From wordpress-plugin-development
Build WordPress plugins correctly and pass wp.org Plugin Directory review. Covers the full Plugin Developer Handbook (security, hooks, REST, shortcodes, blocks, CPTs/taxonomies, settings/meta, privacy/GDPR, users/roles, HTTP API, WP-Cron, JS/Ajax, i18n, readme/assets/SVN) and the 19 wp.org guidelines that cause closures (trialware, telemetry without opt-in, remote-loaded assets, missing source for minified files, wrong text-domain literal, missing REST permission_callback, vendored library collisions). Use when building a WordPress plugin or fixing a Plugins Team closure, preparing a submission, auditing compliance, responding to Plugin Check warnings, adding REST routes/shortcodes/blocks, registering CPTs/taxonomies/settings/meta, enqueuing scripts, wiring cron or activation hooks, translations, sanitizing/escaping, capability/nonce checks, or bundling PHP libs. Apply proactively on code under `wp-content/plugins/` or when you see `register_rest_route`, `add_shortcode`, `register_post_type`, `register_setting`, `current_user_can`, `esc_html__`, `WP_PLUGIN_DIR`, or Freemius. Skip non-plugin PHP, themes, or pure JS UI.
How this skill is triggered — by the user, by Claude, or both
Slash command
/wordpress-plugin-development:wordpress-plugin-developmentThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
A field guide for building WordPress plugins correctly and shipping plugins that pass — and stay
LICENSE.txtreferences/guidelines.mdreferences/handbook-hooks-menus-shortcodes.mdreferences/handbook-js-i18n-tools-directory.mdreferences/handbook-plugin-basics.mdreferences/handbook-privacy-users-http-cron.mdreferences/handbook-security.mdreferences/handbook-settings-data.mdreferences/hooks-paths-uploads-rest.mdreferences/i18n-and-escaping.mdreferences/plugin-check-and-prefixing.mdA field guide for building WordPress plugins correctly and shipping plugins that pass — and stay on — the wp.org directory. It combines two bodies of knowledge:
Any time you are reading or writing code under wp-content/plugins/. The triggers in the
description are not exhaustive — anything touching WordPress plugin APIs from inside a plugin
folder is fair game.
Skip it for: WordPress theme code (different review track), standalone PHP outside a plugin, pure JS/front-end work that doesn't touch a plugin's PHP.
The body below is a fast-loading triage layer. For the actual rules and code patterns, jump to the appropriate reference file.
wp.org directory & compliance (closure-survival):
| You are working on… | Open this reference |
|---|---|
| The closure email itself, or the master list of guidelines | references/guidelines.md |
| Anything translatable, or any echoed/returned HTML | references/i18n-and-escaping.md |
| Hooks, paths, settings, uploads, REST routes (compliance angle) | references/hooks-paths-uploads-rest.md |
| Running Plugin Check, or prefixing Freemius / vendored libs | references/plugin-check-and-prefixing.md |
Plugin Developer Handbook (how to build it right):
| You are working on… | Open this reference |
|---|---|
| Plugin header, activation/deactivation/uninstall, paths, structure | references/handbook-plugin-basics.md |
| Capabilities, validation, sanitizing, escaping, nonces | references/handbook-security.md |
| Actions/filters, admin menus, shortcodes | references/handbook-hooks-menus-shortcodes.md |
| Options API, Settings API, post meta, CPTs, taxonomies | references/handbook-settings-data.md |
| Privacy/GDPR, users & roles, HTTP API, WP-Cron | references/handbook-privacy-users-http-cron.md |
| Enqueuing JS/CSS, jQuery, Ajax, i18n, dev tools, readme/assets/SVN | references/handbook-js-i18n-tools-directory.md |
Each reference is self-contained markdown — read the one you need, ignore the rest. The handbook references are sourced from developer.wordpress.org/plugins/ (verify file:line/API details against current core, as APIs evolve).
If you only remember a handful of rules, remember these. They show up in roughly every other closure notice the Plugins Team sends.
