68% hide-my-wp

Code Review | Hide My WP Ghost - Security Plugin

WordPress plugin Hide My WP Ghost - Security Plugin scored68%from 54 tests.

About plugin

  • Plugin page: hide-my-wp
  • Plugin version: 5.0.27
  • PHP compatiblity: 5.6+
  • PHP version: 7.4.16
  • WordPress compatibility: 4.3-6.3
  • WordPress version: 6.3.1
  • First release: Jul 1, 2016
  • Latest release: Oct 6, 2023
  • Number of updates: 681
  • Update frequency: every 3.9 days
  • Top authors: johndarrel (100%)

Code review

54 tests

User reviews

301 reviews

Install metrics

200,000+ active /1,505,512 total downloads
Download (1.89 MB)

Benchmarks

Plugin footprint 65% from 16 tests

Installer Passed 1 test

🔺 Critical test (weight: 50) | Verifying that this plugin installs correctly without errors
Installer ran successfully

Server metrics [RAM: ▲1.59MB] [CPU: ▲26.17ms] Passed 4 tests

A check of server-side resources used by Hide My WP Ghost - Security Plugin
Server-side resource usage in normal parameters
PageMemory (MB)CPU Time (ms)
Home /4.47 ▲1.0149.29 ▲10.30
Dashboard /wp-admin5.15 ▲1.80249.44 ▲186.80
Posts /wp-admin/edit.php5.16 ▲1.8175.28 ▲26.69
Add New Post /wp-admin/post-new.php7.67 ▲1.79137.47 ▲39.00
Media Library /wp-admin/upload.php5.01 ▲1.7964.08 ▲28.70
Change Paths /wp-admin/admin.php?page=hmwp_permalinks5.0158.60
Backup/Restore /wp-admin/admin.php?page=hmwp_backup5.0149.97
Security Check /wp-admin/admin.php?page=hmwp_securitycheck5.0150.81
Hide My WP /wp-admin/admin.php?page=hmw_settings5.0152.59
Mapping /wp-admin/admin.php?page=hmwp_mapping5.0152.95
Events Log /wp-admin/admin.php?page=hmwp_log5.13238.58
Overview /wp-admin/admin.php?page=hmwp_settings5.0151.19
Tweaks /wp-admin/admin.php?page=hmwp_tweaks5.0150.10
Plugins /wp-admin/admin.php?page=hmwp_plugins5.0148.72
Brute Force /wp-admin/admin.php?page=hmwp_brute5.0155.09

Server storage [IO: ▲5.22MB] [DB: ▲0.01MB] Passed 3 tests

Input-output and database impact of this plugin
This plugin was installed successfully
Filesystem: 182 new files
Database: no new tables, 9 new options
New WordPress options
theysaidso_admin_options
widget_recent-posts
widget_recent-comments
hmwp_options
can_compress_scripts
hmwp_securitycheck_time
widget_theysaidso_widget
db_upgraded
hmwp_securitycheck

Browser metrics Passed 4 tests

An overview of browser requirements for Hide My WP Ghost - Security Plugin
There were no issues detected in relation to browser resource usage
PageNodesMemory (MB)Script (ms)Layout (ms)
Home /2,923 ▲15213.32 ▼1.051.64 ▼0.1340.30 ▼0.40
Dashboard /wp-admin2,329 ▲1414.92 ▲0.05120.16 ▲4.0042.15 ▲5.11
Posts /wp-admin/edit.php2,154 ▲622.00 ▼0.1945.08 ▲10.6740.97 ▲9.14
Add New Post /wp-admin/post-new.php1,593 ▲7918.38 ▲0.89604.86 ▼75.3553.07 ▲3.62
Media Library /wp-admin/upload.php1,455 ▲674.28 ▲0.00100.59 ▼4.6947.47 ▲1.04
Change Paths /wp-admin/admin.php?page=hmwp_permalinks1,0492.1431.7158.45
Backup/Restore /wp-admin/admin.php?page=hmwp_backup1,0552.1228.9836.80
Security Check /wp-admin/admin.php?page=hmwp_securitycheck1,0331.9626.2236.49
Hide My WP /wp-admin/admin.php?page=hmw_settings9551.9725.7935.14
Mapping /wp-admin/admin.php?page=hmwp_mapping1,0522.0828.5440.57
Events Log /wp-admin/admin.php?page=hmwp_log1,0522.2127.1739.05
Overview /wp-admin/admin.php?page=hmwp_settings1,0381.9725.4138.87
Tweaks /wp-admin/admin.php?page=hmwp_tweaks1,0522.1327.5639.57
Plugins /wp-admin/admin.php?page=hmwp_plugins1,3401.9526.2237.69
Brute Force /wp-admin/admin.php?page=hmwp_brute1,0522.0927.1340.34

