83% malcare-security

Code Review | MalCare WordPress Security Plugin - Malware Scanner, Cleaner, Security Firewall

WordPress plugin MalCare WordPress Security Plugin - Malware Scanner, Cleaner, Security Firewall scored83%from 54 tests.

About plugin

  • Plugin page: malcare-security
  • Plugin version: 5.42
  • PHP compatiblity: 5.6.0+
  • PHP version: 7.4.16
  • WordPress compatibility: 4.0-6.4
  • WordPress version: 6.3.1
  • First release: Jan 30, 2018
  • Latest release: Dec 1, 2023
  • Number of updates: 125
  • Update frequency: every 17.1 days
  • Top authors: ritesh.soni36 (74.4%)rrv4813 (14.4%)akshatc (8%)malcare (4.8%)singhsivam (1.6%)

Code review

54 tests

User reviews

309 reviews

Install metrics

400,000+ active /8,335,684 total downloads

Benchmarks

Plugin footprint 83% from 16 tests

Installer Passed 1 test

🔺 Critical test (weight: 50) | It is important to correctly install your plugin, without throwing errors or notices
The plugin installed successfully, without throwing any errors or notices

Server metrics [RAM: ▲0.07MB] [CPU: ▼3.72ms] Passed 4 tests

This is a short check of server-side resources used by MalCare WordPress Security Plugin - Malware Scanner, Cleaner, Security Firewall
Normal server usage
PageMemory (MB)CPU Time (ms)
Home /3.57 ▲0.1144.26 ▼1.72
Dashboard /wp-admin3.41 ▲0.1150.07 ▼0.98
Posts /wp-admin/edit.php3.46 ▲0.1051.31 ▲1.29
Add New Post /wp-admin/post-new.php5.93 ▲0.0489.13 ▼13.46
Media Library /wp-admin/upload.php3.27 ▲0.0438.62 ▲1.86
Malcare /wp-admin/admin.php?page=bv_account_details3.2733.70
Malcare /wp-admin/admin.php?page=bv_add_account3.2737.80

Server storage [IO: ▲0.79MB] [DB: ▲0.00MB] Passed 3 tests

How much does this plugin use your filesystem and database?
No storage issues were detected
Filesystem: 90 new files
Database: no new tables, 6 new options
New WordPress options
theysaidso_admin_options
db_upgraded
widget_recent-posts
widget_recent-comments
can_compress_scripts
widget_theysaidso_widget

Browser metrics Passed 4 tests

MalCare WordPress Security Plugin - Malware Scanner, Cleaner, Security Firewall: an overview of browser usage
This plugin renders optimally with no browser resource issues detected
PageNodesMemory (MB)Script (ms)Layout (ms)
Home /2,838 ▲7614.33 ▼0.011.74 ▼0.0539.58 ▼3.60
Dashboard /wp-admin2,228 ▲545.56 ▼0.0999.48 ▲1.2086.10 ▲43.19
Posts /wp-admin/edit.php2,145 ▲451.98 ▲0.0238.80 ▲0.0833.55 ▲0.06
Add New Post /wp-admin/post-new.php1,569 ▲4323.13 ▼0.22714.60 ▲95.2450.73 ▲1.73
Media Library /wp-admin/upload.php1,433 ▲334.16 ▼0.0797.38 ▲1.4971.97 ▲28.62
Malcare /wp-admin/admin.php?page=bv_account_details1,0802.0124.44107.79
Malcare /wp-admin/admin.php?page=bv_add_account1,2222.0025.0452.46

Uninstaller [IO: ▲0.00MB] [DB: ▲0.00MB] 75% from 4 tests

🔸 Tests weight: 35 | Verifying that this plugin uninstalls completely without leaving any traces
Please fix the following items
  • Zombie WordPress options were found after uninstall: 6 options
    • can_compress_scripts
    • widget_recent-comments
    • widget_theysaidso_widget
    • db_upgraded
    • widget_recent-posts
    • theysaidso_admin_options

Smoke tests 75% from 4 tests

Server-side errors Passed 1 test

🔹 Test weight: 20 | A shallow check that no server-side errors were triggered
Even though everything seems fine, this is not an exhaustive test

