Reviewer2 Tools Stack Signals
Reviewer2 Tools Stack Signals helps site administrators review the maintenance state of installed plugins and themes.
It uses public information from WordPress.org to check items such as release activity, declared WordPress compatibility, directory status, and support activity. Results include an explanation and a confidence level so you can review the available evidence.
This plugin is not a security scanner. It does not detect vulnerabilities, malware, or modified files, and it does not decide whether a component is safe. A high score is a prompt to review the component, not proof of a security problem.
Main features
- An overview of current maintenance findings.
- A searchable and filterable list of installed plugins and themes.
- Detailed evidence for each score.
- Changes between completed audits.
- Manual source mapping for external and custom components.
- Print and CSV reports.
- Optional weekly email summaries, disabled by default.
- Site Health checks and WP-CLI commands.
Plugins and themes that do not use WordPress.org are shown as unrated when no suitable public maintenance data is available. You can set their source manually when needed.
Using the results
Scores range from Low to Critical observed maintenance risk. They are based only on the information available for each component. Missing information is not treated as a negative result.
Open a component to see the evidence behind its score. Consider the component’s purpose, vendor information, update process, and your own testing before taking action.
The plugin does not install, update, activate, deactivate, replace, or delete plugins and themes.
External services
The plugin connects to the public WordPress.org plugin and theme API at api.wordpress.org.
For components that are known or suspected to be listed on WordPress.org, the plugin sends the directory slug during an audit. It uses the response to read the component’s public directory information.
The site URL, post content, user data, and plugin settings are not included in these requests. Components identified as external or custom are not looked up on WordPress.org.
Audits may run on the weekly schedule or when an administrator starts one manually.
WordPress.org privacy policy: https://wordpress.org/about/privacy/
WordPress.org data protection information: https://wordpress.org/about/privacy/data-protection-additional-information/
For a verified WordPress.org plugin, the replacement research section may include a link to mlscientist.com. That site is contacted only when an administrator chooses to open the link. The link includes the verified directory slug and does not include the site URL or audit results.
No remote scripts, stylesheets, fonts, or images are loaded by the plugin.
Privacy and data
Audit data is stored in the site’s WordPress database. It covers installed software and its public maintenance information. The plugin does not collect visitor or customer data and does not create user profiles.
The optional email summary is sent with the site’s WordPress mail configuration. It is disabled until an administrator enables it.
Audit history is retained according to the setting selected by an administrator. Deactivation does not remove audit data. Plugin deletion also keeps audit data unless the uninstall cleanup option is enabled first.
Suggested privacy-policy text is available through the WordPress privacy tools.