Files

T

jason 331edafb60 Update public WordPress workspace working changes

- GRACEPRESS-PUBLIC-PLUGIN-STANDARDS.md
- PUBLIC-PLUGIN-WORKFLOW.md
- WORDPRESS-ORG-REQUIREMENTS.md
- WORDPRESS-PUBLIC-CONVENTIONS.md
- design/dark-mode-admin-v1.1.0-spec.md
- plugins/bible-reference-tooltips/CHANGELOG.md
- plugins/bible-reference-tooltips/bible-reference-tooltips.php
- plugins/bible-reference-tooltips/readme.txt

2026-10-02 15:57:02 -05:00

11 KiB

Raw Permalink Blame History

WordPress.org Public Plugin Requirements

Canonical reusable checklist for every GracePress plugin intended for the WordPress.org Plugin Directory.

Status labels:

REQUIRED: Directory rule or submission requirement.
REVIEW GATE: Common reviewer expectation or security requirement that can block approval.
QUALITY GATE: GracePress release requirement that exceeds the minimum directory rule.
CONDITIONAL: Required only when the plugin uses the named capability.

A. Ownership, identity, and licensing

WP-01 REQUIRED: The plugin and every distributed dependency and asset use a GPL-compatible license.
WP-02 REQUIRED: GracePress has the legal right to distribute all code, fonts, images, icons, and other bundled material.
WP-03 REQUIRED: The plugin name and requested slug do not violate trademarks, impersonate another project, or create misleading affiliation.
WP-04 REQUIRED: The submitted ZIP is complete, production-ready, installable through Plugins > Add Plugin, and under 10 MB.
WP-05 REQUIRED: The stable plugin is fully functional; no trialware, locked local features, or code designed merely to upsell a paid edition.
WP-06 REQUIRED: SaaS dependencies, if any, provide real off-site functionality and are clearly documented.
WP-07 REQUIRED: Distributed code is human-readable. Minified or compiled assets include or link clearly to their corresponding source and build instructions.
WP-08 REQUIRED: The package contains no illegal, dishonest, deceptive, or abusive behavior.

B. Directory behavior and ecosystem boundaries

WP-09 REQUIRED: The plugin does not track users or contact external services without clear disclosure and, where tracking is involved, explicit informed consent.
WP-10 REQUIRED: The plugin does not download or execute executable code from third-party systems.
WP-11 REQUIRED: Front-end credits, backlinks, badges, or external links are absent unless the site owner explicitly opts in.
WP-12 REQUIRED: The plugin does not hijack the Dashboard, conceal normal WordPress behavior, or show persistent or excessive admin notices.
WP-13 REQUIRED: The readme and admin UI are descriptive rather than spammy; competitor names are not used as tags.
WP-14 REQUIRED: WordPress-bundled libraries are used instead of shipping duplicate copies when the core library is suitable.
WP-15 REQUIRED: Releases use incremented versions and avoid rapid, unnecessary commits or release churn.
WP-16 REVIEW GATE: Namespaces, function names, classes, constants, option names, script handles, cron hooks, and other global identifiers use a unique prefix of at least four characters or a unique namespace.
WP-17 REVIEW GATE: The plugin can coexist with likely alternatives and with its own previous/private edition without fatal declarations or unintended data corruption.

C. Security and data handling

WP-18 REVIEW GATE: Every privileged action checks an appropriate capability with current_user_can().
WP-19 REVIEW GATE: Every state-changing form, URL action, AJAX action, and REST mutation uses and verifies a nonce where appropriate. A nonce is never treated as authorization.
WP-20 REVIEW GATE: Input is taken only from required fields, wp_unslash() is applied where WordPress slashes request data, and values are sanitized and strictly validated against allowed types or enums.
WP-21 REVIEW GATE: Dynamic output is escaped at the final output point with the correct context-specific function such as esc_html(), esc_attr(), esc_url(), wp_kses_post(), or wp_json_encode().
WP-22 CONDITIONAL: Database queries use WordPress APIs and $wpdb->prepare() for dynamic SQL; identifiers and ordering values are allow-listed.
WP-23 REVIEW GATE: File operations, uploads, redirects, HTTP requests, and paths are bounded, validated, and use WordPress APIs where available.
WP-24 REVIEW GATE: No eval(), create_function(), executable backticks, hidden payloads, obfuscation, unsafe deserialization, or suppressed failures that conceal security-relevant errors.
WP-25 REVIEW GATE: Settings callbacks sanitize each option, reject invalid values, and cannot be invoked by unauthorized users.
WP-26 CONDITIONAL: AJAX and REST endpoints declare permission callbacks, validate arguments, avoid data exposure, and return structured WordPress responses.
WP-27 CONDITIONAL: Scheduled jobs, background tasks, and external callbacks cannot be abused to bypass capabilities, replay privileged work, or generate unbounded load.
WP-28 QUALITY GATE: Security review covers stored and reflected XSS, CSRF, privilege escalation, SQL injection, SSRF, open redirects, path traversal, arbitrary file access, unsafe upload, object injection, and denial-of-service risks relevant to the plugin.
WP-29 QUALITY GATE: No credentials, API tokens, private endpoints, debug dumps, personal data, or development secrets exist in source, history-bearing release files, or the ZIP.

