In reply to nick6352683.

Code scans for any themes or plugins not coming directly from the repository (which should be scanned and held on upload) would be a fantastic feature. Great thinking Nick!

I'd suggest making it impossible to activate a plugin which fails code scan (of course one could remove the security check module but that's hard work). No exceptions for Automattic plugins either (I'm thinking of Jetpack specifically which gets a whole lot of free passes for its serviceware and promiscuous sharing of user data).

Such a feature could finally bring the Wordpress security wild fires under control.