Submitting a plugin to the WordPress.org plugin directory requires passing a security review. The review team checks your code for common vulnerabilities, coding standards compliance, and adherence to WordPress best practices. Understanding what the reviewers look for helps you prepare your plugin for approval.
This guide covers how to prepare your WordPress plugin for the official WordPress.org review.
Security Checklist
The WordPress.org review team checks for several common security issues. Verify that all user input is sanitized with functions like sanitize_text_field(), absint(), and esc_url(). Confirm all output is escaped with esc_html(), esc_attr(), and esc_url(). Check that database queries use $wpdb->prepare() with placeholders. Ensure nonces are used on all forms and AJAX requests.
Coding Standards
Run PHP Code Sniffer with WordPress coding standards before submission. Fix all errors and warnings. Common issues include incorrect indentation, missing docblocks, function naming violations, and use of deprecated WordPress functions. Use PHPCBF to automatically fix formatting issues.
Internationalization
All user-facing strings must use i18n functions with a text domain. Use __(), _e(), _x(), and _n() appropriately. Load the text domain with load_plugin_textdomain(). Generate a POT file with WP-CLI’s i18n make-pot command. The review team will reject plugins without proper internationalization.
Plugin Header
Your main plugin file must have a complete plugin header. Include Plugin Name, Plugin URI, Description, Version, Author, Author URI, License, License URI, Text Domain, and Domain Path. The license must be GPLv2 or later. The description should be clear and accurate.
Submission Process
Submit your plugin through the WordPress.org plugin submission form. The review team provides feedback within a few days to weeks. Address all reviewer comments promptly. Resubmit with fixes. After approval, your plugin is available in the directory. Be prepared to make changes based on reviewer feedback.
The Bottom Line
Preparing for the WordPress.org review requires attention to security, coding standards, internationalization, and documentation. Run PHPCS, check all input/output handling, ensure i18n is complete, and prepare a proper plugin header. Passing the review on the first attempt is possible with thorough preparation.
