Title: Clarification of Guideline 8 – Executable Code and Installs Author: Ipstenu (Mika Epstein) Published: March 16, 2017 --- [ ](https://profiles.wordpress.org/ipstenu/) [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 9:57 pm _on_ March 16, 2017 Tags: [guidelines ( 27 )](https://make.wordpress.org/plugins/tag/guidelines/) # Clarification of Guideline 8 – Executable Code and Installs Since Jetpack announced it installs themes, a number of people have asked if this is a violation of the 8th guideline: > The pluginPlugin A plugin is a piece of software containing a group of functions > that can be added to a WordPress website. They can extend functionality or add > new features to your WordPress websites. WordPress plugins are written in the > PHP programming language and integrate seamlessly with WordPress. These can be > free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) > or can be cost-based plugin from a third-party. may not send executable code via > third-party systems. And in specific, these two items: > * Serving updates or otherwise installing plugins, themes, or add-ons from servers > other than WordPress.orgWordPress.org The community site where WordPress code > is created and shared by the users. This is where you can download the source > code for WordPress core, plugins and themes as well as the central location > for community conversations and organization. [https://wordpress.org/](https://wordpress.org/)’ > s > * Installing premium versions of the same plugin The short answer is no, it’s not, and yes, you could do this too. The longer answer involves understanding the intent of this guideline, which initially was to prevent nefarious developers from using your installs as a botnet. In addition, it’s used to disallow plugins that exist only to install products from other locations, without actually being of use themselves (ie. marketplace only plugins). Finally it’s there to prevent someone silly from making a plugin that installs a collection of ‘cool plugins’ they found from GitHubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. [https://github.com/](https://github.com/) and want to make easier to install. Which actually did happen once. Plugins are expected to do ‘something’ to your site. A plugin that exists only to check a license and install a product, while incredibly useful, is not something we currently allow as a standalone product. This is why we allow plugins to have the in-situ code for updates that is used by their add-on plugins. The plugin _we_ host has to use WordPress.org to update itself. In addition, we _do_ permit valid services to perform actions of installations onto sites, and have for a very long time. ManageWP, for example, has had this ability for quite a while. It provides a valid service, letting you manage multiple sites from their dashboard, and yes, install and update plugins. Going back to the example of a plugin that hosts the update code for it’s addons, the ‘service’ is the license you bought for the add-on plugin. The trick here, and this is what is about to sound like hair splitting, is that it’s not the plugin UIUI UI is an acronym for User Interface - the layout of the page the user interacts with. Think ‘how are they doing that’ and less about what they are doing. on your site that does the install. In order for Manage WP and Jetpack to work, you have to go to your panel on their sites and install the items. If you wanted to make, say, `my.servicename.com` and let people log in, authenticate their sites, and from that interface use a JSONJSON JSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. to trigger an install, you absolutely, 100%, totally can. To hit the major talking points: * Is Jetpack allowed to do this? Yes. * Are _you_ allowed to do this? Yes. * Can you have your plugin install things? No. * Can your _service_ install things onto a connected site? Yes. * Are you allowed to have a marketplace plugin? Not at this time. I know this is frustrating to a lot of people. The reason it never came up before is no one asked us, and it isn’t our place to run your business or invent all the cool things. The guidelines are guidelines, and not laws or rules, to allow people to interpret them, and you’re always welcome to ask us if something’s okay or not. Or warn us if you’re about to do something you think might get the masses up in a dander. [#guidelines](https://make.wordpress.org/plugins/tag/guidelines/) ### Share this: * [ Threads ](https://make.wordpress.org/plugins/2017/03/16/clarification-of-guideline-8-executable-code-and-installs/?share=threads) * [ Mastodon ](https://make.wordpress.org/plugins/2017/03/16/clarification-of-guideline-8-executable-code-and-installs/?share=mastodon) * [ Bluesky ](https://make.wordpress.org/plugins/2017/03/16/clarification-of-guideline-8-executable-code-and-installs/?share=bluesky) * [ X ](https://make.wordpress.org/plugins/2017/03/16/clarification-of-guideline-8-executable-code-and-installs/?share=x) * [ Facebook ](https://make.wordpress.org/plugins/2017/03/16/clarification-of-guideline-8-executable-code-and-installs/?share=facebook) * [ LinkedIn ](https://make.wordpress.org/plugins/2017/03/16/clarification-of-guideline-8-executable-code-and-installs/?share=linkedin) 1. ![](https://secure.gravatar.com/avatar/49ce6f509c945b9c9009f75cae274d4d827e26b25616141df82e4fbdfaa207c8? s=32&d=mm&r=g) 2. [Josh Pollock](https://profiles.wordpress.org/shelob9/) 10:14 pm _on_ March 16, 2017 3. Thanks for the clarification. I know this is a hard balance between two important goals – allow developers to provide a quality user experience and protect end users from poorly written updaters that lead to arbitrary file execution. 4. I am not entirely clear though on the distinction between a service that allows updates and updates from inside wp-admin. 5. Are you saying that if inside of WordPress a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. asks for APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. key and then provides updates as a service (like Gravity Forms does) that is not allowed, but if a separate site allows you to enter an API key from WordPress and remote update that WordPress site that is OK? 6. If so, I’m wondering what the difference is? In both situations the theme or plugin will need to be running code that allows modifying plugin or theme files, right? I know the difference is button location, but that seems superficial. 7. * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 10:26 pm _on_ March 16, 2017 * You already have to buy Gravity Forms, and they push updates from their site— it’s not hosted here. If it was, though, and you installed add-ons manually, they’re currently allowed to ‘self update’ via code that would be included in Gravity Forms. Gravity Forms itself would not be able to self update (it’d have to use the .org updater). * Sideways. If instead of having the updater, Gravity Forms made their own optional oauth (since they’re not by default a service – everything runs locally), and that connected to my.gravityforms.com where you could buy plugins, and it used the JSONJSON JSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. to install them, yeah. That’s okay. * In both cases, the purchase is always from their site, not the pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party./wp-admin. The difference being the use of an API to push vs the updater to pull. * ![](https://secure.gravatar.com/avatar/250257111d1248c34046552bbcdf6999949ef56b2f992dd5eb39bf45cabeb18a? s=32&d=mm&r=g) * [Samuel Wood (Otto)](https://profiles.wordpress.org/otto42/) 10:27 pm _on_ March 16, 2017 * TBH, I was confused that other people were confused about this particular guideline. Took some explaining by Mika to get me to understand the confusion surrounding it. * The key phrase that I used which I now understand why people don’t get it is“ third-party systems”. * If you have a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. like ManageWP, and you go to their site, sign up for their service, and use their system to install plugins/ themes/whatever to your own site, then that’s not a third-party anymore. That’s a first-party. You’re directly interacting with their service to do these installations. * ManageWP has a “bulk-install” feature right in the description, so I never thought they had any limitations on such. They can install whatever they want. You’re paying them for the service, presumably. * You say that the difference in button-location is superficial, but it really is not. The difference is in whether you’re having the plugin do the install, or whether you (in the form of your service) are doing the install on the part of the user. If it goes wrong, then you are to blame for it, directly, by the user. They know what you did. They asked you (in the form of your service) to do it. It’s about accountability and responsibility and blame. * The intent of the guidelines is to prevent user confusion. People do not understand the differences between “WordPress” and “stuff that plugins or themes add to WordPress”. But they very well understand the difference between the back end of their WordPress installation and whatever service you have on some totally different site. They kinda have to, as it’s a different website. * Yes, plugins can have hooksHooks In WordPress theme and development, hooks are functions that can be