Oiko Boost

v0.2.0WordPress PluginAudited Today

HIGH

WP.org

Total Findings

Security Grade

Coding Score

100/100

Security Findings

Critical0

High8

Medium28

Low13

Info2

Executive Summary

Oiko Boost is a well-engineered performance plugin that follows most WordPress security best practices including proper nonce verification, capability checks, and input sanitization through a centralized Sanitizer class. Two significant vulnerabilities were identified: a stored XSS vulnerability through the lazy-loading CSS background-image feature and an arbitrary file write risk in the Local Fonts module under a compromised CDN scenario. The codebase is modern, uses PHP 8.3 features appropriately, and shows a high level of craftsmanship.

Security Report Card

securityA

standardsA

qualityC

compatibilityA

OverallB

Readiness

Production Ready

Needs Work

WP.org Ready

Needs Changes

EAA Compliance

Needs Work

Coding Standards

100/100

PHP Compatibility

Requires PHP 8.1Declared minimum: 8.3

Categories with Findings

gdprPlugin LifecycleMultisiteData PrivacyAccessibilityPerformanceFile SecurityDependency SecurityType SafetyWordPress CompatibilityInternationalizationsecurityCoding StandardsTheme StandardscompatibilityError HandlingUpdate Safety

Positive Observations

Centralized Sanitizer class ensures consistent input handling across all form/request processing.
Proper nonce verification on all admin actions and REST endpoints using both check_admin_referer and X-WP-Nonce.
Capability checks (current_user_can('manage_options')) enforced on all administrative operations.
Output is properly escaped in admin screens using esc_html, esc_attr, esc_url.
REST endpoints use permission_callback with consistent authorization logic.
All SQL queries use $wpdb->prepare with typed placeholders, preventing SQL injection.
No direct $_POST/$_GET access without sanitization through the Sanitizer class.
Sensitive operations (database cleanup, font downloading) are opt-in and require explicit user action.
Plugin architecture separates concerns cleanly with self-registering modules.
Uninstall handler removes all plugin options from the database.
Modern PHP 8.3 features used appropriately with typed parameters and return types.
Asset enqueuing is scoped to relevant admin pages or frontend conditions, not globally loaded.

Plugin Info

Audit Count: 1
Type: plugin

Embed

Show your audit status in your README or website.

[![Oiko Boost security audit by WP HealthKit](https://wphealthkit.com/api/badge/by-slug/oiko-boost)](https://wphealthkit.com/directory/oiko-boost)

Paste this in your GitHub README or any Markdown file. The badge updates automatically on every re-audit — no need to refresh the snippet.

Are you the developer?

Claim this listing to get a Verified badge, control public audits, and get automatic re-scans.

Claim This Plugin

Audit Your Plugin

Get a comprehensive security audit for your WordPress plugin or theme. Upload your zip and get results in minutes.

Start Free Audit

Readiness

Production Ready

Needs Work

WP.org Ready

Needs Changes

EAA Compliance

Needs Work

Coding Standards

100/100

PHP Compatibility

Requires PHP 8.1Declared minimum: 8.3

Categories with Findings

Positive Observations

Centralized Sanitizer class ensures consistent input handling across all form/request processing.
Proper nonce verification on all admin actions and REST endpoints using both check_admin_referer and X-WP-Nonce.
Capability checks (current_user_can('manage_options')) enforced on all administrative operations.
Output is properly escaped in admin screens using esc_html, esc_attr, esc_url.
REST endpoints use permission_callback with consistent authorization logic.
All SQL queries use $wpdb->prepare with typed placeholders, preventing SQL injection.
No direct $_POST/$_GET access without sanitization through the Sanitizer class.
Sensitive operations (database cleanup, font downloading) are opt-in and require explicit user action.
Plugin architecture separates concerns cleanly with self-registering modules.
Uninstall handler removes all plugin options from the database.
Modern PHP 8.3 features used appropriately with typed parameters and return types.
Asset enqueuing is scoped to relevant admin pages or frontend conditions, not globally loaded.

Plugin uses a centralized Sanitizer class for all input sanitization, reducing security risk.

Admin bar detection panel defers registration to 'wp' hook to avoid calling is_admin_bar_showing() too early.

All front-end modules properly bail out in wp-admin to avoid corrupting admin scripts.

Settings page only saves the submitted tab's settings, preventing accidental overwriting of unsubmitted tabs.

Uninstall is kept separate from deactivation, ensuring user data is not deleted on deactivation.

Plugin uses version_compare to check PHP version and shows admin notice instead of fatally erroring.

All REST routes have permission callbacks that check manage_options capability.

Use of wp_parse_args with defaults throughout the codebase ensures consistent settings retrieval.

Settings page uses semantic HTML including <nav>, <h1>/<h2> headings, and proper landmarks.

Tab navigation uses aria-current="page" on the active tab.

Form controls are generally associated with <label> elements via for/id attributes (except resource hints textarea).

Custom toggle switches use native <input type="checkbox"> with accessible focus-visible outlines.

Dialog uses native <dialog> element with form method="dialog" for close, enabling Escape key handling.

View transitions CSS respects prefers-reduced-motion via @media query.

Inline scripts are minimal and do not interfere with assistive technology.

Admin notices use standard WordPress notice classes for visual consistency.

Transients are used effectively to cache CrUX API responses (Crux_Dashboard::fetch_metrics() uses get_transient/set_transient with DAY_IN_SECONDS).

Assets (scripts/styles) are enqueued conditionally and deferred; admin-only scripts are not loaded on frontend.

Output buffering in Lazy_Load is applied only when the CSS background feature is enabled and on frontend.

Bfcache_Audit uses a careful diff check to avoid unnecessary option writes.

The plugin avoids N+1 queries and uses efficient array operations.

REST routes have proper permission_callback checks.

Activation/Deactivation hooks run flush_rewrite_rules only once, not on every page load.