Qaiyo Access Manager

Security Report Card

Readiness

PHP Compatibility

Categories with Findings

Positive Observations

• Consistent nonce verification on all AJAX handlers.
• Every AJAX handler checks `current_user_can('manage_options')` before processing.
• Input is sanitized systematically using allowlists (plugin files, post type slugs, role slugs) and `absint()` for user IDs.
• Output is escaped with `esc_html`, `esc_attr`, `esc_url`, `esc_textarea`, and `wp_kses_post` as appropriate.
• No raw SQL queries; all data stored via WordPress Options API.
• Shortcode attributes are sanitized with `sanitize_key` and `shortcode_atts`.
• Proper use of WordPress nonces for CSRF protection on import/export and settings save.
• Transient caching for remote ecosystem feed (24h) with fallback to hardcoded list.
• Comprehensive capability mapping for custom post types with proper bounds checking.
• All dynamic output in PHP is properly escaped using esc_html(), esc_attr(), esc_url(), and wp_json_encode() + esc_attr() for data attributes.
• Nonce verification is implemented in the settings form (wpam_save_access_nonce) and in every AJAX call (wpam_data.nonce, wpam_data.user_nonce, wpam_data.tools_nonce).
• Capability checks (current_user_can('manage_options')) protect dashboard widget rendering and settings page access.
• The render_settings_page() method uses sanitize_key() on GET parameters and validates against a whitelist of allowed tab slugs.
• User cache is primed in a single query to avoid N+1 performance problems when rendering user override rows.
• The import/export tools use nonce-protected AJAX and client-side JSON validation before sending data.
• The plugin uses a well-structured object-oriented architecture with traits for cross-cutting concerns.
• Backward compatibility for legacy role rule format (plain array) is handled via normalize_role_rule().
• Admin asset enqueuing is correctly scoped to relevant screens with filemtime-based cache busting.
• All AJAX handlers include proper nonce verification and capability checks.
• Sanitization of input data is thorough, with allowlist-based validation for roles and plugin files.
• The brand menu separator is idempotent and handles conflicts gracefully.
• The plugin provides a comprehensive shortcode for content protection with multiple access gates.
• Update permissions are granted dynamically via user_has_cap filter, avoiding permanent capability changes.
• The export/import feature is well-implemented with validation and sanitization.
• Consistent use of text domain 'qaiyo-access-manager' across all translation functions.
• Uninstall handler respects user choice via an option flag, avoiding accidental data loss.
• Proper capability checks with `current_user_can('manage_options')` on all admin-facing pages.
• Nonce verification on all AJAX actions (save, import, export, user search).
• User cache priming in `prime_override_user_cache()` to avoid N+1 user queries on the settings page.
• Use of traits to separate rendering logic, improving code organization.
• Escaping of all dynamic output: `esc_html`, `esc_attr`, `esc_url`, `wp_json_encode`.
• Dashboard widget provides useful statistics and a direct link to manage rules.
• Most form controls in the Options tab have explicit `<label>` associations (notice type, notice message, redirect type, custom URL).
• Plugin uses proper heading hierarchy (`<h1>`, `<h2>`, `<h3>`, `<h4>`) throughout admin pages.
• Images in the ecosystem page have `alt=""` (decorative) with the plugin name already present as text.
• SVG icons in the Pro teaser have `aria-hidden="true"` to prevent announcement.
• WordPress admin notice classes are used for the restricted access message, ensuring consistent styling and accessibility.
• Shortcode protection allows custom message and uses `wp_kses_post` for output.
• Toggle buttons use aria-expanded correctly to indicate card state.
• Role-based access mode toggle uses role="radiogroup" and aria-label for group labeling.
• Role checkboxes are properly associated with labels via wrapping <label> elements.
• Export function uses a standard button element, keyboard accessible.
• Import file label is correctly associated with the file input via the for attribute.
• Options are cached per-request using private property `$option_cache` and static `$cache` variables, avoiding repeated `get_option()` calls.
• User cache is primed before rendering the admin page via `cache_users()`, preventing N+1 queries for user data.
• Admin assets (CSS/JS) are enqueued only on the relevant admin pages using conditional checks (`$hook`), reducing unnecessary HTTP requests.
• The ecosystem feed uses transients with proper cache invalidation (delete on refresh).
• Shortcodes are registered on `init` hook as per best practices.
• Database queries are kept minimal; the plugin primarily uses `get_option()` and avoids raw `$wpdb` queries.