Title: Automatically Catching Bugs in Plugins Author: Ian Dunn Published: April 27, 2021 Last modified: April 28, 2021 --- [ ](https://profiles.wordpress.org/iandunn/) [Ian Dunn](https://profiles.wordpress.org/iandunn/) 4:50 pm _on_ April 27, 2021 Tags: coding standards, PHPCS, [security ( 2 )](https://make.wordpress.org/meta/tag/security/) # Automatically Catching Bugs in Plugins ## A Problem There are times when it’s difficult for a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. developer to know the most secure way to implement something (e.g., [preparing a SQL query with conditional clauses](https://github.com/WordPress/wordcamp.org/blob/96125536f98b75726824b00688ecd036bf54a86e/public_html/wp-content/plugins/wordcamp-payments-network/includes/payment-requests-list-table.php#L50-L109)), and it can be easy to overlook bugs and bad practices when there are thousands of lines of codeLines of Code Lines of code. This is sometimes used as a poor metric for developer productivity, but can also have other uses.. That creates bad experiences for users when something breaks or their site is hacked. ## A Potential Solution Static code analysisStatic code analysis "...the analysis of computer software that is performed without actually executing programs, in contrast with dynamic analysis, which is analysis performed on programs while they are executing." - [Wikipedia](https://en.wikipedia.org/wiki/Static_program_analysis) could help to catch bugs, and inform developers how to fix them. It could also reduce the amount of time the Plugin team spends doing manual reviews. [The Coding Standards project](https://github.com/WordPress/WordPress-Coding-Standards/graphs/contributors) has already built an extensive set of PHPCSPHP Code Sniffer [PHP Code Sniffer,](https://github.com/squizlabs/PHP_CodeSniffer) a popular tool for analyzing code quality. The [WordPress Coding Standards](https://github.com/WordPress/WordPress-Coding-Standards/) rely on PHPCS. sniffssniff A module for [PHP Code Sniffer](https://github.com/squizlabs/PHP_CodeSniffer) that analyzes code for a specific problem. Multiple stiffs are combined to create a PHPCS standard. The term is named because it detects [code smells](https://en.wikipedia.org/wiki/Code_smell), similar to how a dog would "sniff" out food., and the MetaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. team has [prototyped a custom PHPCS standard](https://make.wordpress.org/meta/2021/02/19/reducing-the-plugin-review-teams-workload-through-automation/) for the Plugin Repository. **Would something like that be useful? If so, what exactly should it check for?** ## Feedback 1. At a **high level, what concerns need to be addressed**? e.g., security, backwards/ forwards-compatibility, best practices? 2. At a **lower level, what specific things should be reported**? e.g., escaped database queries & HTMLHTML HTML is an acronym for Hyper Text Markup Language. It is a markup language that is used in the development of web pages and websites. output, using CoreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. APIs where available, avoiding deprecated functions? 3. * What [existing sniffs](https://github.com/WordPress/WordPress-Coding-Standards/tree/e9c4858/WordPress/Sniffs) should be included from WPCSWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016.? * What new sniffs need to be developed? * What should be treated as an error, and what should just be a recommendation? 4. What are the current **gaps in documentation**? e.g., piecing together complex MySQLMySQL MySQL is a relational database management system. A database is a structured collection of data where content, configuration and other options are stored. [https://www.mysql.com](https://www.mysql.com/) queries with multiple variables. We’ll need good documentation to help devs understand a problem in their code, and fix it the right way. 5. What are the current **gaps in functionality that Core provides** to plugins? e. g., [escaping table and column names](https://core.trac.wordpress.org/ticket/52506), [native MySQL prepared statements](https://core.trac.wordpress.org/ticket/42352), [an HTML templating language](https://core.trac.wordpress.org/ticket/33472). It’ll be easier for plugins to meet the standard if they don’t have to create their own implementations of common functionality. 6. What metrics should we track to **determine if code quality is improving enough**? 7. What metrics should we track to **determine if we’re saving the Plugin Team enough time**? If you’re interested in similar conversations, check out the `#core-coding-standards` channel in [our Slack workspace](https://make.wordpress.org/chat/). +make.wordpress.org/plugins/ +make.wordpress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. [https://wordpress.org/](https://wordpress.org/)/ docs/ +make.wordpress.org/core/ cc [@dingo_d](https://profiles.wordpress.org/dingo_d/), [@westonruter](https://profiles.wordpress.org/westonruter/), [@jdgrimes](https://profiles.wordpress.org/jdgrimes/), [@jeffpaul](https://profiles.wordpress.org/jeffpaul/) [#coding-standards](https://make.wordpress.org/meta/tag/coding-standards/), [#phpcs](https://make.wordpress.org/meta/tag/phpcs/), [#security](https://make.wordpress.org/meta/tag/security/) ### Share this: * [ Threads ](https://make.wordpress.org/meta/2021/04/27/automatically-catching-bugs-in-plugins/?share=threads) * [ Mastodon ](https://make.wordpress.org/meta/2021/04/27/automatically-catching-bugs-in-plugins/?share=mastodon) * [ Bluesky ](https://make.wordpress.org/meta/2021/04/27/automatically-catching-bugs-in-plugins/?share=bluesky) * [ X ](https://make.wordpress.org/meta/2021/04/27/automatically-catching-bugs-in-plugins/?share=x) * [ Facebook ](https://make.wordpress.org/meta/2021/04/27/automatically-catching-bugs-in-plugins/?share=facebook) * [ LinkedIn ](https://make.wordpress.org/meta/2021/04/27/automatically-catching-bugs-in-plugins/?share=linkedin) * [Login to Reply](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fmake.wordpress.org%2Fmeta%2F2021%2F04%2F27%2Fautomatically-catching-bugs-in-plugins%2F%23respond&locale=en_US) 1. ![](https://secure.gravatar.com/avatar/5783a2d9b93f04f6d0a1ddabddcfd71f15136d7eaea7a87f9962d3f93f780224? s=32&d=mm&r=g) 2. [Ian Dunn](https://profiles.wordpress.org/iandunn/) 4:53 pm _on_ April 27, 2021 3. > 1. what concerns need to be addressed 4. I think it should focus on critical things like security, fatal errors, and best- practices that are likely to impact users. Subjective and controversial things like coding style and design patterns should be left up to the developer in my opinion. 5. * ![](https://secure.gravatar.com/avatar/63b496ec3806485229b4f934b26643dad6e734ca6e6ef7b38c846205b01cd37f? s=32&d=mm&r=g) * [Weston Ruter](https://profiles.wordpress.org/westonruter/) 5:08 pm _on_ April 27, 2021 * Agreed. A developer should not be penalized for using PSR-12. 6. ![](https://secure.gravatar.com/avatar/2705ec72762002e78c7aded24c0f5342a977a679a86abd8b1b3b2e09d5f6d715? s=32&d=mm&r=g) 7. [Michael Nelson](https://profiles.wordpress.org/mnelson4/) 5:01 pm _on_ April 27, 2021 8. To not answer your question, I think improving how pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost- based plugin from a third-party. _users_ are alerted to issues would a different but very valuable endeavour. Eg, alerting users when: 9. * a plugin’s owner changes (sometimes the new owner introduce vulnerabilities) * a security bug is disclosed in a plugin * a plugin hasn’t been updated in a long time and is falling out-of-date 10. etc 11. * ![](https://secure.gravatar.com/avatar/d1296c9df64e16ada8b0bd1253eac6bfb07ea528a04558a06b512b5a163dd818? s=32&d=mm&r=g) * [Rocky Kev](https://profiles.wordpress.org/rockykev/) 2:51 am _on_ April 28, 2021 * I really like this. * As as user, I was really disappointed to see a company take over a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. that I used frequently, and are now frequently releasing frequent updates as ‘security changes’, while actually making me feel like it’s become less secure. * As a developer, (and using Node as a example), the quantity of warnings has always been a tool to forcing a stakeholder’s hand to prioritizing changes. 12. ![](https://secure.gravatar.com/avatar/2705ec72762002e78c7aded24c0f5342a977a679a86abd8b1b3b2e09d5f6d715? s=32&d=mm&r=g) 13. [Michael Nelson](https://profiles.wordpress.org/mnelson4/) 5:06 pm _on_ April 27, 2021 14. > What existing sniffs should be included from WPCSWordPress Community Support > A public benefit corporation and a subsidiary of the WordPress Foundation, > [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) > in 2016.? 15. while making it easy to add WPCS sniffs will be good, I know many plugins follow other coding standards (like PSR) so I don’t think we should enforce a particular coding standard. But automatically detecting errors (like how PHPstan does) and security vulnerabilities (eg not escaping SQL) should at least be brought to developers’ attention. 16. > What should be treated as an error, and what should just be a recommendation? 17. I probably wouldn’t start with only recommendations. And then if that goes well for a few months, start to consider requiring stuff. 18. * ![](https://secure.gravatar.com/avatar/5783a2d9b93f04f6d0a1ddabddcfd71f15136d7eaea7a87f9962d3f93f780224? s=32&d=mm&r=g) * [Ian Dunn](https://profiles.wordpress.org/iandunn/) 6:12 pm _on_ April 27, 2021 * That’s a great point. Psalm is another one that could be useful, especially for security. * I still think some of the WPCSWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016. sniffs would be very useful for, though, especially since they’re aware of WordPress-specific escaping, preparing, etc. - ![](https://secure.gravatar.com/avatar/2705ec72762002e78c7aded24c0f5342a977a679a86abd8b1b3b2e09d5f6d715? s=32&d=mm&r=g) - [Michael Nelson](https://profiles.wordpress.org/mnelson4/) 5:39 pm _on_ April 29, 2021 - Ya I think lots of WPCSWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016. is probably still useful. One item we wish we had this last week was a sniffsniff A module for [PHP Code Sniffer](https://github.com/squizlabs/PHP_CodeSniffer) that analyzes code for a specific problem. Multiple stiffs are combined to create a PHPCS standard. The term is named because it detects [code smells](https://en.wikipedia.org/wiki/Code_smell), similar to how a dog would "sniff" out food. for accidentally using WordPress functions that aren’t supported by our pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress. org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party.’s minimum version (eg using` register_block_type` even though our plugin supported WP before 5.0) * ![](https://secure.gravatar.com/avatar/d49139aae88b36b005da13cd5acf63b1904c3066d020ba0480cb8986d50f9d44? s=32&d=mm&r=g) * [Juliette Reinders Folmer](https://profiles.wordpress.org/jrf/) 8: 46 pm _on_ April 29, 2021 * There is an [issue open](https://github.com/WordPress/WordPress-Coding-Standards/issues/1849) already