applied to an action or a Filter in WordPress. Actions are functions performed when a certain event occurs in WordPress. Filters allow you to modify certain functions. Arguments used to hook both filters and actions look the same. for external services to do things to their site with. That includes making posts, or reposting tweets, or even installing plugins and themes. But the initiating action should a) come from the user and b) not be coming from the user interacting with what they see as “WordPress” when what they are really interacting with is “your service”. * As for plugins downloading updates to themselves from elsewhere, that’s not allowed at all. The WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. [https://wordpress.org/](https://wordpress.org/) plugin directory is a hosting service, not a listing service. Otherwise, that would negate the point entirely. A plugin that wanted to do “bad things” could simply put the bad things somewhere else and then download them itself from there. Obviously, that’s not okay. - ![](https://secure.gravatar.com/avatar/49ce6f509c945b9c9009f75cae274d4d827e26b25616141df82e4fbdfaa207c8? s=32&d=mm&r=g) - [Josh Pollock](https://profiles.wordpress.org/shelob9/) 1:37 am _on_ March 17, 2017 - Mika – I was using Gravity Forms as an example beacuse thier add-on installer is a great service to their users and wish I could have such a thing in my pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party.. I was under the impression I could not. - Would I be allowed, to have in the admin of my plugin distributed on WordPress. orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. [https://wordpress.org/](https://wordpress.org/) a place for customers to enter an APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. key they purchased at my site that would then install add-ons they purchased on my sitr (when they click an install button in my admin page) that was served over a JSONJSON JSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. API? - The main plugin they installed from WordPress.org would still be updated via WordPress. I’m talking about that plugin to provide install for add- ons via a JSON API. - Thanks for the clarifications. * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 2: 34 am _on_ March 17, 2017 * I admit I’m not familiar with Gravity Forms and their add on structure, so if I sound vague, it’s literally because I don’t use it so I don’t have a frame of reference for it 🙂 * > Would I be allowed, to have in the admin of my pluginPlugin A plugin > is a piece of software containing a group of functions that can be > added to a WordPress website. They can extend functionality or add > new features to your WordPress websites. WordPress plugins are written > in the PHP programming language and integrate seamlessly with WordPress. > These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) > or can be cost-based plugin from a third-party. distributed on WordPress. > orgWordPress.org The community site where WordPress code is created > and shared by the users. This is where you can download the source > code for WordPress core, plugins and themes as well as the central > location for community conversations and organization. [https://wordpress.org/](https://wordpress.org/) > a place for customers to enter an APIAPI An API or Application Programming > Interface is a software intermediary that allows programs to interact > with each other and share data in limited, clearly defined ways. key > they purchased at my site that would then install add-ons they purchased > on my sitr (when they click an install button in my admin page) that > was served over a JSONJSON JSON, or JavaScript Object Notation, is > a minimal, readable format for structuring data. It is used primarily > to transmit data between a server and web application, as an alternative > to XML. API? * Provided your plugin was a legit plugin and it’s a legit service, yes. Based on what you’ve said about gravity forms, if they handled it that way and wanted to be hosted on .org, I see no problems. - ![](https://secure.gravatar.com/avatar/800399fc620b8b77d0fe690317e549266757e0386d789220764346328a66b8a1? s=32&d=mm&r=g) - [Gary Bairead](https://profiles.wordpress.org/gary-barrett/) 5:39 pm _on_ March 17, 2017 - > You say that the difference in button-location is superficial, but it > really is not. The difference is in whether you’re having the pluginPlugin > A plugin is a piece of software containing a group of functions that can > be added to a WordPress website. They can extend functionality or add > new features to your WordPress websites. WordPress plugins are written > in the PHP programming language and