PreFlight Scanner lets you upload any plugin .zip and run a comprehensive static safety scan before it ever touches your live WordPress environment. No plugin code is executed during the scan.

One bad plugin can white-screen an entire e-commerce store. PreFlight catches the problems before they happen.

What PreFlight Scanner checks

Version Compatibility

PHP version compatibility — reads the plugin header and detects modern syntax your server cannot run (match expressions, nullsafe operators, typed properties, arrow functions, etc.)
WordPress version compatibility — validates Requires At Least and Tested Up To headers against the running site

Collision Detection

Function name collisions — detects global functions that already exist in the active environment; a guaranteed PHP fatal error
Class name collisions — same result, often harder to diagnose
Hook priority conflicts — two plugins registering the same add_filter() hook at the same priority silently overwrite each other’s return value; a common source of checkout and pricing bugs on WooCommerce sites

Security — Critical

Obfuscated and malicious code patterns (eval/base64, compressed payloads, preg_replace /e modifier, large base64 blobs)
Dangerous PHP functions — shell_exec, exec, system, passthru, proc_open, popen, pcntl_exec
Suspicious file types inside the ZIP — .exe, .sh, .bat, .cmd, .py, .rb, .pl, .vbs

Warnings & Best Practices

Missing PHP namespaces — files that define global functions or classes without a namespace declaration are at elevated collision risk as the site grows
Deprecated WordPress functions — code that generates notices or breaks on current and future WordPress versions
Suspicious outbound HTTP calls — wp_remote_get/post(), curl_exec(), file_get_contents() with hardcoded external URLs
Direct database queries — raw $wpdb->query() and string-concatenated SELECT statements that risk SQL injection
Missing nonce and capability checks — files that read $_POST/$_GET without check_admin_referer() or current_user_can()

After the scan

ALL CLEAR — one click to install immediately, then activate from the Plugins page.
WARNINGS FOUND — advisory issues; review and decide whether to proceed.
CRITICAL ISSUES — a confirmation dialog warns you before proceeding; installing is strongly discouraged.

Privacy

PreFlight Scanner performs all analysis locally on your own server. No data is sent anywhere. No external HTTP requests are made.

PreFlight Pro

Upgrade to PreFlight Pro for continuous monitoring of your already-installed plugins:

Scheduled background scans — automatically re-scan all active plugins daily or weekly
Site risk score — dashboard widget with a 0–100 risk score across all active plugins
WooCommerce hook rules — deeper conflict detection for checkout, cart, pricing, and payment hooks
Scan history — every scan saved and browsable with full results
Email alerts — get notified when a scheduled scan finds critical issues or warnings
CSV export — export scan history for client reports

Starter ($49 / 1 site) • Pro ($129 / 5 sites) • Agency ($299 / 25 sites)