jason
331edafb60
- GRACEPRESS-PUBLIC-PLUGIN-STANDARDS.md - PUBLIC-PLUGIN-WORKFLOW.md - WORDPRESS-ORG-REQUIREMENTS.md - WORDPRESS-PUBLIC-CONVENTIONS.md - design/dark-mode-admin-v1.1.0-spec.md - plugins/bible-reference-tooltips/CHANGELOG.md - plugins/bible-reference-tooltips/bible-reference-tooltips.php - plugins/bible-reference-tooltips/readme.txt
110 lines
11 KiB
Markdown
110 lines
11 KiB
Markdown
# WordPress.org Public Plugin Requirements
|
|
|
|
Canonical reusable checklist for every GracePress plugin intended for the WordPress.org Plugin Directory.
|
|
|
|
Status labels:
|
|
|
|
- REQUIRED: Directory rule or submission requirement.
|
|
- REVIEW GATE: Common reviewer expectation or security requirement that can block approval.
|
|
- QUALITY GATE: GracePress release requirement that exceeds the minimum directory rule.
|
|
- CONDITIONAL: Required only when the plugin uses the named capability.
|
|
|
|
## A. Ownership, identity, and licensing
|
|
|
|
- [ ] WP-01 REQUIRED: The plugin and every distributed dependency and asset use a GPL-compatible license.
|
|
- [ ] WP-02 REQUIRED: GracePress has the legal right to distribute all code, fonts, images, icons, and other bundled material.
|
|
- [ ] WP-03 REQUIRED: The plugin name and requested slug do not violate trademarks, impersonate another project, or create misleading affiliation.
|
|
- [ ] WP-04 REQUIRED: The submitted ZIP is complete, production-ready, installable through Plugins > Add Plugin, and under 10 MB.
|
|
- [ ] WP-05 REQUIRED: The stable plugin is fully functional; no trialware, locked local features, or code designed merely to upsell a paid edition.
|
|
- [ ] WP-06 REQUIRED: SaaS dependencies, if any, provide real off-site functionality and are clearly documented.
|
|
- [ ] WP-07 REQUIRED: Distributed code is human-readable. Minified or compiled assets include or link clearly to their corresponding source and build instructions.
|
|
- [ ] WP-08 REQUIRED: The package contains no illegal, dishonest, deceptive, or abusive behavior.
|
|
|
|
## B. Directory behavior and ecosystem boundaries
|
|
|
|
- [ ] WP-09 REQUIRED: The plugin does not track users or contact external services without clear disclosure and, where tracking is involved, explicit informed consent.
|
|
- [ ] WP-10 REQUIRED: The plugin does not download or execute executable code from third-party systems.
|
|
- [ ] WP-11 REQUIRED: Front-end credits, backlinks, badges, or external links are absent unless the site owner explicitly opts in.
|
|
- [ ] WP-12 REQUIRED: The plugin does not hijack the Dashboard, conceal normal WordPress behavior, or show persistent or excessive admin notices.
|
|
- [ ] WP-13 REQUIRED: The readme and admin UI are descriptive rather than spammy; competitor names are not used as tags.
|
|
- [ ] WP-14 REQUIRED: WordPress-bundled libraries are used instead of shipping duplicate copies when the core library is suitable.
|
|
- [ ] WP-15 REQUIRED: Releases use incremented versions and avoid rapid, unnecessary commits or release churn.
|
|
- [ ] WP-16 REVIEW GATE: Namespaces, function names, classes, constants, option names, script handles, cron hooks, and other global identifiers use a unique prefix of at least four characters or a unique namespace.
|
|
- [ ] WP-17 REVIEW GATE: The plugin can coexist with likely alternatives and with its own previous/private edition without fatal declarations or unintended data corruption.
|
|
|
|
## C. Security and data handling
|
|
|
|
- [ ] WP-18 REVIEW GATE: Every privileged action checks an appropriate capability with current_user_can().
|
|
- [ ] WP-19 REVIEW GATE: Every state-changing form, URL action, AJAX action, and REST mutation uses and verifies a nonce where appropriate. A nonce is never treated as authorization.
|
|
- [ ] WP-20 REVIEW GATE: Input is taken only from required fields, wp_unslash() is applied where WordPress slashes request data, and values are sanitized and strictly validated against allowed types or enums.