to add a sniffsniff A module for [PHP Code Sniffer](https://github.com/squizlabs/PHP_CodeSniffer) that analyzes code for a specific problem. Multiple stiffs are combined to create a PHPCS standard. The term is named because it detects [code smells](https://en.wikipedia.org/wiki/Code_smell), similar to how a dog would "sniff" out food. for this. The problem with these kind of “list” based sniff is that it takes a lot of manual effort to keep the lists up to date, so chances are, the feature request won’t see any action until [some tooling to automate the creation of those lists](https://github.com/WordPress/WordPress-Coding-Standards/issues/1803) is created. Unless there is someone willing to step up and create the initial list of functions before that time. 19. ![](https://secure.gravatar.com/avatar/08f5251e656bb9e514f0991825afcfed1053665cc3b79036b6c229552fd6ccd0? s=32&d=mm&r=g) 20. [Paul Bearne](https://profiles.wordpress.org/pbearne/) 5:13 pm _on_ April 27, 2021 21. I guess if we were able to declare the coding standards we are using with the default set to WP that would solve the concerns about PSR 22. * ![](https://secure.gravatar.com/avatar/08f5251e656bb9e514f0991825afcfed1053665cc3b79036b6c229552fd6ccd0? s=32&d=mm&r=g) * [Paul Bearne](https://profiles.wordpress.org/pbearne/) 5:17 pm _on_ April 27, 2021 * And even maybe allow dev to opt-out Then name and same on the pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. page eg. * ## This plugin is code to the WP coding standard and has XX warnings and XX errors * (maybe) This plugin is not coded to any code standard use at your own risk - ![](https://secure.gravatar.com/avatar/d49139aae88b36b005da13cd5acf63b1904c3066d020ba0480cb8986d50f9d44? s=32&d=mm&r=g) - [Juliette Reinders Folmer](https://profiles.wordpress.org/jrf/) 9:34 pm _on_ April 27, 2021 - > Then name and shame on the pluginPlugin A plugin is a piece of software > containing a group of functions that can be added to a WordPress website. > They can extend functionality or add new features to your WordPress websites. > WordPress plugins are written in the PHP programming language and integrate > seamlessly with WordPress. These can be free in the WordPress.org Plugin > Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) > or can be cost-based plugin from a third-party. page - I think this is a **really, really bad idea**. - A lot of best practices can be applied in various ways and WPCSWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016. expects _one_ particular way (by design). Example: making sure all output is escaped – WPCS has a strong focus on _late_ escaping, while early escaping _when done correctly_, can be perfectly safe. - Naming and shaming plugins which do things right, but in a slightly different way is _**really**_ not the right way to go about things and will just create a lot of friction. * ![](https://secure.gravatar.com/avatar/da1872b45f2e9bc6c66ff94d1d99d6fbb3bf7d3af5b5c1eeb870384fb7da3881? s=32&d=mm&r=g) * [Mikko Saari](https://profiles.wordpress.org/msaari/) 3:10 am _on_ April 28, 2021 * Yes, I follow WPCSWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016. and I still have to tell PHPCSPHP Code Sniffer [PHP Code Sniffer,](https://github.com/squizlabs/PHP_CodeSniffer) a popular tool for analyzing code quality. The [WordPress Coding Standards](https://github.com/WordPress/WordPress-Coding-Standards/) rely on PHPCS. to ignore some of the sniffssniff A module for [PHP Code Sniffer](https://github.com/squizlabs/PHP_CodeSniffer) that analyzes code for a specific problem. Multiple stiffs are combined to create a PHPCS standard. The term is named because it detects [code smells](https://en.wikipedia.org/wiki/Code_smell), similar to how a dog would "sniff" out food., because they’re just wrong in my particular use case (lots of early escaping, some variable interpolation in DB queries, some unavoidable use of `serialize()` and file system functions…) – it would not be fun to be shamed for that, when I’ve thought every case through and implemented them the best way I can. - ![](https://secure.gravatar.com/avatar/d1296c9df64e16ada8b0bd1253eac6bfb07ea528a04558a06b512b5a163dd818? s=32&d=mm&r=g) - [Rocky Kev](https://profiles.wordpress.org/rockykev/) 3:01 am _on_ April 28, 2021 - [WPCS](https://make.wordpress.org/core/handbook/best-practices/coding-standards/) were not accepted at my company for many reasons. I don’t think a style should ever be forced on a developer. * ![](https://secure.gravatar.com/avatar/5783a2d9b93f04f6d0a1ddabddcfd71f15136d7eaea7a87f9962d3f93f780224? s=32&d=mm&r=g) * [Ian Dunn](https://profiles.wordpress.org/iandunn/) 4:06 pm _on_ April 28, 2021 * I agree! One great thing about WPCSWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016. (and related tools) is that they can be configured to only detect security bugs, fatal errors, etc. 23. ![](https://secure.gravatar.com/avatar/890bd890338f9b6a17143a65ac10a20410e135583d95106bb09f20d91f66afe2? s=32&d=mm&r=g) 24. [tobifjellner (Tor-Bjorn Fjellner)](https://profiles.wordpress.org/tobifjellner/) 5:26 pm _on_ April 27, 2021 25. Hi from a translator. It would be great if there could be warnings for output to the user that is not prepared for translation (not using translation functions, not using text-domain, using a text-domain that is different from the pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress. org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. slug). Perhaps