78% http-headers

Code Review | HTTP Headers

WordPress plugin HTTP Headers scored78%from 54 tests.

About plugin

  • Plugin page: http-headers
  • Plugin version: 1.19.1
  • PHP compatiblity: 5.3+
  • PHP version: 7.4.16
  • WordPress compatibility: 3.2-6.3.1
  • WordPress version: 6.3.1
  • First release: May 10, 2016
  • Latest release: Sep 2, 2023
  • Number of updates: 161
  • Update frequency: every 16.6 days
  • Top authors: zinoui (100%)

Code review

54 tests

User reviews

62 reviews

Install metrics

40,000+ active /553,143 total downloads

Benchmarks

Plugin footprint 82% from 16 tests

Installer Passed 1 test

🔺 Critical test (weight: 50) | All plugins must install correctly, without throwing any errors, warnings, or notices
This plugin's installer ran successfully

Server metrics [RAM: ▲0.37MB] [CPU: ▼6.22ms] Passed 4 tests

An overview of server-side resources used by HTTP Headers
Server-side resource usage in normal parameters
PageMemory (MB)CPU Time (ms)
Home /3.80 ▲0.3344.86 ▲2.05
Dashboard /wp-admin3.70 ▲0.3552.49 ▼15.43
Posts /wp-admin/edit.php3.81 ▲0.4554.10 ▲7.00
Add New Post /wp-admin/post-new.php6.29 ▲0.4095.14 ▼9.14
Media Library /wp-admin/upload.php3.64 ▲0.4137.87 ▼2.34
HTTP Headers /wp-admin/options-general.php?page=http-headers3.6536.49

Server storage [IO: ▲0.33MB] [DB: ▲0.01MB] 67% from 3 tests

Analyzing filesystem and database footprints of this plugin
Please try to fix the following items
  • Illegal file modification detected: 1 file (2.55KB) outside of "wp-content/plugins/http-headers/" and "wp-content/uploads/"
    • (modified) .htaccess
Filesystem: 67 new files
Database: no new tables, 115 new options
New WordPress options
hh_strict_transport_security
hh_expect_ct
hh_method
hh_feature_policy
hh_x_xxs_protection_value
hh_expect_ct_report_uri
hh_x_ua_compatible
hh_www_authenticate
hh_www_authenticate_user
hh_age_value
...

Browser metrics Passed 4 tests

HTTP Headers: an overview of browser usage
There were no issues detected in relation to browser resource usage
PageNodesMemory (MB)Script (ms)Layout (ms)
Home /2,800 ▲5414.21 ▲0.031.59 ▼0.4943.68 ▼0.85
Dashboard /wp-admin2,203 ▲235.67 ▲0.0090.64 ▲3.2444.76 ▲1.25
Posts /wp-admin/edit.php2,111 ▲112.03 ▲0.0539.75 ▲3.5935.67 ▼2.87
Add New Post /wp-admin/post-new.php1,536 ▲1023.19 ▲0.10614.87 ▼75.9359.76 ▲5.04
Media Library /wp-admin/upload.php1,408 ▲84.27 ▲0.0698.42 ▼16.7942.78 ▼4.28
HTTP Headers /wp-admin/options-general.php?page=http-headers9072.0624.8036.67

Uninstaller [IO: ▲0.00MB] [DB: ▲0.00MB] 75% from 4 tests

🔸 Tests weight: 35 | It is important to correctly uninstall your plugin, without leaving any traces
These items require your attention
  • The uninstall procedure has failed, leaving 6 options in the database
    • widget_recent-posts
    • widget_theysaidso_widget
    • can_compress_scripts
    • theysaidso_admin_options
    • db_upgraded
    • widget_recent-comments

Smoke tests 50% from 4 tests

Server-side errors Passed 1 test

🔹 Test weight: 20 | This is a short smoke test looking for server-side errors
The smoke test was a success, however most plugin functionality was not tested