|
|
- [ ] WP-21 REVIEW GATE: Dynamic output is escaped at the final output point with the correct context-specific function such as esc_html(), esc_attr(), esc_url(), wp_kses_post(), or wp_json_encode().
|
|
- [ ] WP-22 CONDITIONAL: Database queries use WordPress APIs and $wpdb->prepare() for dynamic SQL; identifiers and ordering values are allow-listed.
|
|
- [ ] WP-23 REVIEW GATE: File operations, uploads, redirects, HTTP requests, and paths are bounded, validated, and use WordPress APIs where available.
|
|
- [ ] WP-24 REVIEW GATE: No eval(), create_function(), executable backticks, hidden payloads, obfuscation, unsafe deserialization, or suppressed failures that conceal security-relevant errors.
|
|
- [ ] WP-25 REVIEW GATE: Settings callbacks sanitize each option, reject invalid values, and cannot be invoked by unauthorized users.
|
|
- [ ] WP-26 CONDITIONAL: AJAX and REST endpoints declare permission callbacks, validate arguments, avoid data exposure, and return structured WordPress responses.
|
|
- [ ] WP-27 CONDITIONAL: Scheduled jobs, background tasks, and external callbacks cannot be abused to bypass capabilities, replay privileged work, or generate unbounded load.
|
|
- [ ] WP-28 QUALITY GATE: Security review covers stored and reflected XSS, CSRF, privilege escalation, SQL injection, SSRF, open redirects, path traversal, arbitrary file access, unsafe upload, object injection, and denial-of-service risks relevant to the plugin.
|
|
- [ ] WP-29 QUALITY GATE: No credentials, API tokens, private endpoints, debug dumps, personal data, or development secrets exist in source, history-bearing release files, or the ZIP.
|
|
|
|
## D. Privacy, external services, and cleanup
|
|
|
|
- [ ] WP-30 CONDITIONAL: All collected, stored, transmitted, logged, or browser-stored data is documented accurately, including cookies and localStorage.
|
|
- [ ] WP-31 CONDITIONAL: External services identify the service, data sent, purpose, timing, terms, and privacy policy; optional services require appropriate consent.
|
|
- [ ] WP-32 CONDITIONAL: Plugins handling personal data integrate with WordPress privacy-policy text, exporters, and erasers when applicable.
|
|
- [ ] WP-33 REVIEW GATE: Logging avoids personal or secret data, is disabled or appropriately bounded in production, and documents retention where relevant.
|
|
- [ ] WP-34 REVIEW GATE: Deactivation is safe and non-destructive. Uninstall behavior is explicit and removes plugin-owned data only when that policy is documented and appropriate.
|
|
- [ ] WP-35 QUALITY GATE: A privacy inventory explicitly records "none" when the plugin has no telemetry, cookies, accounts, personal data, or external requests.
|
|
|
|
## E. WordPress implementation quality
|
|
|
|
- [ ] WP-36 REVIEW GATE: The main plugin header has accurate Plugin Name, Description, Version, Requires at least, Requires PHP, Author, License, License URI, and Text Domain fields as applicable.
|
|
- [ ] WP-37 REVIEW GATE: Code uses WordPress APIs for settings, HTTP, filesystem, scheduling, scripts/styles, URLs, and localization rather than bypassing them without reason.
|
|
- [ ] WP-38 REVIEW GATE: Scripts and styles are registered/enqueued only on the required front-end or admin screens; dependencies and versions are accurate.
|
|
- [ ] WP-39 REVIEW GATE: User-facing strings are translatable, use the plugin text domain, avoid runtime-generated translation keys, and escape translated output appropriately.
|
|
- [ ] WP-40 REVIEW GATE: Activation, deactivation, uninstall, upgrades, multisite behavior, and missing optional dependencies fail safely without fatal errors.
|
|
- [ ] WP-41 QUALITY GATE: New and changed PHP follows WordPress Coding Standards and contains useful inline documentation for public APIs, hooks, and non-obvious behavior.
|
|
- [ ] WP-42 QUALITY GATE: The admin UI uses semantic markup, keyboard-operable controls, visible focus, associated labels, sufficient contrast, understandable validation, and responsive layout.
|
|
- [ ] WP-43 QUALITY GATE: The plugin does not impose avoidable front-end performance costs, layout shifts, blocking remote requests, repeated database work, or unbounded generated CSS/HTML.