also some of the i18n checks that [@casiepa](https://profiles.wordpress.org/casiepa/) has put in [https://github.com/ePascalC/CheckPluginForTranslation/](https://github.com/ePascalC/CheckPluginForTranslation/) I’d also say that two things should be regarded as outright errors: “doesn’t compile” and security flaws. (But not using esc_html for a string translation should perhaps just be a warning.) Regarding code layout, etc: **If** a dev wants to follow WPCSWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016., then they could ask for a “stricter teacher” by putting a checkmark somewhere or perhaps some kind of declaration in the plugin headerHeader The header of your site is typically the first thing people will experience. The masthead or header art located across the top of your page is part of the look and feel of your website. It can influence a visitor’s opinion about your content and you/ your organization’s brand. It may also look different on different screen sizes.. 26. * ![](https://secure.gravatar.com/avatar/6b6d1c4d29f1b149da0008917c70b019408d5af404a46bca853e4dd33546e1ed? s=32&d=mm&r=g) * [Joost de Valk](https://profiles.wordpress.org/joostdevalk/) 9:43 pm _on_ April 27, 2021 * There are good cases for not using translation functions or for not using a text domain on some text. We’d have more false positives than I’d want to look at. * ![](https://secure.gravatar.com/avatar/9e6583bcbe4831c87f40523ded6be4ca1ad48833133bd542c4672d4ca4e54081? s=32&d=mm&r=g) * [Gary Jones](https://profiles.wordpress.org/garyj/) 11:02 am _on_ April 29, 2021 * > not using translation functions * How would one detect a string meant for front-end visibility, versus a string used for something else? It would be impossible to get that anywhere close to accurate. * > not using text-domain, using a text-domain that is different from the pluginPlugin > A plugin is a piece of software containing a group of functions that can > be added to a WordPress website. They can extend functionality or add new > features to your WordPress websites. WordPress plugins are written in the > PHP programming language and integrate seamlessly with WordPress. These > can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) > or can be cost-based plugin from a third-party. slug * If you [configure WPCS with a text domain](https://github.com/WordPress/WordPress-Coding-Standards/wiki/Customizable-sniff-properties#internationalization-setting-your-text-domain), then it will already check for this very accurately. 27. ![](https://secure.gravatar.com/avatar/1bd692736861bd20949789e4a3d922736480efcacb0e44041616c5a79eaa54c0? s=32&d=mm&r=g) 28. [Darren Ethier (nerrad)](https://profiles.wordpress.org/nerrad/) 6:13 pm _on_ April 27, 2021 29. I’m curious how this differs from the [Tide project](https://make.wordpress.org/tide/)? 30. * ![](https://secure.gravatar.com/avatar/9708f3ba1b5d39abd7b3c640ff70eed03c85c5d67a939ea9974c6b5769e75642? s=32&d=mm&r=g) * [Marcel Pol](https://profiles.wordpress.org/mpol/) 6:32 pm _on_ April 27, 2021 * In the existing sniffssniff A module for [PHP Code Sniffer](https://github.com/squizlabs/PHP_CodeSniffer) that analyzes code for a specific problem. Multiple stiffs are combined to create a PHPCS standard. The term is named because it detects [code smells](https://en.wikipedia.org/wiki/Code_smell), similar to how a dog would "sniff" out food. I see deprecated WP functions. But something that has happened to me in the past were new functions that I was already using, but were not available on older WP versions. So if the headerHeader The header of your site is typically the first thing people will experience. The masthead or header art located across the top of your page is part of the look and feel of your website. It can influence a visitor’s opinion about your content and you/ your organization’s brand. It may also look different on different screen sizes. sets ‘Requires at least’ to a certain version, it should only use functions that are available in that least version. The error could be to upgrade the tag or use a different function or a polyfill. - ![](https://secure.gravatar.com/avatar/d49139aae88b36b005da13cd5acf63b1904c3066d020ba0480cb8986d50f9d44? s=32&d=mm&r=g) - [Juliette Reinders Folmer](https://profiles.wordpress.org/jrf/) 4:56 pm _on_ April 28, 2021 - [@mpol](https://profiles.wordpress.org/mpol/) You may already know this, but just in case you don’t… You can actually tell WPCSWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016. exactly what the minimum version is your pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. supports. All WPCS sniffssniff A module for [PHP Code Sniffer](https://github.com/squizlabs/PHP_CodeSniffer) that analyzes code for a specific problem. Multiple stiffs are combined to create a PHPCS standard. The term is named because it detects [code smells](https://en.wikipedia.org/wiki/Code_smell), similar to how a dog would "sniff" out food. which look at things like deprecated functions etc will then that that minimum supported version into account. - For details on how to do this, see the [WPCS wiki page](https://github.com/WordPress/WordPress-Coding-Standards/wiki/Customizable-sniff-properties#minimum-wp-version-to-check-for-usage-of-deprecated-functions-classes-and-function-parameters). * ![](https://secure.gravatar.com/avatar/9708f3ba1b5d39abd7b3c640ff70eed03c85c5d67a939ea9974c6b5769e75642? s=32&d=mm&r=g) * [Marcel Pol](https://profiles.wordpress.org/mpol/) 6:02 pm _on_ April 28, 2021 * Thank