integrate seamlessly with WordPress. > These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) > or can be cost-based plugin from a third-party. do the install, or whether > you (in the form of your service) are doing the install on the part of > the user. - Would it be acceptable if the plugin opens an install panel/button from a theme authors site in a lightbox inside wp-admin? - The install process would still happen via the service on the first-party theme authors site. * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 6: 00 pm _on_ March 17, 2017 * It needs to be on the service account on the theme author’s domain. * Otto explained it well I think: * > People do not understand the differences between “WordPress” and “stuff > that plugins or themes add to WordPress”. But they very well understand > the difference between the back end of their WordPress installation > and whatever service you have on some totally different site. They > kinda have to, as it’s a different website. * Basically a lightbox, a user has no idea if that’s WP or your service, but going to `yourservice.yoursite.com` is much more clear. This is you asking as SERVICE to do this. So if it blows up your site, you know who to talk to. - ![](https://secure.gravatar.com/avatar/800399fc620b8b77d0fe690317e549266757e0386d789220764346328a66b8a1? s=32&d=mm&r=g) - [Gary Bairead](https://profiles.wordpress.org/gary-barrett/) 6:18 pm _on_ March 17, 2017 - Having to go to a separate site does make it clear, but it also creates an inconvenient UXUX UX is an acronym for User Experience - the way the user uses the UI. Think ‘what they are doing’ and less about how they do it.. - If an admin notice is added that clarifies exactly what is happening, which a user would have to click “ok/accept” before they can install the themes, would that be acceptable? * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 9:21 pm _on_ March 17, 2017 * No. Not today. We may revisit this in the future, but right now, the inconvenient UXUX UX is an acronym for User Experience - the way the user uses the UI. Think ‘what they are doing’ and less about how they do it. of going to another site is worth the clarity for the end users. - ![](https://secure.gravatar.com/avatar/800399fc620b8b77d0fe690317e549266757e0386d789220764346328a66b8a1? s=32&d=mm&r=g) - [Gary Bairead](https://profiles.wordpress.org/gary-barrett/) 9:32 pm _on_ March 17, 2017 - It’s disappointing that obtaining explicit user consent isn’t deemed sufficient; back to the drawing board for me then 🙂 - Thanks for taking the time to for clarify that Mika. - ![](https://secure.gravatar.com/avatar/1e077c2f5c78e83b780ec6db3358327349d986a26d0e41905bbbb4dc816b0748? s=32&d=mm&r=g) - [carlhancock](https://profiles.wordpress.org/carlhancock/) 10:02 pm _on_ March 20, 2017 - > Basically a lightbox, a user has no idea if that’s WP or your service, > but going to `yourservice.yoursite.com` is much more clear. This > is you asking as SERVICE to do this. So if it blows up your site, > you know who to talk to. - A modal that is clearly branded as the service, and requires you to login with your login for the service to continue, wouldn’t be clear enough? - I could understand if there is nothing to distinguish between your WordPress Dashboard and the contents of the modal because they looked exactly the same. - There isn’t the same confusion when connecting a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. to a service via oAuth authentication that appears in a modal, so how would this be any different? It would basically be the same thing. Only instead of oAuth authentication you’d login and approve add-on installation. - Also, a modal window doesn’t have to be a lightbox. A modal can be a new browser window that is sized more like a lightbox so that it’s smaller and a new window. Which would meet the requirements you mentioned. So i’m not sure what the difference would be with doing that vs. a lightbox as long as the content is branded appropriately? - I’m not sure how a lightbox that is branded as the service, and requires them to login with their username/password for the service, would cause confusion for the user as to WordPress vs. the service. * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 10:48 pm _on_ March 20, 2017 * Actually there IS the same confusion with oauth. 