Test activation across every supported WordPress and PHP version
WP HealthKit installs your plugin in a real sandboxed WordPress environment and activates it across WP 7.0/6.9 × PHP 8.1/8.2/8.3. Activation failures surface immediately — before they reach your users.
What it tests
Activation errors
PHP fatal errors that stop plugins loading entirely. Detected per WP+PHP combination so you know exactly which matrix cell fails.
Deprecation warnings
PHP deprecated function calls that produce notices today and will become fatal errors on future PHP versions.
WooCommerce conflicts
Optional sub-engine: installs WooCommerce first, then activates your plugin. Detects plugin/WC conflicts at activation time.
The version matrix
Sample result — 6 combinations, each run in an isolated sandbox.
| PHP version | WP 7.0 | WP 6.9 |
|---|---|---|
| PHP 8.1 | Pass | Pass |
| PHP 8.2 | 1 warning | 1 warning |
| PHP 8.3 | Pass | Pass |
PHP 8.2 warnings are deprecation notices — not fatal — and link directly to the affected line in your plugin.
What static analysis can't catch
Proof, not patterns
Then we attack it — unauthenticated
Activation is only the start. Once your plugin is running in the sandbox, the probe engine fires real requests at it as an anonymous visitor — no nonce, no login, no cookies.
AJAX exploit probe
Every wp_ajax_nopriv_* handler your plugin registers gets executed with crafted input. If the handler runs without verifying a nonce or capability, that's a live proof-of-concept — reported as HIGH with the exact request that worked. Rejected probes (nonce/capability enforced) produce no finding; silent ones surface as MEDIUM for review.
REST auth probe
Every non-core REST route is called via rest_do_request as an unauthenticated user. Routes that answer writes without a working permission_callback are flagged with the response as evidence. How the REST probe works
Probe findings land in your report alongside scanner findings — same severity model, same Fix Plan. This is the difference between “your code matches a risky pattern” and “here is the request that exploited your plugin.”
How to enable
Upload plugin ZIP
Drop your plugin ZIP at /upload as you would for any audit.
Enable Playground Testing
Toggle the optional Playground Testing engine. Costs +1 token from your balance.
Optionally enable WooCommerce check
Turn on the WooCommerce conflict sub-toggle to test activation alongside WC.
The results matrix appears in the Layers tab of your audit report.
Also captures
Know your plugin activates cleanly — on every version your users run.
No live server needed. Sandboxed, isolated, and reproducible.