WP HealthKit Companion

Security Report Card

Readiness

PHP Compatibility

Categories with Findings

Positive Observations

• All four AJAX handlers verify nonces via check_ajax_referer() with matching action strings AND enforce current_user_can('manage_options').
• Plugin ZIP path is validated with realpath() containment against WP_PLUGIN_DIR before any file operation — no path traversal possible via plugin_file.
• Self-update package URL is restricted to HTTPS on wphealthkit.com or its subdomains before being handed to the WordPress upgrader.
• API-supplied plugin-info section HTML is sanitized with wp_kses_post() and section keys with sanitize_key() before being rendered in the unescaped details modal.
• No synchronous HTTP on any render path: update-transient filter and dashboard widget schedule async single-event priming and serve cached data only.
• Update-warning injection into the update transient has an idempotency marker ('[WP HealthKit') preventing duplicate appends on repeated transient reads.
• All template output is escaped contextually (esc_html, esc_attr, esc_url, esc_html_e) including the dashboard widget and grade badges.
• Debug logging is gated behind WP_DEBUG, redacts site IDs from endpoint paths, and is disabled in production.
• Settings use the Settings API with sanitize_callback; the site_id is validated against a strict UUID regex; token verification is deferred to background cron rather than blocking the save.
• Bulk audit and server-initiated audit uploads are staggered (15–30s increments) and deduplicated via wp_next_scheduled() with argument matching, preventing API bursts and duplicate jobs.
• Cron lifecycle is fully clean: activation schedules, deactivation clears all recurring AND single-event hooks.
• In-memory credentials cache is invalidated via update_option_*/add_option_* hooks, preventing stale-token use after disconnect or token rotation.
• ZIP upload prefers streaming via CURLFile to keep memory flat, with a documented memory-heavy fallback only for hosts without cURL, plus a 50MB cap and temp-file cleanup on all paths.
• The wphk_audit_jobs option is stored non-autoloaded and pruned when audit results land or after a one-hour staleness window.
• Activation hook correctly uses a static method (not the singleton constructor), preventing premature hook registration during the activation sandbox.
• Deactivation hook clears ALL registered cron hooks including single-event hooks (wphk_deferred_sync, wphk_run_plugin_audit, wphk_prime_caches, wphk_verify_token) — thorough cron cleanup.
• Version migration pattern is correctly implemented: add_option() on first install, update_option() on upgrade, with version_compare() guard.
• wp_add_privacy_policy_content() is implemented and correctly discloses data transmission to wphealthkit.com.
• All AJAX handlers use check_ajax_referer() and current_user_can('manage_options') — proper nonce + capability checks.
• API error logging is gated behind WP_DEBUG and redacts site IDs from endpoint paths — no PII in logs.
• Credentials are cached in-memory with invalidation hooks on update_option_wphk_site_token and update_option_wphk_site_id — avoids repeated DB reads.
• All admin output uses esc_html(), esc_attr(), esc_url() consistently — no XSS vectors found.
• Plugin ZIP upload validates the resolved path stays within WP_PLUGIN_DIR using realpath() — path traversal prevention.
• Self-update package URL is validated for HTTPS and trusted domain before being handed to the WordPress upgrader.
• API responses used in the plugin-details modal are sanitized with wp_kses_post() — prevents XSS from compromised API responses.
• Supply chain alerts and update warnings use async cache-priming (wphk_prime_caches cron) rather than synchronous HTTP on admin page loads — good performance practice.
• Plugin uses #[\AllowDynamicProperties] attribute on the main class — correct PHP 8.2 compatibility.
• WPHealthKit_Telemetry SDK is loaded with a class_exists() guard and file_exists() check — safe bundling pattern.
• All translatable strings use the correct 'wp-healthkit' text domain consistently throughout the file.
• The plugin correctly uses wp_json_encode() instead of json_encode() for API request bodies.
• ZipArchive path traversal is prevented by validating plugin_path starts with plugins_dir using realpath().
• The plugin correctly uses wp_tempnam() for temporary ZIP files and wp_delete_file() for cleanup — no temp file leaks.
• Rate-limit (429) handling in sync_inventory() schedules a retry via wphk_deferred_sync rather than silently failing.
• The grades transient is memoized per-request via $grades_memo to avoid repeated transient reads on the plugins.php page with many plugins.
• All interactive elements that trigger actions (Sync Now, Disconnect Site, Connect Site) use native <button> elements with explicit type='button' or submit, ensuring full keyboard accessibility without additional ARIA or keydown handlers.
