of server-side resources used by 2FAS Prime — Two Factor Authentication
No issues were detected with server-side resource usage
PageMemory (MB)CPU Time (ms)
Home /4.28 ▲0.7760.87 ▲10.36
Dashboard /wp-admin4.13 ▲0.7237.55 ▲4.92
Posts /wp-admin/edit.php4.42 ▲0.7741.83 ▲5.44
Add New Post /wp-admin/post-new.php7.65 ▲0.6895.37 ▼1,169.21
Media Library /wp-admin/upload.php4.07 ▲0.7826.55 ▲2.64
Admin settings /wp-admin/admin.php?page=twofas-light-admin-settings4.5332.96
Personal settings /wp-admin/admin.php?page=twofas-light-personal-settings5.9789.90

Server storage [IO: ▲23.09MB] [DB: ▲0.01MB] Passed 3 tests

Analyzing filesystem and database footprints of this plugin
This plugin installed successfully
Filesystem: 1,228 new files
Database: 5 new tables, 2 new options
New tables
wp_twofas_light_sessions
wp_twofas_light_trusted_devices
wp_twofas_light_authentications
wp_twofas_light_migrations
wp_twofas_light_session_variables
New WordPress options
twofas_light_remember_browser_allowed_rolesl
twofas_light_plugin_version

Browser metrics Passed 4 tests

An overview of browser requirements for 2FAS Prime — Two Factor Authentication
Normal browser usage
PageNodesMemory (MB)Script (ms)Layout (ms)
Home /3,877 ▲12315.10 ▼0.465.77 ▼0.362.15 ▼0.69
Dashboard /wp-admin2,972 ▲1146.24 ▲0.04121.55 ▼15.39151.53 ▼12.19
Posts /wp-admin/edit.php2,769 ▲783.25 ▲0.0167.05 ▲2.10137.70 ▼9.14
Add New Post /wp-admin/post-new.php1,697 ▲3616.14 ▲0.22404.73 ▼41.86153.19 ▼10.84
Media Library /wp-admin/upload.php1,779 ▲815.59 ▲0.08143.73 ▼1.20183.87 ▼2.91
Admin settings /wp-admin/admin.php?page=twofas-light-admin-settings1,5702.4757.55156.16
Personal settings /wp-admin/admin.php?page=twofas-light-personal-settings2,3482.7160.52184.07

Uninstaller [IO: ▲0.00MB] [DB: ▲0.00MB] Passed 4 tests

🔸 Tests weight: 35 | Checking the uninstaller removed all traces of the plugin
This plugin's uninstaller ran successfully

Smoke tests 75% from 4 tests

Server-side errors Passed 1 test

🔹 Test weight: 20 | This is a short smoke test looking for server-side errors
Good news, no errors were detected

SRP 50% from 2 tests

🔹 Tests weight: 20 | A shallow check of the single-responsibility principle; PHP files should perform no action - including output of placeholder text - and trigger no errors when accessed directly
Please take a closer look at the following
  • 471× GET requests to PHP files trigger server-side errors or Error 500 responses (only 10 are shown):
    • > PHP Fatal error
      Uncaught Error: Class 'Twig\ode\ode' not found in wp-content/plugins/2fas-light/vendor/twig/twig/src/Node/PrintNode.php:23
    • > PHP Fatal error
      Uncaught Error: Class 'Twig\\TokenParser\\AbstractTokenParser' not found in wp-content/plugins/2fas-light/vendor/twig/twig/src/TokenParser/AutoEscapeTokenParser.php:22
    • > PHP Fatal error
      Uncaught Error: Interface 'Twig\\Loader\\LoaderInterface' not found in wp-content/plugins/2fas-light/vendor/twig/twig/src/Loader/FilesystemLoader.php:22
    • > PHP Fatal error
      Uncaught Error: Class 'WhichBrowser\\Data\\Applications' not found in wp-content/plugins/2fas-light/vendor/whichbrowser/parser/data/regexes/applications-browsers.php:5
    • > PHP Fatal error
      Uncaught Error: Interface 'TwoFAS\\Light\\Hooks\\Hook_Interface' not found in wp-content/plugins/2fas-light/src/Hooks/Authenticate_Filter.php:11
    • > PHP Fatal error
      Uncaught Error: Class 'Twig\ode\\Expression\\Binary\\AbstractBinary' not found in wp-content/plugins/2fas-light/vendor/twig/twig/src/Node/Expression/Binary/OrBinary.php:17
    • > PHP Fatal error
      Uncaught Error: Class 'TwoFAS\\Light\\Http\\Controllers\\Controller' not found in wp-content/plugins/2fas-light/src/Http/Controllers/Update_Obligatory_Roles.php:12
    • > PHP Fatal error
      Uncaught Error: Class 'TwoFAS\\Light\\Http\\Middleware\\Middleware' not found in wp-content/plugins/2fas-light/src/Http/Middleware/Check_User_Is_Admin.php:15
    • > PHP Fatal error
      Uncaught Error: Class 'TwoFAS\\Light\\Exceptions\\Http_Exception' not found in wp-content/plugins/2fas-light/src/Exceptions/Method_Not_Allowed_Http_Exception.php:8
    • > PHP Fatal error
      Uncaught Error: Class 'DI\\Definition\\Resolver\\ObjectCreator' not found in wp-content/plugins/2fas-light/vendor/php-di/php-di/src/Definition/Resolver/InstanceInjector.php:18

