# WordPress.org Public Plugin Requirements Canonical reusable checklist for every GracePress plugin intended for the WordPress.org Plugin Directory. Status labels: - REQUIRED: Directory rule or submission requirement. - REVIEW GATE: Common reviewer expectation or security requirement that can block approval. - QUALITY GATE: GracePress release requirement that exceeds the minimum directory rule. - CONDITIONAL: Required only when the plugin uses the named capability. ## A. Ownership, identity, and licensing - [ ] WP-01 REQUIRED: The plugin and every distributed dependency and asset use a GPL-compatible license. - [ ] WP-02 REQUIRED: GracePress has the legal right to distribute all code, fonts, images, icons, and other bundled material. - [ ] WP-03 REQUIRED: The plugin name and requested slug do not violate trademarks, impersonate another project, or create misleading affiliation. - [ ] WP-04 REQUIRED: The submitted ZIP is complete, production-ready, installable through Plugins > Add Plugin, and under 10 MB. - [ ] WP-05 REQUIRED: The stable plugin is fully functional; no trialware, locked local features, or code designed merely to upsell a paid edition. - [ ] WP-06 REQUIRED: SaaS dependencies, if any, provide real off-site functionality and are clearly documented. - [ ] WP-07 REQUIRED: Distributed code is human-readable. Minified or compiled assets include or link clearly to their corresponding source and build instructions. - [ ] WP-08 REQUIRED: The package contains no illegal, dishonest, deceptive, or abusive behavior. ## B. Directory behavior and ecosystem boundaries - [ ] WP-09 REQUIRED: The plugin does not track users or contact external services without clear disclosure and, where tracking is involved, explicit informed consent. - [ ] WP-10 REQUIRED: The plugin does not download or execute executable code from third-party systems. - [ ] WP-11 REQUIRED: Front-end credits, backlinks, badges, or external links are absent unless the site owner explicitly opts in. - [ ] WP-12 REQUIRED: The plugin does not hijack the Dashboard, conceal normal WordPress behavior, or show persistent or excessive admin notices. - [ ] WP-13 REQUIRED: The readme and admin UI are descriptive rather than spammy; competitor names are not used as tags. - [ ] WP-14 REQUIRED: WordPress-bundled libraries are used instead of shipping duplicate copies when the core library is suitable. - [ ] WP-15 REQUIRED: Releases use incremented versions and avoid rapid, unnecessary commits or release churn. - [ ] WP-16 REVIEW GATE: Namespaces, function names, classes, constants, option names, script handles, cron hooks, and other global identifiers use a unique prefix of at least four characters or a unique namespace. - [ ] WP-17 REVIEW GATE: The plugin can coexist with likely alternatives and with its own previous/private edition without fatal declarations or unintended data corruption. ## C. Security and data handling - [ ] WP-18 REVIEW GATE: Every privileged action checks an appropriate capability with current_user_can(). - [ ] WP-19 REVIEW GATE: Every state-changing form, URL action, AJAX action, and REST mutation uses and verifies a nonce where appropriate. A nonce is never treated as authorization. - [ ] WP-20 REVIEW GATE: Input is taken only from required fields, wp_unslash() is applied where WordPress slashes request data, and values are sanitized and strictly validated against allowed types or enums. - [ ] WP-21 REVIEW GATE: Dynamic output is escaped at the final output point with the correct context-specific function such as esc_html(), esc_attr(), esc_url(), wp_kses_post(), or wp_json_encode(). - [ ] WP-22 CONDITIONAL: Database queries use WordPress APIs and $wpdb->prepare() for dynamic SQL; identifiers and ordering values are allow-listed. - [ ] WP-23 REVIEW GATE: File operations, uploads, redirects, HTTP requests, and paths are bounded, validated, and use WordPress APIs where available. - [ ] WP-24 REVIEW GATE: No eval(), create_function(), executable backticks, hidden payloads, obfuscation, unsafe deserialization, or suppressed failures that conceal security-relevant errors. - [ ] WP-25 REVIEW GATE: Settings callbacks sanitize each option, reject invalid values, and cannot be invoked by unauthorized users. - [ ] WP-26 CONDITIONAL: AJAX and REST endpoints declare permission callbacks, validate arguments, avoid data exposure, and return structured WordPress responses. - [ ] WP-27 CONDITIONAL: Scheduled jobs, background tasks, and external callbacks cannot be abused to bypass capabilities, replay privileged work, or generate unbounded load. - [ ] WP-28 QUALITY GATE: Security review covers stored and reflected XSS, CSRF, privilege escalation, SQL injection, SSRF, open redirects, path traversal, arbitrary file access, unsafe upload, object injection, and denial-of-service risks relevant to the plugin. - [ ] WP-29 QUALITY GATE: No credentials, API tokens, private endpoints, debug dumps, personal data, or development secrets exist in source, history-bearing release files, or the ZIP. ## D. Privacy, external services, and cleanup - [ ] WP-30 CONDITIONAL: All collected, stored, transmitted, logged, or browser-stored data is documented accurately, including cookies and localStorage. - [ ] WP-31 CONDITIONAL: External services identify the service, data sent, purpose, timing, terms, and privacy policy; optional services require appropriate consent. - [ ] WP-32 CONDITIONAL: Plugins handling personal data integrate with WordPress privacy-policy text, exporters, and erasers when applicable. - [ ] WP-33 REVIEW GATE: Logging avoids personal or secret data, is disabled or appropriately bounded in production, and documents retention where relevant. - [ ] WP-34 REVIEW