Scan active plugins

[swissspidy]

I think we shouldn't just limit this functionality to the active theme.

Any objections about such a feature? I'm sure it will require some work to achieve this. Maybe it's not even easily possible, e.g. because there could be many false-positives with some plugins.

[glueckpress]

+1 for the general idea. Regarding false positives etc: I can’t help but seeing a potential boost in support requests. Regardless whether we could indicate that scanning plugins is “experimental”, I see a good chance we’d soon have plugin authors hammering our doors because of users hammering theirs due to existing or non-existing problems detected by AntiVirus.

This is not to say I’m against further testing the idea, I like it! Let’s just also think of possible implications within the ecosystem.

[swissspidy]

Yep, that's what I was thinking about too. If this works out, we could do something like this in the beginning:

• Disabled by default, perhaps only even activatable through a constant
• Mark as highly experimental
• Limit to specific popular plugins we've tested this heavily with, like Jetpack, Akismet, Yoast SEO, etc.

But first, ~~let me take a selfie~~ let's see if we could get this to work.

[glueckpress]

:camera: :wink:

[swissspidy]

Other areas that may be worth considering for a scan:

• wp-config.php
• mu-plugins

[swissspidy]

Additionally, we could tell the user something like "Hey, we detected you have 6 inactive plugins. Better delete them!"

[swissspidy]

See also: https://wordpress.org/plugins/plugin-security-scanner/