Uninstaller [IO: ▲0.00MB] [DB: ▲0.00MB] 50% from 4 tests

🔸 Tests weight: 35 | Checking the uninstaller removed all traces of the plugin
You still need to fix the following
  • Uninstall procedure had uncaught errors
    • > Notice in wp-content/plugins/hide-my-wp/uninstall.php+11
    Constant HMWP_BASENAME already defined
  • This plugin did not uninstall successfully, leaving 6 options in the database
    • widget_recent-comments
    • widget_recent-posts
    • can_compress_scripts
    • widget_theysaidso_widget
    • theysaidso_admin_options
    • db_upgraded

Smoke tests 50% from 4 tests

Server-side errors Passed 1 test

🔹 Test weight: 20 | A shallow check that no server-side errors were triggered
Even though everything seems fine, this is not an exhaustive test

SRP 0% from 2 tests

🔹 Tests weight: 20 | The single-responsibility principle applies for WordPress plugins as well - please make sure your PHP files perform no actions when accessed directly
Please fix the following items
  • 66× GET requests to PHP files return non-empty strings (only 10 are shown):
    • > /wp-content/plugins/hide-my-wp/models/compatibility/Autoptimize.php
    • > /wp-content/plugins/hide-my-wp/models/Brute.php
    • > /wp-content/plugins/hide-my-wp/models/Woocommerce.php
    • > /wp-content/plugins/hide-my-wp/controllers/Overview.php
    • > /wp-content/plugins/hide-my-wp/models/compatibility/Breeze.php
    • > /wp-content/plugins/hide-my-wp/classes/Tools.php
    • > /wp-content/plugins/hide-my-wp/controllers/Connect.php
    • > /wp-content/plugins/hide-my-wp/models/compatibility/FlyingPress.php
    • > /wp-content/plugins/hide-my-wp/models/compatibility/JsOptimize.php
    • > /wp-content/plugins/hide-my-wp/controllers/SecurityCheck.php
  • 1× GET requests to PHP files trigger server-side errors or Error 500 responses:
    • > PHP Fatal error
      Uncaught Error: Call to undefined function esc_html__() in wp-content/plugins/hide-my-wp/view/blocks/Upgrade.php:5

User-side errors Passed 1 test

🔹 Test weight: 20 | A shallow check that no browser errors were triggered
Everything seems fine, but this is not an exhaustive test

Optimizations

Plugin configuration 93% from 29 tests

readme.txt Passed 16 tests

Perhaps the most important file in your plugin readme.txt gets parsed in order to generate the public listing of your plugin
9 plugin tags: security, hide, hide wordpress, wp-login, firewall...

hide-my-wp/index.php 85% from 13 tests

The main PHP script in "Hide My WP Ghost - Security Plugin" version 5.0.27 is automatically included on every request by WordPress
You should first fix the following items:
  • Main file name: Name the main plugin file the same as the plugin slug ("hide-my-wp.php" instead of "index.php")
  • Description: Please keep the plugin description shorter than 140 characters (currently 148 characters long)

Code Analysis Passed 3 tests

File types Passed 1 test

🔸 Test weight: 35 | A short review of files and their extensions; it is not recommended to include executable files
Success! There were no dangerous files found in this plugin54,725 lines of code in 144 files:
LanguageFilesBlank linesComment linesLines of code
PO File1110,10812,49128,523
PHP913,5614,76514,986
CSS251,2631416,746
SVG4002,712
JavaScript132491161,758

PHP code Passed 2 tests

A short review of cyclomatic complexity and code structure
There were no cyclomatic complexity issued detected
Cyclomatic complexity
Average complexity per logical line of code0.67
Average class complexity39.40
▷ Minimum class complexity1.00
▷ Maximum class complexity493.00
Average method complexity6.03
▷ Minimum method complexity1.00
▷ Maximum method complexity68.00
Code structure
Namespaces0
Interfaces0
Traits0
Classes67
▷ Abstract classes11.49%
▷ Concrete classes6698.51%
▷ Final classes00.00%
Methods490
▷ Static methods8417.14%
▷ Public methods47797.35%
▷ Protected methods61.22%
▷ Private methods71.43%
Functions43
▷ Named functions00.00%
▷ Anonymous functions43100.00%
Constants52
▷ Global constants52100.00%
▷ Class constants00.00%
▷ Public constants00.00%

Plugin size Passed 2 tests

Image compression Passed 2 tests

Often times overlooked, PNG files can occupy unnecessary space in your plugin
14 PNG files occupy 0.37MB with 0.10MB in potential savings
Potential savings
Compression of 5 random PNG files using pngquant
FileSize - originalSize - compressedSavings
view/wplogin/images/w-logo-white.png5.27KB5.29KB0.00%
view/assets/img/pro_offer.png97.47KB35.61KB▼ 63.47%
view/assets/img/speedometer_high.png20.45KB21.54KB0.00%
view/assets/img/monitor_panel.png7.74KB5.18KB▼ 33.07%
view/assets/img/security_check.png23.70KB13.61KB▼ 42.58%