GATE: Deactivation is safe and non-destructive. Uninstall behavior is explicit and removes plugin-owned data only when that policy is documented and appropriate. - [ ] WP-35 QUALITY GATE: A privacy inventory explicitly records "none" when the plugin has no telemetry, cookies, accounts, personal data, or external requests. ## E. WordPress implementation quality - [ ] WP-36 REVIEW GATE: The main plugin header has accurate Plugin Name, Description, Version, Requires at least, Requires PHP, Author, License, License URI, and Text Domain fields as applicable. - [ ] WP-37 REVIEW GATE: Code uses WordPress APIs for settings, HTTP, filesystem, scheduling, scripts/styles, URLs, and localization rather than bypassing them without reason. - [ ] WP-38 REVIEW GATE: Scripts and styles are registered/enqueued only on the required front-end or admin screens; dependencies and versions are accurate. - [ ] WP-39 REVIEW GATE: User-facing strings are translatable, use the plugin text domain, avoid runtime-generated translation keys, and escape translated output appropriately. - [ ] WP-40 REVIEW GATE: Activation, deactivation, uninstall, upgrades, multisite behavior, and missing optional dependencies fail safely without fatal errors. - [ ] WP-41 QUALITY GATE: New and changed PHP follows WordPress Coding Standards and contains useful inline documentation for public APIs, hooks, and non-obvious behavior. - [ ] WP-42 QUALITY GATE: The admin UI uses semantic markup, keyboard-operable controls, visible focus, associated labels, sufficient contrast, understandable validation, and responsive layout. - [ ] WP-43 QUALITY GATE: The plugin does not impose avoidable front-end performance costs, layout shifts, blocking remote requests, repeated database work, or unbounded generated CSS/HTML. ## F. Readme, metadata, and directory assets - [ ] WP-44 REQUIRED: readme.txt follows the WordPress.org format and passes the official readme validator. - [ ] WP-45 REQUIRED: Contributors contains valid WordPress.org usernames; Tags contains one to five relevant generic terms; the short description is plain text and no more than 150 characters. - [ ] WP-46 REQUIRED: Requires at least, Requires PHP, Tested up to, Stable tag, License, and License URI are accurate; requirements also appear correctly in the main PHP header. - [ ] WP-47 REQUIRED: The plugin header Version, runtime version constant, readme Stable tag, tagged release directory, and changelogs all agree exactly. - [ ] WP-48 REVIEW GATE: Description, installation, FAQ, privacy disclosure, screenshots, changelog, and upgrade notice describe only behavior present in the submitted package. - [ ] WP-49 REVIEW GATE: The readme is concise, avoids unsupported claims and keyword stuffing, and remains below the practical 10 KB parser limit. - [ ] WP-50 REQUIRED: Directory assets use exact lowercase names and dimensions: banner-772x250, banner-1544x500, icon-128x128, icon-256x256, and sequential screenshot-N files when screenshots are declared. - [ ] WP-51 REQUIRED: WordPress.org listing assets are prepared for the SVN repositorys top-level assets directory, not bundled unnecessarily inside the runtime plugin ZIP. - [ ] WP-52 REVIEW GATE: Asset rights, accessibility, legibility, image size limits, and right-to-left compatibility have been reviewed. ## G. Compatibility, testing, and submission evidence - [ ] WP-53 QUALITY GATE: PHP syntax checks pass for every distributed PHP file. - [ ] WP-54 QUALITY GATE: WordPress Coding Standards checks pass or each intentional exception is documented. - [ ] WP-55 REQUIRED: The official Plugin Check plugin runs against the exact release candidate and all errors are resolved; warnings are resolved or explicitly justified. - [ ] WP-56 REQUIRED: The official readme validator passes the exact release candidate readme. - [ ] WP-57 QUALITY GATE: Fresh install, activation, configuration, normal use, deactivation, reactivation, upgrade, and uninstall are exercised in an isolated test site. - [ ] WP-58 QUALITY GATE: The declared minimum and current supported WordPress/PHP combinations are tested in the maintained compatibility matrix. - [ ] WP-59 QUALITY GATE: WP_DEBUG and SCRIPT_DEBUG testing produces no plugin-owned warnings, notices, deprecated calls, or unexpected output. - [ ] WP-60 QUALITY GATE: The final ZIP is inspected for required files, excluded development files, secrets, unsafe permissions, stale versions, and a single correct top-level plugin directory. - [ ] WP-61 QUALITY GATE: The exact final ZIP installs successfully and the active plugin reports the intended version. - [ ] WP-62 REQUIRED: Submission occurs only with an actively monitored WordPress.org account and email address, and only after the plugin is complete and ready for public use. - [ ] WP-63 REQUIRED: WordPress.org SVN is treated as the release target after approval; Git remains the canonical development source. ## Official references - https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin-guidelines/ - https://developer.wordpress.org/plugins/wordpress-org/common-issues/ - https://developer.wordpress.org/plugins/wordpress-org/planning-submitting-and-maintaining-plugins/ - https://developer.wordpress.org/plugins/wordpress-org/how-your-readme-txt-works/ - https://developer.wordpress.org/plugins/wordpress-org/plugin-assets/ - https://developer.wordpress.org/plugins/wordpress-org/plugin-developer-faq/ - https://developer.wordpress.org/plugins/developer-tools/helper-plugins/ - https://developer.wordpress.org/apis/security/ - https://developer.wordpress.org/plugins/privacy/ - https://developer.wordpress.org/coding-standards/wordpress-coding-standards/php/ Last reconciled against official documentation: 2026-08-22.