73% wp-simple-firewall

Code Review | Shield Security - Smart Bot Blocking & Intrusion Prevention Security

WordPress plugin Shield Security - Smart Bot Blocking & Intrusion Prevention Security scored73%from 54 tests.

About plugin

  • Plugin page: wp-simple-firewall
  • Plugin version: 18.5.7
  • PHP compatiblity: 7.2.5+
  • PHP version: 7.4.16
  • WordPress compatibility: 5.7-6.4
  • WordPress version: 6.3.1
  • First release: Jul 9, 2013
  • Latest release: Nov 23, 2023
  • Number of updates: 2,006
  • Update frequency: every 1.9 days
  • Top authors: paultgoodchild (100%)

Code review

54 tests

User reviews

1017 reviews

Install metrics

50,000+ active /11,572,750 total downloads

Benchmarks

Plugin footprint 65% from 16 tests

Installer Passed 1 test

🔺 Critical test (weight: 50) | All plugins must install correctly, without throwing any errors, warnings, or notices
This plugin's installer ran successfully

Server metrics [RAM: ▲4.93MB] [CPU: ▲73.92ms] Passed 4 tests

An overview of server-side resources used by Shield Security - Smart Bot Blocking & Intrusion Prevention Security
This plugin does not affect your website's performance
PageMemory (MB)CPU Time (ms)
Home /7.71 ▲4.24126.05 ▲85.96
Dashboard /wp-admin8.48 ▲5.13121.15 ▲61.12
Posts /wp-admin/edit.php8.52 ▲5.17118.42 ▲71.22
Add New Post /wp-admin/post-new.php11.17 ▲5.28163.69 ▲77.36
Media Library /wp-admin/upload.php8.40 ▲5.17137.43 ▲103.88

Server storage [IO: ▲18.89MB] [DB: ▲0.35MB] 67% from 3 tests

Input-output and database impact of this plugin
Please try to fix the following items
  • You have illegally modified 6 files (0.29KB) outside of "wp-content/plugins/wp-simple-firewall/" and "wp-content/uploads/"
    • (new file) wp-content/shield/logs-656195728f897405710042/.empty
    • (new file) wp-content/shield/.htaccess
    • (new file) wp-content/shield/index.php
    • (new file) wp-content/shield/README.txt
    • (new file) wp-content/shield/assessed.flag
    • (new file) wp-content/shield/ptguard-oFGAEPPrBCOeVOgk/.empty
Filesystem: 4,414 new files
Database: 19 new tables, 16 new options
New tables
wp_icwp_wpsf_ip_rules
wp_icwp_wpsf_crowdsec_signals
wp_icwp_wpsf_resultitem_meta
wp_icwp_wpsf_user_meta
wp_icwp_wpsf_snapshots
wp_icwp_wpsf_ips
wp_icwp_wpsf_event
wp_icwp_wpsf_req_logs
wp_icwp_wpsf_reports
wp_icwp_wpsf_botsignal
...
New WordPress options
widget_theysaidso_widget
db_upgraded
icwp_wpsf_ip_rules_cache
aptoweb_controller_c5bfaa
icwp_wpsf_install_date
apto-dbs-ready-status
theysaidso_admin_options
aptoweb_can_trans_confirmed
widget_recent-posts
can_compress_scripts
...

Browser metrics Passed 4 tests

A check of browser resources used by Shield Security - Smart Bot Blocking & Intrusion Prevention Security
Normal browser usage
PageNodesMemory (MB)Script (ms)Layout (ms)
Home /3,678 ▲91615.78 ▲1.1432.21 ▲30.5751.03 ▲7.80
Dashboard /wp-admin2,290 ▲1095.97 ▲0.22108.22 ▼0.72100.19 ▲56.14
Posts /wp-admin/edit.php2,168 ▲682.48 ▲0.5354.83 ▲14.1534.45 ▼0.54
Add New Post /wp-admin/post-new.php1,727 ▲20120.15 ▼2.83799.21 ▲112.5136.87 ▼21.97
Media Library /wp-admin/upload.php1,462 ▲624.51 ▲0.29123.91 ▲25.7181.62 ▲37.57