D. Privacy, external services, and cleanup

WP-30 CONDITIONAL: All collected, stored, transmitted, logged, or browser-stored data is documented accurately, including cookies and localStorage.
WP-31 CONDITIONAL: External services identify the service, data sent, purpose, timing, terms, and privacy policy; optional services require appropriate consent.
WP-32 CONDITIONAL: Plugins handling personal data integrate with WordPress privacy-policy text, exporters, and erasers when applicable.
WP-33 REVIEW GATE: Logging avoids personal or secret data, is disabled or appropriately bounded in production, and documents retention where relevant.
WP-34 REVIEW GATE: Deactivation is safe and non-destructive. Uninstall behavior is explicit and removes plugin-owned data only when that policy is documented and appropriate.
WP-35 QUALITY GATE: A privacy inventory explicitly records "none" when the plugin has no telemetry, cookies, accounts, personal data, or external requests.

E. WordPress implementation quality

WP-36 REVIEW GATE: The main plugin header has accurate Plugin Name, Description, Version, Requires at least, Requires PHP, Author, License, License URI, and Text Domain fields as applicable.
WP-37 REVIEW GATE: Code uses WordPress APIs for settings, HTTP, filesystem, scheduling, scripts/styles, URLs, and localization rather than bypassing them without reason.
WP-38 REVIEW GATE: Scripts and styles are registered/enqueued only on the required front-end or admin screens; dependencies and versions are accurate.
WP-39 REVIEW GATE: User-facing strings are translatable, use the plugin text domain, avoid runtime-generated translation keys, and escape translated output appropriately.
WP-40 REVIEW GATE: Activation, deactivation, uninstall, upgrades, multisite behavior, and missing optional dependencies fail safely without fatal errors.
WP-41 QUALITY GATE: New and changed PHP follows WordPress Coding Standards and contains useful inline documentation for public APIs, hooks, and non-obvious behavior.
WP-42 QUALITY GATE: The admin UI uses semantic markup, keyboard-operable controls, visible focus, associated labels, sufficient contrast, understandable validation, and responsive layout.
WP-43 QUALITY GATE: The plugin does not impose avoidable front-end performance costs, layout shifts, blocking remote requests, repeated database work, or unbounded generated CSS/HTML.

F. Readme, metadata, and directory assets

WP-44 REQUIRED: readme.txt follows the WordPress.org format and passes the official readme validator.
WP-45 REQUIRED: Contributors contains valid WordPress.org usernames; Tags contains one to five relevant generic terms; the short description is plain text and no more than 150 characters.
WP-46 REQUIRED: Requires at least, Requires PHP, Tested up to, Stable tag, License, and License URI are accurate; requirements also appear correctly in the main PHP header.
WP-47 REQUIRED: The plugin header Version, runtime version constant, readme Stable tag, tagged release directory, and changelogs all agree exactly.
WP-48 REVIEW GATE: Description, installation, FAQ, privacy disclosure, screenshots, changelog, and upgrade notice describe only behavior present in the submitted package.
WP-49 REVIEW GATE: The readme is concise, avoids unsupported claims and keyword stuffing, and remains below the practical 10 KB parser limit.
WP-50 REQUIRED: Directory assets use exact lowercase names and dimensions: banner-772x250, banner-1544x500, icon-128x128, icon-256x256, and sequential screenshot-N files when screenshots are declared.
WP-51 REQUIRED: WordPress.org listing assets are prepared for the SVN repositorys top-level assets directory, not bundled unnecessarily inside the runtime plugin ZIP.
WP-52 REVIEW GATE: Asset rights, accessibility, legibility, image size limits, and right-to-left compatibility have been reviewed.

G. Compatibility, testing, and submission evidence

WP-53 QUALITY GATE: PHP syntax checks pass for every distributed PHP file.
WP-54 QUALITY GATE: WordPress Coding Standards checks pass or each intentional exception is documented.
WP-55 REQUIRED: The official Plugin Check plugin runs against the exact release candidate and all errors are resolved; warnings are resolved or explicitly justified.
WP-56 REQUIRED: The official readme validator passes the exact release candidate readme.
WP-57 QUALITY GATE: Fresh install, activation, configuration, normal use, deactivation, reactivation, upgrade, and uninstall are exercised in an isolated test site.
WP-58 QUALITY GATE: The declared minimum and current supported WordPress/PHP combinations are tested in the maintained compatibility matrix.
WP-59 QUALITY GATE: WP_DEBUG and SCRIPT_DEBUG testing produces no plugin-owned warnings, notices, deprecated calls, or unexpected output.
WP-60 QUALITY GATE: The final ZIP is inspected for required files, excluded development files, secrets, unsafe permissions, stale versions, and a single correct top-level plugin directory.
WP-61 QUALITY GATE: The exact final ZIP installs successfully and the active plugin reports the intended version.
WP-62 REQUIRED: Submission occurs only with an actively monitored WordPress.org account and email address, and only after the plugin is complete and ready for public use.
WP-63 REQUIRED: WordPress.org SVN is treated as the release target after approval; Git remains the canonical development source.

Official references

Last reconciled against official documentation: 2026-08-22.

11 KiB Raw Permalink Blame History