Qaiyo Web Performance Surgeon

v1.0.0WordPress PluginAudited Today

HIGH

WP.org

#9 Security

Total Findings

Security Grade

Coding Score

100/100

Security Findings

Critical0

High1

Medium16

Low7

Info1

Executive Summary

Free-tier AI cap reached. This report contains deterministic-scanner findings only. Upgrade to a paid tier for security / quality / accessibility AI engine analysis.

Security Report Card

Readiness

Coding Standards

100/100

PHP Compatibility

Requires PHP 8.0Declared minimum: 7.4Mismatch detected

Categories with Findings

Coding StandardsType SafetyWordPress CompatibilitysecurityPerformanceInternationalizationcompatibility

Plugin Info

Audit Count: 1
Type: plugin

Embed Audit Badge

Show your audit status in your README or website.

[![Qaiyo Web Performance Surgeon security audit by WP HealthKit](https://wphealthkit.com/api/badge/by-slug/qaiyo-web-performance-surgeon)](https://wphealthkit.com/directory/qaiyo-web-performance-surgeon)

Paste this in your GitHub README or any Markdown file. The badge updates automatically on every re-audit — no need to refresh the snippet.

Are you the developer?

Claim this listing to get a Verified badge, control public audits, and get automatic re-scans.

Claim This Plugin

Audit Your Plugin

Get a comprehensive security audit for your WordPress plugin or theme. Upload your zip and get results in minutes.

Start Free Audit

Readiness

Coding Standards

100/100

PHP Compatibility

Requires PHP 8.0Declared minimum: 7.4Mismatch detected

Categories with Findings

Coding StandardsType SafetyWordPress CompatibilitysecurityPerformanceInternationalizationcompatibility

Positive Observations

Assets are enqueued conditionally on the admin page hook
Browser collector JS only loaded during browser scans (query param check)
Scan results and auth tokens use transients with appropriate TTL
Direct database queries in fixes are limited to admin AJAX handlers
Rule engine catches exceptions so a misbehaving rule never breaks the report
Uninstall.php cleans up options and transients thoroughly
Mu-plugin loader only activates on tokened requests