|
|
|
|
## F. Readme, metadata, and directory assets
|
|
|
|
- [ ] WP-44 REQUIRED: readme.txt follows the WordPress.org format and passes the official readme validator.
|
|
- [ ] WP-45 REQUIRED: Contributors contains valid WordPress.org usernames; Tags contains one to five relevant generic terms; the short description is plain text and no more than 150 characters.
|
|
- [ ] WP-46 REQUIRED: Requires at least, Requires PHP, Tested up to, Stable tag, License, and License URI are accurate; requirements also appear correctly in the main PHP header.
|
|
- [ ] WP-47 REQUIRED: The plugin header Version, runtime version constant, readme Stable tag, tagged release directory, and changelogs all agree exactly.
|
|
- [ ] WP-48 REVIEW GATE: Description, installation, FAQ, privacy disclosure, screenshots, changelog, and upgrade notice describe only behavior present in the submitted package.
|
|
- [ ] WP-49 REVIEW GATE: The readme is concise, avoids unsupported claims and keyword stuffing, and remains below the practical 10 KB parser limit.
|
|
- [ ] WP-50 REQUIRED: Directory assets use exact lowercase names and dimensions: banner-772x250, banner-1544x500, icon-128x128, icon-256x256, and sequential screenshot-N files when screenshots are declared.
|
|
- [ ] WP-51 REQUIRED: WordPress.org listing assets are prepared for the SVN repositorys top-level assets directory, not bundled unnecessarily inside the runtime plugin ZIP.
|
|
- [ ] WP-52 REVIEW GATE: Asset rights, accessibility, legibility, image size limits, and right-to-left compatibility have been reviewed.
|
|
|
|
## G. Compatibility, testing, and submission evidence
|
|
|
|
- [ ] WP-53 QUALITY GATE: PHP syntax checks pass for every distributed PHP file.
|
|
- [ ] WP-54 QUALITY GATE: WordPress Coding Standards checks pass or each intentional exception is documented.
|
|
- [ ] WP-55 REQUIRED: The official Plugin Check plugin runs against the exact release candidate and all errors are resolved; warnings are resolved or explicitly justified.
|
|
- [ ] WP-56 REQUIRED: The official readme validator passes the exact release candidate readme.
|
|
- [ ] WP-57 QUALITY GATE: Fresh install, activation, configuration, normal use, deactivation, reactivation, upgrade, and uninstall are exercised in an isolated test site.
|
|
- [ ] WP-58 QUALITY GATE: The declared minimum and current supported WordPress/PHP combinations are tested in the maintained compatibility matrix.
|
|
- [ ] WP-59 QUALITY GATE: WP_DEBUG and SCRIPT_DEBUG testing produces no plugin-owned warnings, notices, deprecated calls, or unexpected output.
|
|
- [ ] WP-60 QUALITY GATE: The final ZIP is inspected for required files, excluded development files, secrets, unsafe permissions, stale versions, and a single correct top-level plugin directory.
|
|
- [ ] WP-61 QUALITY GATE: The exact final ZIP installs successfully and the active plugin reports the intended version.
|
|
- [ ] WP-62 REQUIRED: Submission occurs only with an actively monitored WordPress.org account and email address, and only after the plugin is complete and ready for public use.
|
|
- [ ] WP-63 REQUIRED: WordPress.org SVN is treated as the release target after approval; Git remains the canonical development source.
|
|
|
|
## Official references
|
|
|
|
- https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin-guidelines/
|
|
- https://developer.wordpress.org/plugins/wordpress-org/common-issues/
|
|
- https://developer.wordpress.org/plugins/wordpress-org/planning-submitting-and-maintaining-plugins/
|
|
- https://developer.wordpress.org/plugins/wordpress-org/how-your-readme-txt-works/
|
|
- https://developer.wordpress.org/plugins/wordpress-org/plugin-assets/
|
|
- https://developer.wordpress.org/plugins/wordpress-org/plugin-developer-faq/
|
|
- https://developer.wordpress.org/plugins/developer-tools/helper-plugins/
|
|
- https://developer.wordpress.org/apis/security/
|
|
- https://developer.wordpress.org/plugins/privacy/
|
|
- https://developer.wordpress.org/coding-standards/wordpress-coding-standards/php/
|
|
|
|
Last reconciled against official documentation: 2026-08-22.
|