90% host-header-injection-fix

Code Review | Host Header Injection Fix

WordPress plugin Host Header Injection Fix scored90%from 54 tests.

About plugin

  • Plugin page: host-header-injec...
  • Plugin version: 2.9
  • PHP compatiblity: 5.6.20+
  • PHP version: 7.4.16
  • WordPress compatibility: 4.6-6.4
  • WordPress version: 6.3.1
  • First release: Nov 6, 2017
  • Latest release: Oct 25, 2023
  • Number of updates: 23
  • Update frequency: every 94.7 days
  • Top authors: specialk (100%)

Code review

54 tests

User reviews

6 reviews

Install metrics

800+ active /17,795 total downloads

Benchmarks

Plugin footprint 83% from 16 tests

Installer Passed 1 test

🔺 Critical test (weight: 50) | It is important to correctly install your plugin, without throwing errors or notices
The plugin installed successfully, without throwing any errors or notices

Server metrics [RAM: ▲0.03MB] [CPU: ▼5.71ms] Passed 4 tests

Analyzing server-side resources used by Host Header Injection Fix
This plugin has minimal impact on server resources
PageMemory (MB)CPU Time (ms)
Home /3.49 ▲0.0334.49 ▼7.87
Dashboard /wp-admin3.34 ▲0.0344.06 ▼1.35
Posts /wp-admin/edit.php3.45 ▲0.0944.28 ▼2.45
Add New Post /wp-admin/post-new.php5.92 ▲0.0381.14 ▼11.16
Media Library /wp-admin/upload.php3.26 ▲0.0333.67 ▲1.27
HHIF /wp-admin/options-general.php?page=hhif3.2530.71

Server storage [IO: ▲0.05MB] [DB: ▲0.07MB] Passed 3 tests

Filesystem and database footprint
This plugin was installed successfully
Filesystem: 6 new files
Database: no new tables, 6 new options
New WordPress options
widget_recent-posts
db_upgraded
widget_theysaidso_widget
theysaidso_admin_options
widget_recent-comments
can_compress_scripts

Browser metrics Passed 4 tests

Checking browser requirements for Host Header Injection Fix
There were no issues detected in relation to browser resource usage
PageNodesMemory (MB)Script (ms)Layout (ms)
Home /2,818 ▲5714.38 ▲0.012.07 ▲0.3540.45 ▼0.84
Dashboard /wp-admin2,196 ▲165.53 ▼0.1482.81 ▼3.4238.09 ▼3.47
Posts /wp-admin/edit.php2,104 ▲42.01 ▼0.0132.29 ▼7.9332.79 ▼5.44
Add New Post /wp-admin/post-new.php1,531 ▲523.26 ▲0.35685.75 ▲22.5456.45 ▼5.08
Media Library /wp-admin/upload.php1,407 ▲104.15 ▼0.00107.37 ▲5.5848.32 ▲4.13
HHIF /wp-admin/options-general.php?page=hhif8712.0526.3334.72

Uninstaller [IO: ▲0.00MB] [DB: ▲0.07MB] 75% from 4 tests

🔸 Tests weight: 35 | It is important to correctly uninstall your plugin, without leaving any traces
You still need to fix the following
  • The uninstall procedure has failed, leaving 6 options in the database
    • widget_recent-comments
    • can_compress_scripts
    • widget_theysaidso_widget
    • theysaidso_admin_options
    • db_upgraded
    • widget_recent-posts

Smoke tests Passed 4 tests

Server-side errors Passed 1 test

🔹 Test weight: 20 | This is a short smoke test looking for server-side errors
Even though no errors were found, this is by no means an exhaustive test

SRP Passed 2 tests

🔹 Tests weight: 20 | The single-responsibility principle applies for WordPress plugins as well - please make sure your PHP files perform no actions when accessed directly
No output text or server-side errors detected on direct access of PHP files

User-side errors Passed 1 test

🔹 Test weight: 20 | This is a shallow check for browser errors
Everything seems fine, but this is not an exhaustive test

Optimizations

Plugin configuration Passed 29 tests

readme.txt Passed 16 tests

Perhaps the most important file in your plugin readme.txt gets parsed in order to generate the public listing of your plugin
8 plugin tags: notification, injection, security, patch, email...

host-header-injection-fix/host-header-injection-fix.php Passed 13 tests

The main PHP script in "Host Header Injection Fix" version 2.9 is automatically included on every request by WordPress
102 characters long description:
Sets custom headers for WP notification emails. Also fixes a security issue with WP versions < 5.5.

Code Analysis Passed 3 tests

File types Passed 1 test

🔸 Test weight: 35 | This is an overview of programming languages used in this plugin; dangerous file extensions are not allowed
Everything looks great! No dangerous files found in this plugin278 lines of code in 3 files:
LanguageFilesBlank linesComment linesLines of code
PHP219631259
JavaScript16019

PHP code Passed 2 tests

An overview of cyclomatic complexity and code structure
Everything seems fine, there were no complexity issues found
Cyclomatic complexity
Average complexity per logical line of code0.42
Average class complexity62.00
▷ Minimum class complexity62.00
▷ Maximum class complexity62.00
Average method complexity3.26
▷ Minimum method complexity1.00
▷ Maximum method complexity10.00
Code structure
Namespaces0
Interfaces0
Traits0
Classes1
▷ Abstract classes00.00%
▷ Concrete classes1100.00%
▷ Final classes00.00%
Methods27
▷ Static methods00.00%
▷ Public methods27100.00%
▷ Protected methods00.00%
▷ Private methods00.00%
Functions1
▷ Named functions1100.00%
▷ Anonymous functions00.00%
Constants9
▷ Global constants9100.00%
▷ Class constants00.00%
▷ Public constants00.00%

Plugin size Passed 2 tests

Image compression Passed 2 tests

All PNG images should be compressed to minimize bandwidth usage for end users
There were not PNG files found in your plugin