SRP 50% from 2 tests

🔹 Tests weight: 20 | SRP (Single-Responsibility Principle) - PHP files must act as libraries and never output text or perform any action when accessed directly in a browser
Please fix the following
  • 11× GET requests to PHP files have triggered server-side errors or warnings (only 10 are shown):
    • > PHP Fatal error
      Uncaught Error: Call to undefined function plugin_dir_path() in wp-content/plugins/malcare-security/maintenance/template.php:2
    • > PHP Fatal error
      Uncaught Error: Call to undefined function esc_html() in wp-content/plugins/malcare-security/admin/components/footer.php:8
    • > PHP Fatal error
      Uncaught Error: Call to undefined function plugins_url() in wp-content/plugins/malcare-security/admin/components/header_top.php:4
    • > PHP Fatal error
      Uncaught Error: Call to undefined function esc_url() in wp-content/plugins/malcare-security/admin/dashboard.php:2
    • > PHP Fatal error
      Uncaught Error: Class 'MCAccount' not found in wp-content/plugins/malcare-security/admin/components/list_accounts.php:2
    • > PHP Fatal error
      Uncaught Error: Call to undefined function esc_url() in wp-content/plugins/malcare-security/admin/components/form.php:9
    • > PHP Fatal error
      Uncaught Error: Call to undefined function esc_url() in wp-content/plugins/malcare-security/admin/components/mc_testimony.php:3
    • > PHP Fatal error
      Uncaught Error: Call to undefined function plugins_url() in wp-content/plugins/malcare-security/admin/components/features_list.php:4
    • > PHP Fatal error
      Uncaught Error: Call to undefined function plugins_url() in wp-content/plugins/malcare-security/admin/components/header_top.php:4
    • > PHP Fatal error
      Uncaught Error: Call to undefined function plugins_url() in wp-content/plugins/malcare-security/admin/components/header_top.php:4

User-side errors Passed 1 test

🔹 Test weight: 20 | This is a smoke test targeting browser errors/issues
Everything seems fine on the user side

Optimizations

Plugin configuration 90% from 29 tests

readme.txt 94% from 16 tests

You should put a lot of thought into formatting readme.txt as it is used by WordPress.org to prepare the public listing of your plugin
Attributes that need to be fixed:
  • License uri: Please fix this invalid url: "[http://www.gnu.org/licenses/gpl-2.0.html](http://www.gnu.org/licenses/gpl-2.0.html)"
The official readme.txt is a good inspiration

malcare-security/malcare.php 85% from 13 tests

Analyzing the main PHP file in "MalCare WordPress Security Plugin - Malware Scanner, Cleaner, Security Firewall" version 5.42
Please make the necessary changes and fix the following:
  • Main file name: It is recommended to name the main PHP file as the plugin slug ("malcare-security.php" instead of "malcare.php")
  • Plugin Name: Please don't use more than 70 characters for the plugin name (currently 79 characters long)

Code Analysis Passed 3 tests

File types Passed 1 test

🔸 Test weight: 35 | This is a short overview of programming languages used in this plugin, detecting executable files
Everything looks great! No dangerous files found in this plugin11,056 lines of code in 73 files:
LanguageFilesBlank linesComment linesLines of code
PHP691,81411810,955
SVG20199
CSS2062

PHP code Passed 2 tests

Analyzing cyclomatic complexity and code structure
Although this was not an exhaustive test, there were no cyclomatic complexity issues detected
Cyclomatic complexity
Average complexity per logical line of code0.38
Average class complexity32.30
▷ Minimum class complexity1.00
▷ Maximum class complexity248.00
Average method complexity3.15
▷ Minimum method complexity1.00
▷ Maximum method complexity54.00
Code structure
Namespaces0
Interfaces0
Traits5
Classes51
▷ Abstract classes00.00%
▷ Concrete classes51100.00%
▷ Final classes00.00%
Methods815
▷ Static methods769.33%
▷ Public methods60874.60%
▷ Protected methods00.00%
▷ Private methods20725.40%
Functions0
▷ Named functions00.00%
▷ Anonymous functions00.00%
Constants123
▷ Global constants32.44%
▷ Class constants12097.56%
▷ Public constants120100.00%

Plugin size Passed 2 tests

Image compression Passed 2 tests

Using a strong compression for your PNG files is a great way to speed-up your plugin
10 PNG files occupy 0.07MB with 0.03MB in potential savings
Potential savings
Compression of 5 random PNG files using pngquant
FileSize - originalSize - compressedSavings
img/astra.png4.31KB2.53KB▼ 41.33%
img/play-video.png0.81KB0.50KB▼ 38.25%
img/mc-features-list.png29.50KB11.51KB▼ 61.00%
img/cw_icon.png0.29KB0.35KB0.00%
img/malcare-wordpress-security.png15.65KB1.55KB▼ 90.08%