Oiko Sessions

v0.1.1WordPress PluginAudited Today

HIGH

WP.org

Total Findings

Security Grade

Coding Score

100/100

Security Findings

Critical0

High3

Medium22

Low10

Info4

Executive Summary

Oiko Sessions is a well-structured WordPress plugin that provides force-logout, online presence tracking, and login lockdown capabilities. The codebase demonstrates a strong security posture with consistent use of nonce verification, capability checks, input sanitization, and output escaping. All database queries use $wpdb->prepare with typed placeholders, and the plugin avoids N+1 query patterns through batch caching. The plugin is designed for high-traffic sites and handles bulk operations efficiently without loading unbounded user objects into memory. No critical or high-severity vulnerabilities were identified.

Security Report Card

securityA

standardsA

qualityA

compatibilityA

OverallA

Readiness

Production Ready

Needs Work

WP.org Ready

Needs Changes

EAA Compliance

Needs Work

Coding Standards

100/100

PHP Compatibility

Requires PHP 8.0Declared minimum: 8.3

Categories with Findings

MultisiteAccessibilityDependency SecurityType SafetyWordPress CompatibilityInternationalizationsecurityTheme StandardsCoding StandardsData PrivacyPerformancePlugin ConflictscompatibilityError Handling

Positive Observations

All admin actions (logout user, logout all, logout role, lockdown toggle) implement nonce verification and capability checks before processing.
Settings form uses wp_nonce_field and the save handler verifies both capability and referrer nonce.
All database queries use $wpdb->prepare with %d and %s placeholders; no raw SQL injection vectors exist.
Input sanitization is centralized in a Sanitizer class, ensuring consistent unslashing and sanitization across the plugin.
Output is properly escaped with esc_html, esc_url, esc_attr, esc_textarea, and wp_kses functions.
Batch operations (force_logout_role, batch_status_for) use bounded queries and avoid loading large user sets into memory.
The table creation uses $wpdb->get_charset_collate() and dbDelta for proper schema management.
Uninstall.php cleans up all options and custom tables on plugin removal.
Deactivation removes the lockdown option to prevent accidental lockout of non-admin users.
The plugin declares a minimum PHP 8.3 and uses modern language features appropriately.
No extraneous AJAX endpoints or REST routes that could be abused.

Plugin Info

Audit Count: 1
Type: plugin

Embed

Show your audit status in your README or website.

[![Oiko Sessions security audit by WP HealthKit](https://wphealthkit.com/api/badge/by-slug/oiko-sessions)](https://wphealthkit.com/directory/oiko-sessions)

Paste this in your GitHub README or any Markdown file. The badge updates automatically on every re-audit — no need to refresh the snippet.

Are you the developer?

Claim this listing to get a Verified badge, control public audits, and get automatic re-scans.

Claim This Plugin

Audit Your Plugin

Get a comprehensive security audit for your WordPress plugin or theme. Upload your zip and get results in minutes.

Start Free Audit

Readiness

Production Ready

Needs Work

WP.org Ready

Needs Changes

EAA Compliance

Needs Work

Coding Standards

100/100

PHP Compatibility

Requires PHP 8.0Declared minimum: 8.3

Categories with Findings

Positive Observations

All admin actions (logout user, logout all, logout role, lockdown toggle) implement nonce verification and capability checks before processing.
Settings form uses wp_nonce_field and the save handler verifies both capability and referrer nonce.
All database queries use $wpdb->prepare with %d and %s placeholders; no raw SQL injection vectors exist.
Input sanitization is centralized in a Sanitizer class, ensuring consistent unslashing and sanitization across the plugin.
Output is properly escaped with esc_html, esc_url, esc_attr, esc_textarea, and wp_kses functions.
Batch operations (force_logout_role, batch_status_for) use bounded queries and avoid loading large user sets into memory.
The table creation uses $wpdb->get_charset_collate() and dbDelta for proper schema management.
Uninstall.php cleans up all options and custom tables on plugin removal.
Deactivation removes the lockdown option to prevent accidental lockout of non-admin users.
The plugin declares a minimum PHP 8.3 and uses modern language features appropriately.
No extraneous AJAX endpoints or REST routes that could be abused.

Code comments explain design decisions and trade-offs clearly.

Consistent use of modern PHP 8.3 features with proper type declarations and return types.

Centralized input sanitization via Sanitizer class, reducing risk of data-type mismatches.

Proper capability and nonce checks before every admin action.

Batch queries and per-request caching in Users_List avoid N+1 query patterns.

Per-request state cache is reset on shutdown, preventing stale data in persistent worker runtimes.

Activation and deactivation hooks are idempotent and do not delete user data on deactivation.

Uninstall.php cleans up all plugin-related data (options and custom table).

Lockdown feature gracefully handles the option missing or malformed via get_info() returning false.

i18n text domain is consistent and load_plugin_textdomain() is called early.

Error messages use wp_die() with proper response codes only where appropriate.

All admin settings form fields use proper <label> elements with for attributes.

Custom toggle switch maintains keyboard focus indicator via focus-visible outline.

Action buttons are native anchor elements, ensuring keyboard accessibility without custom scripting.

Online/offline status column includes text labels ('Online'/'Offline') in addition to color, so status is not conveyed by color alone.

No JavaScript dependency reduces risk of focus traps or inaccessible dynamic content.

Proper use of WordPress admin notice classes (notice, notice-error, notice-success, is-dismissible).

Batch queries for presence status and last login avoid N+1 pattern in users list.

Custom table for presence tracking replaces usermeta, improving query performance.

SQL-level throttling in heartbeat prevents frequent writes.

Batched paginated queries in role logout avoid memory exhaustion on large sites.

Per-request static caching of batch results reduces redundant queries.

Conditional enqueuing of admin CSS only on plugin's settings page.

No external HTTP calls or blocking file I/O in frontend hooks.

Plugin uses proper nonce verification and capability checks for admin actions.

Uninstall script properly cleans up all plugin data.