you, I just started dabbling with wpcsWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016.. I will check that out. * ![](https://secure.gravatar.com/avatar/9708f3ba1b5d39abd7b3c640ff70eed03c85c5d67a939ea9974c6b5769e75642? s=32&d=mm&r=g) * [Marcel Pol](https://profiles.wordpress.org/mpol/) 6:33 pm _on_ April 27, 2021 * Sorry, I got the threading wrong 🙁 * ![](https://secure.gravatar.com/avatar/5783a2d9b93f04f6d0a1ddabddcfd71f15136d7eaea7a87f9962d3f93f780224? s=32&d=mm&r=g) * [Ian Dunn](https://profiles.wordpress.org/iandunn/) 3:31 pm _on_ April 28, 2021 * I think this could definitely utilize Tide (and Psalm, etc) in addition to WPCSWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016.. But the focus here should be much more narrow IMO: just critical things like security and fatal errors. * So it’s kind of like tailoring WPCS/Tide/etc for the specific needs of the w.org PluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. Directory. My goal is to protect users from the worse experiences, without taking away the freedom of plugin authors to follow their preferences. * That will hopefully be a gateway for many plugin authors, though. Once they see the benefit that WPCS, Tide, etc can give them for the big things, they might also start using them to improve best practices, etc. - ![](https://secure.gravatar.com/avatar/75f0f2c68e98799c913158b3253a84bffe60cb83335db3095b802c89a8aee056? s=32&d=mm&r=g) - [rheinardkorf](https://profiles.wordpress.org/rheinardkorf/) 4:00 am _on_ April 29, 2021 - FWIW, when Tide was released as an open sourceOpen Source Open Source denotes software for which the original source code is made freely available and may be redistributed and modified. Open Source **must be** delivered via a licensing model, see GPL. project the focus was towards serving wordpress. orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. [https://wordpress.org/](https://wordpress.org/) PluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. Directory and its been running static code analysisStatic code analysis "...the analysis of computer software that is performed without actually executing programs, in contrast with dynamic analysis, which is analysis performed on programs while they are executing." - [Wikipedia](https://en.wikipedia.org/wiki/Static_program_analysis) against the directory for a long time now. - The original sniffssniff A module for [PHP Code Sniffer](https://github.com/squizlabs/PHP_CodeSniffer) that analyzes code for a specific problem. Multiple stiffs are combined to create a PHPCS standard. The term is named because it detects [code smells](https://en.wikipedia.org/wiki/Code_smell), similar to how a dog would "sniff" out food. in Tide were catagorized into security, performance and best practices categories (the later being very subjective). This is not the case anymore, but it would not be too difficult to take the reports and narrowing on the sniffs that you care about. - It would be worth joining the Tide chats and seeing what the current status of the project is. It’s a lot simpler now to contribute than before. * ![](https://secure.gravatar.com/avatar/5783a2d9b93f04f6d0a1ddabddcfd71f15136d7eaea7a87f9962d3f93f780224? s=32&d=mm&r=g) * [Ian Dunn](https://profiles.wordpress.org/iandunn/) 3:13 pm _on_ April 29, 2021 * Yeah, I can definitely see us having a custom ruleset for Tide, in addition to WPCSWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016., Psalm, etc. * For now, I’m mostly focused on gathering feedback on what the standard should include, but after that the next step would be to evaluate specific tooling to implement the standard. 31. ![](https://secure.gravatar.com/avatar/81a6c81f384c9d0bf3864240e1f5f197c6a3a1052c7cfc9e3e8fd977365cad4a? s=32&d=mm&r=g) 32. [SimonRWaters](https://profiles.wordpress.org/simonrwaters/) 6:54 pm _on_ April 27, 2021 33. Got caught by a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. using short PHPPHP PHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general- purpose scripting language that is especially suited for web development and can be embedded into HTML. [https://www.php.net/manual/en/index.php](https://www.php.net/manual/en/index.php) tags recently. Suggested plugin PHP files should at least parse (“php -l”) with a default ini file. 34. * ![](https://secure.gravatar.com/avatar/cd257f389c91f137dab25f343b527123e887135b01921ebb6206e40cfa2eb636? s=32&d=mm&r=g) * [Knut Sparhell](https://profiles.wordpress.org/knutsp/) 2:13 am _on_ April 28, 2021 * In case you mean ` What are the current gaps in documentation? 42. The documentation is obtuse and difficult to parse, to be honest. I trust more in random StackOverflow user’s answers than actually finding what I want from the documentation. 43. I figured out how to make plugins from hacking together tutorials and reading other pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. code. And I have a decade of WordPress user experience, and half a decade of PHPPHP PHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. [https://www.php.net/manual/en/index.php](https://www.php.net/manual/en/index.php) experience… I still struggle with WordPress documentation. 44. It’s lightyears behind a lot more modern styles of documentation (like the [React Docs](https://reactjs.org/docs/getting-started.html), The [Vue Docs](https://v3.vuejs.org/guide/introduction.html#what-is-vue-js), [The Laravel Docs,](https://laravel.com/docs/8.x/container), even the MDN has become a amazing source of well-written documentation. 