🙂 The oauth model is why we know it’s not enough. Go grab a happiness engineer and ask how many times people complained their .org site’s password doesn’t work on .com. Buy ’em a drink first. * Anyway, at least by forcing them to go over to your sites, we’re taking that extra step. Plus now you take one step out of the chain of someone’s credit card information being snipped by another evil pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress. org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. on their site. - ![](https://secure.gravatar.com/avatar/1e077c2f5c78e83b780ec6db3358327349d986a26d0e41905bbbb4dc816b0748? s=32&d=mm&r=g) - [carlhancock](https://profiles.wordpress.org/carlhancock/) 11:14 pm _on_ March 20, 2017 - I’d say I’m surprised but I’d be lying. Nothing surprised anymore as it relates to users not understanding things. So I get it. - Does this apply to all modals or only lightbox style modals that exist within the same browser window? - What about modals that consist of a new browser window with the address bar visible, etc.? * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 3:20 pm _on_ March 21, 2017 * All modals. * Use a new browser tab/window right now. * IF this changes, and that’s a BIG IF, we’ll post and explain it full details. (Guess what I get to do at WCEU now? 😉 ) - ![](https://secure.gravatar.com/avatar/800399fc620b8b77d0fe690317e549266757e0386d789220764346328a66b8a1? s=32&d=mm&r=g) - [Gary Bairead](https://profiles.wordpress.org/gary-barrett/) 11:58 am _on_ March 21, 2017 - > Go grab a happiness engineer and ask how many times people > complained their .org site’s password doesn’t work on .com - It’s easy to see why users could be confused in that specific instance when both are called ‘WordPress’. * ![](https://secure.gravatar.com/avatar/1e077c2f5c78e83b780ec6db3358327349d986a26d0e41905bbbb4dc816b0748? s=32&d=mm&r=g) * [carlhancock](https://profiles.wordpress.org/carlhancock/) 12:32 pm _on_ March 21, 2017 * Actually I wasn’t even thinking about that aspect. You are correct Gary. Any confusion there is with oAuth in Jetpack has nothing to do with anything other than longstanding confusion users have over WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. [https://wordpress.org/](https://wordpress.org/) vs WordPress.comWordPress.com An online implementation of WordPress code that lets you immediately access a new WordPress environment to publish your content. WordPress.com is a private company owned by Automattic that hosts the largest multisite in the world. This is arguably the best place to start blogging if you have never touched WordPress before. [https://wordpress.com/](https://wordpress.com/). * Tons of plugins have oAuth integration for connecting to services and I doubt the same confusion exists. * Any confusion with Jetpack is going to be a direct result of the general confusion caused by both .org and .com being called WordPress. - ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) - [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 3:18 pm _on_ March 21, 2017 - I grabbed Jetpack as a simple example, but it’s actually( in my experience based on angry emails to plugins) _WORSE_ for one-off small companies! * ![](https://secure.gravatar.com/avatar/1e077c2f5c78e83b780ec6db3358327349d986a26d0e41905bbbb4dc816b0748? s=32&d=mm&r=g) * [carlhancock](https://profiles.wordpress.org/carlhancock/) 3:34 pm _on_ March 21, 2017 * Appreciate the continued discussion and clarification Mika! * Although i’d say we are pushing the limits of the comments UIUI UI is an acronym for User Interface - the layout of the page the user interacts with. Think ‘how are they doing that’ and less about what they are doing. for this theme LOL. - ![](https://secure.gravatar.com/avatar/250257111d1248c34046552bbcdf6999949ef56b2f992dd5eb39bf45cabeb18a? s=32&d=mm&r=g) - [Samuel Wood (Otto)](https://profiles.wordpress.org/otto42/) 9:56 pm _on_ March 21, 2017 - As Carl correctly points out, the comment UIUI UI is an acronym for User Interface - the layout of the page the user interacts with. Think‘ how are they doing that’ and less about what they are doing. has been exceeded for this theme, so I have adjusted the settings for this site to only allow 5 levels of nested comments. Due to ludicrously small widths. - So if you can’t reply directly to something anymore, that’s why. Start a new thread instead. 🙂 8. ![](https://secure.gravatar.com/avatar/542c93f45f2a6622d0929c5cdd26e24b43222d78c2bd4e25c30cec6f3ea354d8? s=32&d=mm&r=g) 9. [Thomas Griffin](https://profiles.wordpress.org/griffinjt/) 10:18 pm _on_ March 16, 2017 10. > In order for Manage WP and Jetpack to work, you have to go to your panel on > their sites and install the items. If you wanted to make, say, my.servicename. > com and let people log in, authenticate their sites, and from that interface > use a JSONJSON JSON, or JavaScript Object Notation, is a minimal, readable format > for structuring data. It is used primarily to transmit data between a server > and web application, as an alternative to XML. APIAPI An API or Application > Programming Interface is a software intermediary that allows programs to interact > with each other and share data in limited, clearly defined ways. to trigger > an install, you absolutely, 100%, totally can. 11. So, in a nutshell, you are advocating that plugins that can be installed from . org can act as webhook receivers to be able to execute remote code from 3rd party platforms? I just want to clarify because this is the method currently being used and is what is being advocated from these terms. 