PreFlight Scanner

PreFlight Scanner lets you upload any plugin .zip and run a comprehensive static safety scan before it ever touches your live WordPress environment. No plugin code is executed during the scan.

One bad plugin can white-screen an entire e-commerce store. PreFlight catches the problems before they happen.

What PreFlight Scanner checks

Version Compatibility

• PHP version compatibility — reads the plugin header and detects modern syntax your server cannot run (match expressions, nullsafe operators, typed properties, arrow functions, etc.)
• WordPress version compatibility — validates Requires At Least and Tested Up To headers against the running site

Collision Detection

• Function name collisions — detects global functions that already exist in the active environment; a guaranteed PHP fatal error
• Class name collisions — same result, often harder to diagnose
• Hook priority conflicts — two plugins registering the same add_filter() hook at the same priority silently overwrite each other’s return value; a common source of checkout and pricing bugs on WooCommerce sites

Security — Critical

• Obfuscated and malicious code patterns (eval/base64, compressed payloads, preg_replace /e modifier, large base64 blobs)
• Dangerous PHP functions — shell_exec, exec, system, passthru, proc_open, popen, pcntl_exec
• Suspicious file types inside the ZIP — .exe, .sh, .bat, .cmd, .py, .rb, .pl, .vbs

Warnings & Best Practices

• Missing PHP namespaces — files that define global functions or classes without a namespace declaration are at elevated collision risk as the site grows
• Deprecated WordPress functions — code that generates notices or breaks on current and future WordPress versions
• Suspicious outbound HTTP calls — wp_remote_get/post(), curl_exec(), file_get_contents() with hardcoded external URLs