45. How can I help? 46. * ![](https://secure.gravatar.com/avatar/5783a2d9b93f04f6d0a1ddabddcfd71f15136d7eaea7a87f9962d3f93f780224? s=32&d=mm&r=g) * [Ian Dunn](https://profiles.wordpress.org/iandunn/) 5:30 pm _on_ April 28, 2021 * > The documentation is obtuse and difficult to parse… How can I help? * That’s the best kind of critique, kudos for the great attitude! * [The Docs team](https://make.wordpress.org/docs/) has [some onboarding docs](https://make.wordpress.org/docs/handbook/) that will hopefully get you started. The `#docs` channel on [our Slack workspace](https://make.wordpress.org/chat/) is a great resource too. 47. ![](https://secure.gravatar.com/avatar/da1872b45f2e9bc6c66ff94d1d99d6fbb3bf7d3af5b5c1eeb870384fb7da3881? s=32&d=mm&r=g) 48. [Mikko Saari](https://profiles.wordpress.org/msaari/) 3:07 am _on_ April 28, 2021 49. It might be useful to check for minimum PHPPHP PHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. [https://www.php.net/manual/en/index.php](https://www.php.net/manual/en/index.php) version; before I implemented minimum PHP version checking on my own tooling ( I now have VS Code warn me if I do something that isn’t PHP 7.0 legal), I got burnt a couple of times for using code that was too advanced. 50. So, instead of just relying the pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. developer setting the minimum PHP version for the plugin, it might be useful to actually check which PHP version is required and especially alert the developer if the declared minimum PHP version and the code actually used don’t match. 51. * ![](https://secure.gravatar.com/avatar/9e6583bcbe4831c87f40523ded6be4ca1ad48833133bd542c4672d4ca4e54081? s=32&d=mm&r=g) * [Gary Jones](https://profiles.wordpress.org/garyj/) 11:07 am _on_ April 29, 2021 * Running the [PHPCompatibilityWP](https://github.com/PHPCompatibility/PHPCompatibilityWP) standard over submissions, if the Requires PHPPHP PHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. [https://www.php.net/manual/en/index.php](https://www.php.net/manual/en/index.php): heading is set (or defined in a Composer file), may be useful. 52. ![](https://secure.gravatar.com/avatar/8c541ac2ff7954183eef79106254fadc5e3d508d5542f706778ece0d4a68b397? s=32&d=mm&r=g) 53. [janw.oostendorp](https://profiles.wordpress.org/janwoostendorp/) 2:00 pm _on_ April 28, 2021 54. I would not be against such a system if a developer can turn it off. A pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress. org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. can have good reasons to make exceptions to sniffssniff A module for [PHP Code Sniffer](https://github.com/squizlabs/PHP_CodeSniffer) that analyzes code for a specific problem. Multiple stiffs are combined to create a PHPCS standard. The term is named because it detects [code smells](https://en.wikipedia.org/wiki/Code_smell), similar to how a dog would "sniff" out food., several have already been mentioned above. 55. But for developers that aren’t familiar with phpcsPHP Code Sniffer [PHP Code Sniffer,](https://github.com/squizlabs/PHP_CodeSniffer) a popular tool for analyzing code quality. The [WordPress Coding Standards](https://github.com/WordPress/WordPress-Coding-Standards/) rely on PHPCS. might be helped, they might see some errors and be triggered into looking into it. And developers familiar with phpcs can just use their own implementation and turn it off. 56. Such a system would also have to keep in mind not overwhelming newcomers. The first time I enabled phpcs on an existing (1 php-file) plugin. It was a bit overwhelming to me and I was actively looking to improve my code. 57. Adding several “levels” of severity might help trim that down. For example only show the critical errors for starter. 58. ![](https://secure.gravatar.com/avatar/241584c8900ae5ccd62ff4c9db7d58e58bc9e0dc0162d4bdcac2a916d586c7ed? s=32&d=mm&r=g) 59. [Francesca Marano](https://profiles.wordpress.org/francina/) 3:40 pm _on_ April 28, 2021 60. +make.wordpress.org/core 61. ![](https://secure.gravatar.com/avatar/f177e770b035389ec065534539ac16c73c5e4bf2b41ece68336c7119f0b9c6f5? s=32&d=mm&r=g) 62. [Sergey Biryukov](https://profiles.wordpress.org/sergeybiryukov/) 9:10 pm _on_ April 28, 2021 63. Helping pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. authors to catch fatal errors and security issues early on seems great to me, but we need to find the right balance between catching legitimate issues and creating extra noise with false positives. 64. Some questions that come to mind: 65. * How do we make sure to improve the developer experience here, not make it worse? * How can we make the check results helpful for plugin authors, not overwhelming? 66. There are some existing issues with developer experience as is, for example forward compatibility with PHPPHP PHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. [https://www.php.net/manual/en/index.php](https://www.php.net/manual/en/index.php) 8 can be [errouneously flagged as a parse error](https://meta.trac.wordpress.org/ticket/3791#comment:30). 67. There were also some previous discussions on [displaying PHP Compatibility results from Tide on WP.org](https://meta.trac.wordpress.org/ticket/4309), I wonder if we could investigate and reuse something from there. 