User-side errors Passed 1 test

🔹 Test weight: 20 | This is just a short smoke test looking for browser issues
No browser errors were detected

Optimizations

Plugin configuration 93% from 29 tests

readme.txt 94% from 16 tests

It's important to format your readme.txt file correctly as it is parsed for the public listing of your plugin
These attributes need your attention:
  • Tags: Too many tags (12 tag instead of maximum 10); only the first 5 tags are used in your directory listing
The official readme.txt is a good inspiration

2fas-light/twofas_light.php 92% from 13 tests

Analyzing the main PHP file in "2FAS Prime — Two Factor Authentication" version 3.3.1
You should first fix the following items:
  • Main file name: Name the main plugin file the same as the plugin slug ("2fas-light.php" instead of "twofas_light.php")

Code Analysis 97% from 3 tests

File types Passed 1 test

🔸 Test weight: 35 | Executable files are not allowed as they can serve as attack vectors
No dangerous file extensions were detected110,652 lines of code in 1,197 files:
LanguageFilesBlank linesComment linesLines of code
PHP98214,93019,21899,320
reStructuredText1042,4542,4042,930
Sass31424302,195
CSS439122,068
JSON2001,080
Twig34950917
Markdown103430746
JavaScript41247693
PO File1161208437
YAML5150109
XML57096
Bourne Shell16143
SVG140018

PHP code 50% from 2 tests

This is a short overview of cyclomatic complexity and code structure for this plugin
The following items need your attention
  • Cyclomatic complexity of methods should be reduced to less than 100 (currently 210)
Cyclomatic complexity
Average complexity per logical line of code0.39
Average class complexity8.34
▷ Minimum class complexity1.00
▷ Maximum class complexity484.00
Average method complexity3.02
▷ Minimum method complexity1.00
▷ Maximum method complexity210.00
Code structure
Namespaces120
Interfaces62
Traits26
Classes830
▷ Abstract classes404.82%
▷ Concrete classes79095.18%
▷ Final classes10813.67%
Methods3,550
▷ Static methods2687.55%
▷ Public methods2,82379.52%
▷ Protected methods2166.08%
▷ Private methods51114.39%
Functions315
▷ Named functions13743.49%
▷ Anonymous functions17856.51%
Constants362
▷ Global constants154.14%
▷ Class constants34795.86%
▷ Public constants34599.42%

Plugin size Passed 2 tests

Image compression Passed 2 tests

Using a strong compression for your PNG files is a great way to speed-up your plugin
3 PNG files occupy 0.08MB with 0.03MB in potential savings
Potential savings
Compression of 3 random PNG files using pngquant
FileSize - originalSize - compressedSavings
vendor/endroid/qr-code/assets/symfony.png15.90KB16.60KB0.00%
assets/img/phone@2x.png53.07KB24.54KB▼ 53.76%
assets/img/phone.png18.06KB9.36KB▼ 48.19%