__(), _e(), esc_html__() etc. needs 'your-plugin-slug' (no underscores, no variables, no constants).render_callback, the_content filter, admin notice — escape every dynamic part at the last moment with esc_html / esc_attr / esc_url / wp_kses_post.permission_callback on every REST route. Never omit it, never set null. Use __return_true for intentionally public, current_user_can( … ) for everything else.define() core constants. ABSPATH, WPINC, WP_CONTENT_DIR are core's. A plugin that redefines them gets flagged under "changing global behaviour".plugin_dir_path( __FILE__ ) and friends, not WP_PLUGIN_DIR . '/your-slug'. Users rename folders.wp_upload_dir(), never to plugin_dir_path(). Plugin folder is wiped on upgrade and public-readable.Requires Plugins: header) instead of deactivate_plugins( 'other-plugin/foo.php' ).vendor/ — must be prefixed (Strauss is the current recommendation) so it doesn't collide with another plugin's copy.When you encounter plugin code, audit it in this order:
wp plugin check <slug> or via WP admin → Tools → Plugin Check. See references/plugin-check-and-prefixing.md for setup.grep -rn "define.*ABSPATH" . — should find zero non-comment hitsgrep -rn "WP_PLUGIN_URL.*'/" . — should find zerogrep -rn "__(\$" . — variables in gettext callsgrep -rn "deactivate_plugins" . — should be empty (or only Freemius-vendored)grep -rn "include ABSPATH" . — should be require_once, inside a callbackreferences/plugin-check-and-prefixing.md.The closure emails from [email protected] are partly machine-generated (marked ✨). They will sometimes flag false positives. The reviewer's own guidance:
"Note that there may be false positives — we are humans and make mistakes, we apologize if there is anything we have gotten wrong. If you have doubts you can ask us for clarification, when asking us please be clear, concise, direct and include an example."
That said, in practice it is almost always faster to fix a borderline flag than to argue it. Every back-and-forth round is days of waiting. Push back only when a fix would meaningfully regress the product, and when you do, reply with a concise paragraph + a code example.
If the user is responding to an actual closure email:
Even when the plugin is closed, you can still upload to SVN. The flow:
Version: in the main plugin file's header.Stable tag: in readme.txt.svn co https://plugins.svn.wordpress.org/<slug>/trunk/. Make sure your .distignore / build process excludes dev files (src/, .github/, node_modules/, package.json only-if-not-used-at-runtime, .git/, tests/, etc.).svn add new files, svn delete removed ones.svn cp trunk tags/<version> to create the tag.svn ci -m "Release <version>" — the message can be terse; SVN log is not the user-facing changelog (readme is).wp.org directory & compliance:
references/guidelines.md — All 19 numbered guidelines + the Guideline 4 deep dive for compiled/minified codereferences/i18n-and-escaping.md — Text domains, gettext rules, escape functions, shortcode/block/filter escaping, XSS vectorsreferences/hooks-paths-uploads-rest.md — Actions/filters, plugin paths, Settings API, uploads dir, REST permission_callbackreferences/plugin-check-and-prefixing.md — Plugin Check setup + usage, library-prefixing with Strauss / Mozart / PHP-Scoper, Freemius prefixing recipePlugin Developer Handbook (developer.wordpress.org/plugins/):
references/handbook-plugin-basics.md — Plugin header fields, single-file vs folder, activation/deactivation/uninstall, path & URL functions, best practicesreferences/handbook-security.md — Capabilities, validation, sanitizing input, escaping output, nonces; context→function tables; common vulnsreferences/handbook-hooks-menus-shortcodes.md — Actions vs filters, priorities, custom hooks, admin menus, shortcodesreferences/handbook-settings-data.md — Options API, Settings API, post meta + meta boxes, custom post types, taxonomiesreferences/handbook-privacy-users-http-cron.md — Privacy/GDPR exporters & erasers, users/roles/caps, HTTP API, WP-Cronreferences/handbook-js-i18n-tools-directory.md — Enqueuing, jQuery, Ajax, internationalization, dev tools, readme.txt/assets/SVNProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.
npx claudepluginhub atlasaidev/wordpress-plugin-development --plugin wordpress-plugin-development