• The settings page SVG logo correctly uses aria-hidden='true' and focusable='false', preventing it from being announced by screen readers or receiving focus in IE/Edge legacy modes.
• The site token input field has a properly associated <label for='wphk_site_token'>, aria-required='true', and aria-describedby pointing to the description paragraph — a complete and correct form labelling pattern.
• The 'required' asterisk on the token field uses aria-hidden='true' on the visual asterisk and a screen-reader-text span with '(required)' — the correct dual-channel pattern for communicating required fields.
• All external links (View Full Dashboard, View Full Report, audit report links) include target='_blank' rel='noopener noreferrer' and a screen-reader-text '(opens in new tab)' span — correct disclosure of link behaviour.
• The settings page is structured with <section aria-labelledby> regions and appropriate h2 headings, providing a clear document outline for screen reader navigation.
• The health score in the dashboard widget uses aria-label='Health score: N out of 100' on the score container, providing a complete accessible name that includes the scale context.
• The plugin grade badge uses aria-label='WP HealthKit audit grade: RISK_LEVEL' on the badge span, giving screen reader users the full grade context rather than just the raw risk word.
• The privacy policy content is registered via wp_add_privacy_policy_content(), ensuring the plugin's data practices are disclosed in the site's privacy policy page.
• Admin notices use standard WordPress notice classes (notice-success, notice-error, is-dismissible), ensuring compatibility with WordPress core's notice dismissal JavaScript and screen reader announcement patterns.
• The aria-live polite announcer div (#wphk-status-announcer) is present on the settings page for dynamic AJAX status feedback.
• The 'Critical Issues' card uses a dual-channel label pattern: a screen-reader-text span with 'Critical issues:' and an aria-hidden visible label, correctly separating the accessible name from the visual presentation.
• Self-update package URLs are validated to HTTPS and the wphealthkit.com domain before being passed to the WordPress upgrader, preventing supply-chain attacks via a compromised API response.
• API-supplied HTML sections for the plugin-details modal are sanitized with wp_kses_post() before rendering, preventing XSS from a compromised or spoofed API response.
• All HTTP calls in render/filter paths (dashboard widget, site_transient_update_plugins filter) correctly avoid synchronous HTTP and use transient caching with async priming via WP-Cron — excellent pattern.
• Credentials are memoized in $credentials_cache with proper invalidation on option changes via update_option_* hooks, preventing repeated get_option() calls.
• Plugin grades transient is memoized per-request in $grades_memo, preventing N get_transient() calls on plugins.php (one per plugin row).
• All admin assets are conditionally enqueued only on specific admin pages (plugins.php and settings page) — no global asset loading.
• wp_cache_add_non_persistent_groups('wphk') is registered for the installed-plugins object cache, correctly scoping it as non-persistent.
• get_installed_plugins() wraps get_plugins() with a 5-minute object cache, preventing repeated filesystem scans.
• All API calls include explicit timeout values — no reliance on the 5-second default.
• Plugin ZIP uploads use cURL streaming (CURLFile) to avoid loading large files into PHP memory, with a clear fallback path.
• The sanitize_callback for wphk_site_token correctly avoids synchronous HTTP on settings save, deferring verification to a cron event.
• wphk_version option is created with add_option(..., false) to disable autoloading — correct for data not needed on every page load.
• uninstall.php correctly uses WP_UNINSTALL_PLUGIN guard and cleans up all options, transients, and cron events.
• The supply chain alerts section in the dashboard widget gracefully omits itself on cache miss rather than blocking the render.
• Self-update package URLs are validated against an allowlist (HTTPS + wphealthkit.com domain) before being passed to the WordPress upgrader.
• API section HTML in the plugin-info modal is sanitized with wp_kses_post() before rendering.
• load_plugin_textdomain is correctly hooked to init (not plugins_loaded) in both the main plugin and the telemetry SDK.
• Cron events are properly cleared on both deactivation and uninstall, including single-event hooks.
• The priming_caches re-entry guard prevents recursive cache priming calls.
• Static caching of active_plugins and auto_update_plugins options within sync_inventory() prevents repeated option reads in the same request.