Audit the WordPress code you take over in minutes, not half a day.

Send a plugin, a theme or a whole site, as a repository link or a zip, and get a readable report: findings with the reason, the file and the code itself. Use it to decide whether to keep, fix or rebuild, and to show your client why.

Request an audit pilot See a sample report

Early access. Rateo recognises WordPress plugins, themes and whole sites, and leaves WordPress core out, so only the code you inherited is reviewed. The same code always gets the same report, and no AI model is involved.

How it works

  1. Send the code. A repository link or a zip of the plugin, theme or site you took over.

  2. Get the findings. Rateo works out what each file is and leaves WordPress core out. Today it checks size, complexity, duplication, naming and security: long files, classes and functions, functions with too many paths, blocks repeated inside a file, unclear or inconsistent names, and risky code such as eval, shell commands, SQL with values pasted in, request input never sanitized and output never escaped. The WordPress rules for nonces and capability checks come next, and pilot users shape the order.

  3. Decide and show it. Every finding shows why it matters, where it is and the code, so you can check it in seconds and hand the report to your client.

Why not an AI or a sniffer?

  • Same code, same report. Run it twice, or on two sites, and you get the same written rules applied the same way. An AI agent can answer differently each time.

  • A report your client can read. Sniffers print hundreds of lines for a developer. Rateo groups the findings and explains each one, so the case for a fix or a rebuild is on one page.

  • Half a day back. The report is ready before you've opened the code.

See what you get

Two real WordPress plugins, reported by the engine. Open one and check any finding against code you can download.

ACPT Pro 2.1.6

A custom post type and fields plugin. Made by the team behind Rateo; we ran it on our own code first.

3,480 findings Open the report

Both samples are real GPL plugins: ACPT Pro 2.1.6, made by the team behind Rateo, and WooCommerce 11.2.1. Every finding was produced by the engine, and nothing was removed or edited. The full engine output is linked from each report.

Get early access

Tell us a little about the code you take over. If you ask for an audit pilot, you'll get a reply within a few working days.

Your role
How often do you take over a site, plugin or theme written by someone else?
What would you like?

Questions

What does it check today?

Size, complexity, duplication and naming, file by file, with WordPress core left out, plus security checks: eval, shell commands, unserialize and includes built from data, SQL with values pasted in, request input never sanitized and output never escaped. The security checks read one statement at a time, so they show where to look, not proof of a hole. Nonces and capability checks come next; pilot users decide what comes after.

Does it replace a security scanner?

No. It reviews the code itself and explains what it finds. Use it alongside the tools you already run.

Is it available today?

Not yet. We're running audit pilots with a few freelancers and agencies to shape the report.

How will pricing work?

Per audit, since you take over code a few times a year rather than every day. Pilot users agree a pilot price with us by email before anything is charged.

What about the code I send?

It is used only to produce your report, and it is never shared or used to train anything.

What happens to my details?

We use them only to contact you about early access and pilots, keep them for 12 months, and send you a newsletter only if you tick its box. See the privacy notice.