83% headers-security-advanced-hsts-wp

Code Review | Headers Security Advanced & HSTS WP

WordPress plugin Headers Security Advanced & HSTS WP scored83%from 54 tests.

About plugin

  • Plugin page: headers-security-...
  • Plugin version: 5.0.29
  • PHP compatiblity: 7.4+
  • PHP version: 7.4.16
  • WordPress compatibility: 4.7-6.3.1
  • WordPress version: 6.3.1
  • First release: Sep 4, 2021
  • Latest release: Sep 10, 2023
  • Number of updates: 290
  • Update frequency: every 2.5 days
  • Top authors: unicorn03 (100%)

Code review

54 tests

User reviews

47 reviews

Install metrics

30,000+ active /343,529 total downloads

Benchmarks

Plugin footprint 82% from 16 tests

Installer Passed 1 test

🔺 Critical test (weight: 50) | Verifying that this plugin installs correctly without errors
This plugin's installer ran successfully

Server metrics [RAM: ▲0.02MB] [CPU: ▼5.92ms] Passed 4 tests

Server-side resources used by Headers Security Advanced & HSTS WP
This plugin has minimal impact on server resources
PageMemory (MB)CPU Time (ms)
Home /3.50 ▲0.0343.11 ▲0.46
Dashboard /wp-admin3.33 ▲0.0248.87 ▼0.66
Posts /wp-admin/edit.php3.38 ▲0.0248.33 ▼1.96
Add New Post /wp-admin/post-new.php5.91 ▲0.0280.87 ▼19.80
Media Library /wp-admin/upload.php3.25 ▲0.0239.28 ▼1.24
Headers Security Advanced & HSTS WP /wp-admin/options-general.php?page=headers-security-advanced-hsts-wp-plugin3.2233.72

Server storage [IO: ▲0.24MB] [DB: ▲0.00MB] 67% from 3 tests

Filesystem and database footprint
Just a few items left to fix
  • You have illegally modified 1 file (1.94KB) outside of "wp-content/plugins/headers-security-advanced-hsts-wp/" and "wp-content/uploads/"
    • (modified) .htaccess
Filesystem: 21 new files
Database: no new tables, 10 new options
New WordPress options
hsts_preload
widget_recent-posts
db_upgraded
widget_theysaidso_widget
can_compress_scripts
hsts_max_age
hsts_include_subdomains
widget_recent-comments
hsts_csp
theysaidso_admin_options

Browser metrics Passed 4 tests

An overview of browser requirements for Headers Security Advanced & HSTS WP
Minimal impact on browser resources
PageNodesMemory (MB)Script (ms)Layout (ms)
Home /2,846 ▲8514.26 ▼0.181.38 ▼0.5712.87 ▼29.03
Dashboard /wp-admin2,271 ▲915.61 ▼0.0482.57 ▼8.7146.28 ▲4.50
Posts /wp-admin/edit.php1,923 ▼1770.71 ▼1.232.39 ▼36.4410.83 ▼24.86
Add New Post /wp-admin/post-new.php1,531 ▲523.13 ▼0.54666.88 ▲2.0649.87 ▼11.93
Media Library /wp-admin/upload.php1,403 ▼04.19 ▲0.0697.87 ▼12.2747.75 ▲1.09
Headers Security Advanced & HSTS WP /wp-admin/options-general.php?page=headers-security-advanced-hsts-wp-plugin1,0391.9927.2975.63

Uninstaller [IO: ▲0.00MB] [DB: ▲0.00MB] 75% from 4 tests

🔸 Tests weight: 35 | It is important to correctly uninstall your plugin, without leaving any traces
It is recommended to fix the following
  • Zombie WordPress options were found after uninstall: 6 options
    • widget_recent-comments
    • theysaidso_admin_options
    • widget_theysaidso_widget
    • db_upgraded
    • widget_recent-posts
    • can_compress_scripts

Smoke tests 75% from 4 tests

Server-side errors Passed 1 test

🔹 Test weight: 20 | Just a short smoke test targeting errors on the server (in the Apache logs)
Even though everything seems fine, this is not an exhaustive test

SRP 50% from 2 tests

🔹 Tests weight: 20 | A shallow check of the single-responsibility principle; PHP files should perform no action - including output of placeholder text - and trigger no errors when accessed directly
The following issues need your attention
  • 1× PHP files output text when accessed directly:
    • > /wp-content/plugins/headers-security-advanced-hsts-wp/headers-security-advanced-hsts-wp.php

User-side errors Passed 1 test

🔹 Test weight: 20 | A shallow check that no browser errors were triggered
Everything seems fine, but this is not an exhaustive test

Optimizations

Plugin configuration 90% from 29 tests

readme.txt 88% from 16 tests

The readme.txt file is important because it is parsed by WordPress.org for the public listing of your plugin
These attributes need to be fixed:
  • Plugin Name: Please replace "Plugin Name" with the name of your plugin on the first line ( === headers-security-advanced-hsts-wp === )
  • Tags: Please delete some tags, you are using 14 tag instead of maximum 10
The official readme.txt might help

headers-security-advanced-hsts-wp/headers-security-advanced-hsts-wp.php 92% from 13 tests

The main PHP script in "Headers Security Advanced & HSTS WP" version 5.0.29 is automatically included on every request by WordPress
Please make the necessary changes and fix the following:
  • Description: If Twitter did it, so should we! Keep the description under 140 characters (currently 604 characters long)

Code Analysis Passed 3 tests

File types Passed 1 test

🔸 Test weight: 35 | There should be no dangerous file extensions present in any WordPress plugin
No dangerous file extensions were detected1,695 lines of code in 13 files:
LanguageFilesBlank linesComment linesLines of code
PO File62819641,114
PHP24932425
CSS20153
SVG10148
XML1152241
JSON10014

PHP code Passed 2 tests

Analyzing cyclomatic complexity and code structure
There are no cyclomatic complexity problems detected for this plugin
Cyclomatic complexity
Average complexity per logical line of code0.18
Average class complexity0.00
▷ Minimum class complexity0.00
▷ Maximum class complexity0.00
Average method complexity0.00
▷ Minimum method complexity0.00
▷ Maximum method complexity0.00
Code structure
Namespaces0
Interfaces0
Traits0
Classes0
▷ Abstract classes00.00%
▷ Concrete classes00.00%
▷ Final classes00.00%
Methods0
▷ Static methods00.00%
▷ Public methods00.00%
▷ Protected methods00.00%
▷ Private methods00.00%
Functions18
▷ Named functions18100.00%
▷ Anonymous functions00.00%
Constants2
▷ Global constants00.00%
▷ Class constants2100.00%
▷ Public constants2100.00%

Plugin size Passed 2 tests

Image compression Passed 2 tests

Often times overlooked, PNG files can occupy unnecessary space in your plugin
2 PNG files occupy 0.02MB with 0.01MB in potential savings
Potential savings
Compression of 2 random PNG files using pngquant
FileSize - originalSize - compressedSavings
assets/images/orange-button-min.png16.75KB7.67KB▼ 54.20%
assets/images/cyan-button-min.png6.84KB3.51KB▼ 48.72%