68. Personally, I think a more close collaboration with the WPCSWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016. maintainers and the Plugin Review team would be helpful here. 69. ![](https://secure.gravatar.com/avatar/d49139aae88b36b005da13cd5acf63b1904c3066d020ba0480cb8986d50f9d44? s=32&d=mm&r=g) 70. [Juliette Reinders Folmer](https://profiles.wordpress.org/jrf/) 8:25 am _on_ April 29, 2021 71. If I understand things correctly, the goal of this project is to improve the experience of end-users with WordPress by improving their experience with plugins. 72. I can only applaud that idea. 73. However, other than the goal itself, this project leaves a lot to be desired. 74. I see no plan. I see no information backing up the claim that users often have bad experiences with plugins. I see no research into why there are (presumably) so many bad plugins. I see no research into whether these (presumed) bad experiences are with plugins from the wp.org repo versus plugins downloaded elsewhere, whether via commercial sites or otherwise. … etc, etc 75. In short, I see a technical “solution” being prototyped, while the actual problem hasn’t even been properly defined. 76. PHPPHP PHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. [https://www.php.net/manual/en/index.php](https://www.php.net/manual/en/index.php) has a low barrier of entry compared to a lot of programming languages. Similarly, WordPress has a low barrier of entry compared to a lot of other programming frameworks. 77. It is really easy for someone to cobble together a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost- based plugin from a third-party. with some copy & pasting from various sources( StackOverflow anyone?) without being hindered by any actual understanding of WordPress, let alone PHP. 78. Now, why does this happen ? Well, I’d wager a guess to say that this happens because developers want to code and can’t be bothered with reading the documentation, asking people about the proper way to go about things or finding the right tools to help them. 79. Which brings me back to this project. 80. I’m very happy to see that sniffssniff A module for [PHP Code Sniffer](https://github.com/squizlabs/PHP_CodeSniffer) that analyzes code for a specific problem. Multiple stiffs are combined to create a PHPCS standard. The term is named because it detects [code smells](https://en.wikipedia.org/wiki/Code_smell), similar to how a dog would "sniff" out food. from WPCSWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016. will be used, but will this help if the average plugin/theme developer has never even heard of WPCS and doesn’t know what it is, let alone how to install it ? I mean, last time I looked WPCS is still not mentioned anywhere except in the Core contributorsCore Contributors Core contributors are those who have worked on a release of WordPress, by creating the functions or finding and patching bugs. These contributions are done through Trac. [https://core.trac.wordpress.org](https://core.trac.wordpress.org) guide and even there, the information is minimal. 81. I’m very happy to see improving the documentation being mentioned, but will this help if people don’t bother to read it ? 82. Automated PHP linting against parse errors is one thing, any other form of automated scanning coupled with publicly available results which can really easily be misinterpreted by non-technical end-users and give good plugins a bad reputation, is – in my humble option – just a really bad idea™. 83. Defaming of plugins/themes based on tools that most plugin/theme devs aren’t even aware of exist, is going about things the wrong way round. 84. I’d like to kindly suggest taking a few steps back and rethinking whether what is currently being proposed will actually contribute to achieving the original goal or whether it will only cause friction and alienate good people. 85. Maybe then we can have a constructive conversation about how to move forward. 86. * ![](https://secure.gravatar.com/avatar/9e6583bcbe4831c87f40523ded6be4ca1ad48833133bd542c4672d4ca4e54081? s=32&d=mm&r=g) * [Gary Jones](https://profiles.wordpress.org/garyj/) 11:22 am _on_ April 29, 2021 * I have to agree. * I read the original post as “We have these cool toys – how can we use them?” rather than “We have a serious problem with pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. developers [not escaping output |not securely writing custom SQL queries |using PHPPHP PHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. [https://www.php.net/manual/en/index.php](https://www.php.net/manual/en/index.php) code that doesn’t work the same or doesn’t exist in PHP 8]; how can we fix that specific problem?”. * The only definition of the problem is “to know the most secure way to implement something”, followed by one example, which is so vague as to not be that useful. More discovery is needed to establish the scale of the perceived problem before thinking about the implementation details of a solution. * As the next step, the Feedback questions are heading in the right direction. * > What are the current gaps in functionality that CoreCore Core is the set > of software required to run WordPress. The Core Development Team builds > WordPress. provides to plugins? * I’ll add another – escaping of echoed attribute names or attribute=value pairs. - ![](https://secure.gravatar.com/avatar/5783a2d9b93f04f6d0a1ddabddcfd71f15136d7eaea7a87f9962d3f93f780224? s=32&d=mm&r=g) - [Ian Dunn](https://profiles.wordpress.org/iandunn/) 4:13 pm _on_ April 29, 2021 - > escaping of echoed attribute names or attribute=value pairs. - That’s a good one, thanks! It looks like that’s being tracked in [#43010-core](https://core.trac.wordpress.org/ticket/43010). * ![](https://secure.gravatar.com/avatar/5783a2d9b93f04f6d0a1ddabddcfd71f15136d7eaea7a87f9962d3f93f780224? s=32&d=mm&r=g) * [Ian Dunn](https://profiles.wordpress.org/iandunn/) 4:12 pm _on_ April 29, 2021 * It’s becoming clear to me from many comments that I miscommunicated my intent in the post, so I apologize for that. I’m not proposing that we ask folks to install WPCSWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016., display scanner results publicly, shame anybody, etc. * The only goal I have with this post is to gather feedback on what the standard should include. * Once we have that, then we can gather data on the degree to which plugins meet the standard. And then we can discuss what do with the data (maybe email results to authors after each commit, integrate docs into that email, etc). - ![](https://secure.gravatar.com/avatar/d49139aae88b36b005da13cd5acf63b1904c3066d020ba0480cb8986d50f9d44? s=32&d=mm&r=g) - [Juliette Reinders Folmer](https://profiles.wordpress.org/jrf/) 4:19 pm _on_ April 29, 2021 - Apparently my post still wasn’t clear enough as when talking about a standard, you are still talking about a technical implementation for a problem which may not even exist, but at the very least isn’t clearly defined. - Starting at the beginning instead of in the middle may be more helpful. 87. ![](https://secure.gravatar.com/avatar/db79d5416d942e5fd9415b136feefd2da7929cc39853b4c30bafff4ceb8ef219? s=32&d=mm&r=g) 88. [Daniele Scasciafratte](https://profiles.wordpress.org/mte90/) 9:08 am _on_ April 29, 2021 89. This is not something that the Tide project was doing? [https://make.wordpress.org/tide/](https://make.wordpress.org/tide/) 90. * ![](https://secure.gravatar.com/avatar/5783a2d9b93f04f6d0a1ddabddcfd71f15136d7eaea7a87f9962d3f93f780224? s=32&d=mm&r=g) * [Ian Dunn](https://profiles.wordpress.org/iandunn/) 3:15 pm _on_ April 29, 2021 * Yeah, [we could definitely utilize Tide when we get to the implementation phase](https://make.wordpress.org/meta/2021/04/27/automatically-catching-bugs-in-plugins/#comment-9150), but for now I’m just trying to gather feedback on the what the standard should include. It’ll likely be much more narrow that what Tide, WPCSWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016., etc, output by default. 91. ![](https://secure.gravatar.com/avatar/2e79381a73b417f6b89e478127c3e4e171cd34236cfa1afb8d430e6ad987aa4a? s=32&d=mm&r=g) 92. [Thomas Patrick Levy](https://profiles.wordpress.org/thomasplevy/) 4:26 pm _on_ April 30, 2021 93. Hi from a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. dev 94. It would be important to me that anything is opt-in — at least to start. Mostly because I already deal with a large amount of “noise”. When starting any amount of new automation (in my experience) every piece of output from the tool feels like a ton of overwhelming noise and I need to be able to choose when I can start doing something with the information. 95. My team already has our coding standards (a modified version of the WPCSWordPress Community Support A public benefit corporation and a subsidiary of the WordPress Foundation, [established](https://wordpressfoundation.org/news/2016/introducing-wordpress-community-support-a-public-benefit-subsidiary/) in 2016. standards, mostly modified to make our lives easier when it comes to updating legacy files and code created before we adopted the standards) and we already run an amount of automated testing. 96. I wouldn’t want to create a new set of rules for us requiring updates to a large number of files to silence warnings or notices from a new standard. 97. Adding WPCS to our project was really valuable to me. I still learn things regularly from the standards and I’m grateful for the work that’s been put into these projects to make it easy for my team to use them. 98. Adding things like WPCS and unit/integration and e2e tests to a project was a bit of a time consuming process. Once up and running it’s very valuable but it was time consuming and there was a lot to learn. This feels like it could be a step towards lowering a barrier of entry to automating things. 99. Finally, I wonder if there’s any value in a stock unit test suite for plugins( like there is for themes). Obviously themes have a much simpler task in that every theme should have an archive, a single post, etc… whereas plugins don’t fit into a neat box. But an amount of testing could still help with some standard things that should still work when a plugin is running, one thing I’ve seen enough times to know to look for it is when a plugin echos the content of a shortcodeShortcode A shortcode is a placeholder used within a WordPress post, page, or widget to insert a form or function generated by a plugin in a specific location on your site. instead of returning it. (Maybe a moot point since we’re working towards getting rid of shortcodes, right?) 100. There could be automation around making sure that kind of thing is done right. ### Leave a Reply 󠀁[Cancel reply](https://make.wordpress.org/meta/2021/04/27/automatically-catching-bugs-in-plugins/?output_format=md#respond)󠁿 You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fmake.wordpress.org%2Fmeta%2F2021%2F04%2F27%2Fautomatically-catching-bugs-in-plugins%2F&locale=en_US) to post a comment. # Post navigation [← Theme test results added to Trac tickets](https://make.wordpress.org/meta/2021/03/18/theme-test-results-added-to-trac-tickets/) [New WordPress Make Team →](https://make.wordpress.org/meta/2021/04/27/new-wordpress-make-team/)