Uninstaller [IO: ▲0.01MB] [DB: ▲0.34MB] 50% from 4 tests

🔸 Tests weight: 35 | Checking the uninstaller removed all traces of the plugin
Please fix the following items
  • The uninstall procedure failed, leaving 16 tables in the database
    • wp_icwp_wpsf_scans
    • wp_icwp_wpsf_mfa
    • wp_icwp_wpsf_reports
    • wp_icwp_wpsf_crowdsec_signals
    • wp_icwp_wpsf_at_logs
    • wp_icwp_wpsf_botsignal
    • wp_icwp_wpsf_resultitem_meta
    • wp_icwp_wpsf_req_logs
    • wp_icwp_wpsf_ips
    • wp_icwp_wpsf_resultitems
    • ...
  • Zombie WordPress options were found after uninstall: 16 options
    • icwp_wpsf_install_date
    • theysaidso_admin_options
    • widget_recent-comments
    • db_upgraded
    • can_compress_scripts
    • aptoweb_can_trans_confirmed
    • icwp_wpsf_ip_rules_cache
    • widget_icwp_wpsf_plugin_badge
    • aptoweb_controller_c5bfaa
    • widget_recent-posts
    • ...

Smoke tests 75% from 4 tests

Server-side errors Passed 1 test

🔹 Test weight: 20 | This is a shallow check for server-side errors
Good news, no errors were detected

SRP 50% from 2 tests

🔹 Tests weight: 20 | The single-responsibility principle applies for WordPress plugins as well - please make sure your PHP files perform no actions when accessed directly
Almost there! Just fix the following items
  • 2218× PHP files trigger server-side errors or warnings when accessed directly (only 10 are shown):
    • > PHP Fatal error
      Uncaught Error: Class 'Twig\ode\\Expression\\TestExpression' not found in wp-content/plugins/wp-simple-firewall/src/lib/vendor/twig/twig/src/Node/Expression/Test/NullTest.php:24
    • > PHP Fatal error
      Uncaught Error: Class 'FernleafSystems\\Wordpress\\Plugin\\Core\\Databases\\Base\\Select' not found in wp-content/plugins/wp-simple-firewall/src/lib/src/Modules/Data/DB/IPs/Ops/Select.php:8
    • > PHP Fatal error
      Uncaught Error: Interface 'Psr\\Http\\Message\\ServerRequestInterface' not found in wp-content/plugins/wp-simple-firewall/src/lib/vendor/nyholm/psr7/src/ServerRequest.php:16
    • > PHP Fatal error
      Trait 'FernleafSystems\\Utilities\\Logic\\ExecOnce' not found in wp-content/plugins/wp-simple-firewall/src/lib/src/Modules/UserManagement/Lib/Password/UserPasswordHandler.php on line 17
    • > PHP Fatal error
      Uncaught Error: Class 'FernleafSystems\\Wordpress\\Services\\Utilities\\Integrations\\WpHashes\\ApiBase' not found in wp-content/plugins/wp-simple-firewall/src/lib/vendor/fernleafsystems/wordpress-services/src/Utilities/Integrations/WpHashes/CrowdSourcedHashes/Base.php:5
    • > PHP Fatal error
      Uncaught Error: Class 'FernleafSystems\\Wordpress\\Plugin\\Core\\Databases\\Base\\Select' not found in wp-content/plugins/wp-simple-firewall/src/lib/src/Modules/HackGuard/DB/ScanItems/Ops/Select.php:7
    • > PHP Fatal error
      Trait 'Carbon\\Traits\\Mixin' not found in wp-content/plugins/wp-simple-firewall/src/lib/vendor/nesbot/carbon/src/Carbon/Traits/Macro.php on line 19
    • > PHP Fatal error
      Uncaught Error: Class 'FernleafSystems\\Wordpress\\Plugin\\Shield\\Modules\\Base\\Strings' not found in wp-content/plugins/wp-simple-firewall/src/lib/src/Modules/Traffic/Strings.php:9
    • > PHP Fatal error
      Uncaught Error: Class 'Twig\ode\\Expression\\Binary\\AbstractBinary' not found in wp-content/plugins/wp-simple-firewall/src/lib/vendor/twig/twig/src/Node/Expression/Binary/MulBinary.php:17
    • > PHP Fatal error
      Uncaught Error: Class 'Symfony\\Component\\Process\\Exception\\RuntimeException' not found in wp-content/plugins/wp-simple-firewall/src/lib/vendor/symfony/process/Exception/ProcessTimedOutException.php:21