SRP 0% from 2 tests

🔹 Tests weight: 20 | A shallow check of the single-responsibility principle; PHP files should perform no action - including output of placeholder text - and trigger no errors when accessed directly
Almost there! Just fix the following items
  • 5× PHP files output text when accessed directly:
    • > /wp-content/plugins/http-headers/views/includes/csp-src.inc.php
    • > /wp-content/plugins/http-headers/views/includes/csp-inc.inc.php
    • > /wp-content/plugins/http-headers/views/includes/csp-text.inc.php
    • > /wp-content/plugins/http-headers/views/includes/csp-sri.inc.php
    • > /wp-content/plugins/http-headers/views/includes/csp-sandbox.inc.php
  • 168× PHP files trigger server-side errors or warnings when accessed directly (only 10 are shown):
    • > PHP Notice
      Undefined variable: item in wp-content/plugins/http-headers/views/includes/csp-src.inc.php on line 25
    • > PHP Notice
      Undefined variable: item in wp-content/plugins/http-headers/views/includes/csp-src.inc.php on line 21
    • > PHP Notice
      Undefined variable: item in wp-content/plugins/http-headers/views/includes/csp-sri.inc.php on line 14
    • > PHP Notice
      Undefined variable: content_security_policy in wp-content/plugins/http-headers/views/includes/csp-sandbox.inc.php on line 24
    • > PHP Notice
      Undefined variable: item in wp-content/plugins/http-headers/views/includes/csp-sri.inc.php on line 13
    • > PHP Notice
      Undefined variable: item in wp-content/plugins/http-headers/views/includes/csp-src.inc.php on line 27
    • > PHP Notice
      Undefined variable: item in wp-content/plugins/http-headers/views/includes/csp-src.inc.php on line 21
    • > PHP Notice
      Undefined variable: content_security_policy in wp-content/plugins/http-headers/views/includes/csp-src.inc.php on line 26
    • > PHP Notice
      Undefined variable: content_security_policy in wp-content/plugins/http-headers/views/includes/csp-src.inc.php on line 26
    • > PHP Notice
      Undefined variable: item in wp-content/plugins/http-headers/views/includes/csp-sri.inc.php on line 13

User-side errors Passed 1 test

🔹 Test weight: 20 | Just a short smoke test targeting errors on the browser (console and network errors and warnings)
No browser issues were found

Optimizations

Plugin configuration 97% from 29 tests

readme.txt 94% from 16 tests

The readme.txt file is important because it is parsed by WordPress.org for the public listing of your plugin
Attributes that need to be fixed:
  • Tags: There are too many tags (22 tag instead of maximum 10)
The official readme.txt might help

http-headers/http-headers.php Passed 13 tests

The entry point to "HTTP Headers" version 1.19.1 is a PHP file that has certain tags in its header comment area
121 characters long description:
A plugin for HTTP headers management including security, access-control (CORS), caching, compression, and authentication.

Code Analysis Passed 3 tests

File types Passed 1 test

🔸 Test weight: 35 | A short glimpse at programming languages used with this plugin and a check that no dangerous files are present
Good job! No executable or dangerous file extensions detected6,116 lines of code in 62 files:
LanguageFilesBlank linesComment linesLines of code
PHP59243475,253
CSS190348
JavaScript1331284
PO File1110110231

PHP code Passed 2 tests

Cyclomatic complexity and code structure are the fingerprint of this plugin
Everything seems fine, there were no complexity issues found
Cyclomatic complexity
Average complexity per logical line of code0.44
Average class complexity0.00
▷ Minimum class complexity0.00
▷ Maximum class complexity0.00
Average method complexity0.00
▷ Minimum method complexity0.00
▷ Maximum method complexity0.00
Code structure
Namespaces0
Interfaces0
Traits0
Classes0
▷ Abstract classes00.00%
▷ Concrete classes00.00%
▷ Final classes00.00%
Methods0
▷ Static methods00.00%
▷ Public methods00.00%
▷ Protected methods00.00%
▷ Private methods00.00%
Functions73
▷ Named functions73100.00%
▷ Anonymous functions00.00%
Constants0
▷ Global constants00.00%
▷ Class constants00.00%
▷ Public constants00.00%

Plugin size Passed 2 tests

Image compression Passed 2 tests

It is recommended to compress PNG files in your plugin to minimize bandwidth usage
There were not PNG files found in your plugin