12. * ![](https://secure.gravatar.com/avatar/542c93f45f2a6622d0929c5cdd26e24b43222d78c2bd4e25c30cec6f3ea354d8? s=32&d=mm&r=g) * [Thomas Griffin](https://profiles.wordpress.org/griffinjt/) 10:26 pm _on_ March 16, 2017 * (since I can’t seem to edit my comment?) – I wanted to make sure I said thank you for taking the time to clarify and willingness to receive pushback. I appreciate all you do for WP! 🙂 - ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) - [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 10:36 pm _on_ March 16, 2017 - You’re welcome 🙂 * ![](https://secure.gravatar.com/avatar/250257111d1248c34046552bbcdf6999949ef56b2f992dd5eb39bf45cabeb18a? s=32&d=mm&r=g) * [Samuel Wood (Otto)](https://profiles.wordpress.org/otto42/) 10:31 pm _on_ March 16, 2017 * Yes, it is allowed for services to do things to your site through a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party., and some of those things can sometimes run code from that service. * Did you know that VaultPress can run code directly on your site over an SSHSSH Secure SHell - a protocol for securely connecting to a remote system in addition to or in place of a password. connection? That’s how they do some of the backup processes, if you give them an SSH key. That’s why you give them the SSH key, in fact. * The key here is that it must be a service the user is interacting with directly. Then it’s not a third-party anymore. Then the user isn’t blaming WordPress for doing things to their site, because it’s the service doing things to their site. - ![](https://secure.gravatar.com/avatar/542c93f45f2a6622d0929c5cdd26e24b43222d78c2bd4e25c30cec6f3ea354d8? s=32&d=mm&r=g) - [Thomas Griffin](https://profiles.wordpress.org/griffinjt/) 10:34 pm _on_ March 16, 2017 - Solid – thanks for the further clarification! * ![](https://secure.gravatar.com/avatar/250257111d1248c34046552bbcdf6999949ef56b2f992dd5eb39bf45cabeb18a? s=32&d=mm&r=g) * [Samuel Wood (Otto)](https://profiles.wordpress.org/otto42/) 10:49 pm _on_ March 16, 2017 * Before you rush off, note that it’s extremely hard to do this securely, so expect heavy scrutiny on it, for security reasons. * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 10:31 pm _on_ March 16, 2017 * Kind of. The intent of ‘no remote code!’ really is “Don’t use users as bot- nets!” (autocorrect really wants that to be bonnets…). So if you’re a legit service, providing a real service, then yes. But if you make up a service just to install things without providing added value, then no. * Again we’re talking about plugins that are **valid** services. Someone already submitted a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. that just installed random 3rd party plugins they thought were super cool. That’s not a valid service. * EDD, Yoast, ManageWP, every single backup plugin, or a plugin that migrated your site from Host A to Host B — those would be okay because again they’re actual services 🙂 - ![](https://secure.gravatar.com/avatar/542c93f45f2a6622d0929c5cdd26e24b43222d78c2bd4e25c30cec6f3ea354d8? s=32&d=mm&r=g) - [Thomas Griffin](https://profiles.wordpress.org/griffinjt/) 10:35 pm _on_ March 16, 2017 - I appreciate the response and clarifications Mika! 13. ![](https://secure.gravatar.com/avatar/1e077c2f5c78e83b780ec6db3358327349d986a26d0e41905bbbb4dc816b0748? s=32&d=mm&r=g) 14. [carlhancock](https://profiles.wordpress.org/carlhancock/) 10:42 pm _on_ March 16, 2017 15. So if I understand this correctly: 16. Say ManageWP wants to provide it’s users with an exclusive ManageWP repository of themes and plugins via the ManageWP hosted admin and allow users to install those exclusive themes and plugins using the ManageWP admin which communicates with their site to install the theme or pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. via the ManageWP worker plugin that is freely available in the WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. [https://wordpress.org/](https://wordpress.org/) plugin repository. 17. They would be allowed to do so based on the clarification above. Correct? 