User-side errors Passed 1 test

🔹 Test weight: 20 | This is a shallow check for browser errors
No browser issues were found

Optimizations

Plugin configuration 96% from 29 tests

readme.txt Passed 16 tests

Perhaps the most important file in your plugin readme.txt gets parsed in order to generate the public listing of your plugin
5 plugin tags: activity log, two-factor authentication, intrusion prevention, login protection, security

wp-simple-firewall/icwp-wpsf.php 92% from 13 tests

The principal PHP file in "Shield Security - Smart Bot Blocking & Intrusion Prevention Security" v. 18.5.7 is loaded by WordPress automatically on each request
Please take the time to fix the following:
  • Main file name: Even though not officially enforced, the main plugin file should be the same as the plugin slug ("wp-simple-firewall.php" instead of "icwp-wpsf.php")

Code Analysis 97% from 3 tests

File types Passed 1 test

🔸 Test weight: 35 | A short glimpse at programming languages used with this plugin and a check that no dangerous files are present
Good job! No executable or dangerous file extensions detected228,045 lines of code in 4,089 files:
LanguageFilesBlank linesComment linesLines of code
PHP3,75138,17895,390196,781
JSON280014,849
PO File12,8243,6896,812
Twig203715896,449
XSD392482,803
SVG8500312
HTML10010
JavaScript100610
Markdown16010
CSS61359

PHP code 50% from 2 tests

Analyzing cyclomatic complexity and code structure
Please tend to the following items
  • Cyclomatic complexity of methods has to be reduced to less than 100 (currently 140)
Cyclomatic complexity
Average complexity per logical line of code0.38
Average class complexity6.67
▷ Minimum class complexity1.00
▷ Maximum class complexity351.00
Average method complexity2.38
▷ Minimum method complexity1.00
▷ Maximum method complexity140.00
Code structure
Namespaces539
Interfaces140
Traits123
Classes2,720
▷ Abstract classes2097.68%
▷ Concrete classes2,51192.32%
▷ Final classes1144.54%
Methods12,596
▷ Static methods1,32910.55%
▷ Public methods8,90070.66%
▷ Protected methods2,59720.62%
▷ Private methods1,0998.72%
Functions2,259
▷ Named functions1,35359.89%
▷ Anonymous functions90640.11%
Constants2,004
▷ Global constants221.10%
▷ Class constants1,98298.90%
▷ Public constants1,84392.99%

Plugin size 50% from 2 tests

Image compression 50% from 2 tests

It is recommended to compress PNG files in your plugin to minimize bandwidth usage
32 PNG files occupy 0.65MB with 0.24MB in potential savings
Potential savings
Compression of 5 random PNG files using pngquant
FileSize - originalSize - compressedSavings
assets/images/banner-1500x500-transparent.png22.82KB11.12KB▼ 51.26%
assets/images/pluginlogo_128x128.png3.37KB2.71KB▼ 19.77%
assets/images/shield/shield-security-logo-colour-32px.png0.86KB1.06KB0.00%
assets/images/shield/banner-2FA.png23.64KB11.19KB▼ 52.66%
assets/images/wizard/general-shield_help.png61.92KB22.75KB▼ 63.26%