A WordPress plugin that enables you to scan all sorts of themes and files and things.
Requires WordPress version 3.4 or greater and PHP >= 5.4.
The plugin itself is simply a UI for the VIP Scanner library, which does all the heavy lifting. The library allows you to create arbitrary "Checks" (e.g. UndefinedFunctionCheck), group them together as Reviews (e.g. WP.com Theme Review), and run them against themes, plugins, directories, single files, and even diffs.
For parsing PHP files, VIP Scanner uses PHP-Parser,
which it includes as a git submodule. When cloning VIP Scanner's git repo, use
--recursive parameter to include PHP-Parser, i.e.
git clone --recursive email@example.com:Automattic/vip-scanner.git
If you have already cloned the repo without the
--recursive parameter and
find yourself with an empty
vendor/PHP-Parser directory, run
git submodule update --init --recursive.
- Upload the plugin folder to the
- Activate the plugin through the 'Plugins' menu in WordPress
Install using the Plugin Installer.
You can find the tool under Tools > VIP Scanner. There, you can choose what type of scan you'd like to perform -- there's a dropdown list on the right hand side, just next to the "Scan" button.
The dropdown allows you to choose between three types of scan:
- Undefined Function Check
- WP.com Theme Review
- VIP Theme Review
Once you have selected a scan type, you can hit the "Scan" button and see the results in the tabbed view below.
If you prefer to use the wp-cli tool for your check, there's a
command with two main actions:
$ wp vip-scanner usage: wp vip-scanner analyze-theme [--theme=<theme>] [--scan_type=<scan-type>] [--depth=<depth>] or: wp vip-scanner scan-theme [--theme=<theme>] [--scan_type=<scan_type>] [--summary] [--format=<format>]
--themeis the theme's path relative to the WP themes directory, for example,
pub/twentyfourteen. Defaults to the current theme.
--scan_typeexpects one of the following options:
"Undefined Function Check",
"WP.com Theme Review"or
"VIP Theme Review". Defaults to "VIP Theme Review".
--depthexpects an integer. You can change the parameter to indicate how many levels of hierarchy you would like outputted. 0 outputs everything. Defaults to 1.
--summarygives you just an overview of how many files were checked, how many checks were done and how many errors, warnings and blockers were found.
--formatallows you to select a output format:
CSV. Defaults to
- Modified check for
pre_option_*to also include
- Modified analyzer to use PHP tokens rather than regular expressions
- New checks, including white/blacklist checking for file types and names
- Added basic async scanning as an admin bar node
- WP CLI scan commands now support paths in addition to theme slugs
- WP CLI
scan_typeargument is now optional
- Analysis tab for analysing functions, classes, namespaces, shortcodes, actions, filters, capabilities, roles, CPTs, taxonomies, scripts, and styles.
- WP CLI command for analysis:
wp vip-scanner analyze-theme
- New checks, including VCMergeConflictCheck, WordPressCodingStandardsCheck
- PHP Code Sniffer integration using the WordPress Coding Standards
- Check improvements: VIPRestrictedCommandsCheck, VIPRestrictedPatternsCheck, PHPShortTagsCheck
- Added unit testing for some tests
- ClamAV Integration
- New checks, including VIPInitCheck, filter_input, WP_Widget_Tag_Cloud, and more!
- WP CLI Support (using vip-scanner command)
- Reducing false positives
- Adjusting severity of several checks
- UI Refresh
- Auto scan
- Various bug fixes, including preventing the annoying upgrade nag between the main VIP Scanner plugin and WP.com Rules.
- New checks and scans! VIP_PregFile, EscapingCheck, etc.
- PHP 5.2 compatibility, props kevinmcgillivray and chrisguitarguy
- Bump WP version requirement (3.4)
- Code cleanup, props lance
- Initial version, using slightly older versions of the Theme Check plugin's checks.