18. * ![](https://secure.gravatar.com/avatar/250257111d1248c34046552bbcdf6999949ef56b2f992dd5eb39bf45cabeb18a? s=32&d=mm&r=g) * [Samuel Wood (Otto)](https://profiles.wordpress.org/otto42/) 10:50 pm _on_ March 16, 2017 * I would have thought they had something like this already. The worker has install functionality. They advertise bulk pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. installs. - ![](https://secure.gravatar.com/avatar/1e077c2f5c78e83b780ec6db3358327349d986a26d0e41905bbbb4dc816b0748? s=32&d=mm&r=g) - [carlhancock](https://profiles.wordpress.org/carlhancock/) 10:58 pm _on_ March 16, 2017 - They don’t. It’s a service for managing your sites, they don’t provide you with themes and plugins. - You can install plugins from the WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. [https://wordpress.org/](https://wordpress.org/) pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. and theme repository, you can connect your Dropbox account and install plugins from your Dropbox account, or you can upload your own plugins. - The key is it’s either plugins and themes from WordPress.org OR bring your own. Just like WordPress itself. - They do not provide an alternative repository of themes and/or plugins that competes with the WordPress.org repos. * ![](https://secure.gravatar.com/avatar/250257111d1248c34046552bbcdf6999949ef56b2f992dd5eb39bf45cabeb18a? s=32&d=mm&r=g) * [Samuel Wood (Otto)](https://profiles.wordpress.org/otto42/) 11:05 pm _on_ March 16, 2017 * We don’t see them as competing in that way. It’s a management service. Managing sites involves installing things on them. They allow you to install from Dropbox, I see no difference in them hosting the plugins themselves. Or even curating those they think their users like the most. * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 10:51 pm _on_ March 16, 2017 * Correct. - ![](https://secure.gravatar.com/avatar/1e077c2f5c78e83b780ec6db3358327349d986a26d0e41905bbbb4dc816b0748? s=32&d=mm&r=g) - [carlhancock](https://profiles.wordpress.org/carlhancock/) 11:06 pm _on_ March 16, 2017 - Thank you for the clarification Mika! It’s a topic that hasn’t really been discussed in more detail publicly like this. Really appreciate the post and follow up comments! 19. ![](https://secure.gravatar.com/avatar/d5db0cf4c28a2301cfaa2c215242906fcae87bc265c27a452207f1703e383197? s=32&d=mm&r=g) 20. [Breno Alves](https://profiles.wordpress.org/breno-alves/) 12:00 am _on_ March 17, 2017 21. > The guidelines are guidelines, and not laws or rules, to allow people to interpret > them, and you’re always welcome to ask us if something’s okay or not. 22. This deserves a highlighted mention on pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. handbook. This kind of explanation is very important to community 🙂 23. * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 12:23 am _on_ March 17, 2017 * We do here: [https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin-guidelines/](https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin-guidelines/) * In multiple ways we stress you can talk to us, but if you have suggestions on how we can make it better, we’re always willing to hear 🙂 The update to those guidelines was my 2016 undertaking and was WAY bigger than I imagined! 24. ![](https://secure.gravatar.com/avatar/7d4e6978df89809d15df65aac619677de2180d4e0ec5a613aece7c9e7103324d? s=32&d=mm&r=g) 25. [J.D. Grimes](https://profiles.wordpress.org/jdgrimes/) 1:13 pm _on_ March 17, 2017 26. Thank you for this clarification. 🙂 I think this will be really helpful for many people. It is great to be able to have a public discussion on this. I really appreciate the willingness to answer everyone’s questions and make sure things are clear. ❤️ 27. Like Otto said, the “third-party” is what can throw people off. I assumed that third-party meant “anything but WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. [https://wordpress.org/](https://wordpress.org/)”. And what exactly qualified as a service was not clear to me either. Now I understand both points much better. 28. * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 2:12 pm _on_ March 17, 2017 * Third Party is fun. I may need to add in ‘unauthorized or unknown’ to preface it, since that may explain better. * ![](https://secure.gravatar.com/avatar/250257111d1248c34046552bbcdf6999949ef56b2f992dd5eb39bf45cabeb18a? s=32&d=mm&r=g) * [Samuel Wood (Otto)](https://profiles.wordpress.org/otto42/) 12:24 am _on_ March 18, 2017 * I do apologise for any misunderstanding of the terminology used there. It made perfect sense to me at the time, but yes, it’s worth a revisit 29. ![](https://secure.gravatar.com/avatar/0608b540c7da83b396fd9a453ad1ac0298152522bc3a06888d41649e4024a089? s=32&d=mm&r=g) 30. [Ahmad Awais](https://profiles.wordpress.org/mrahmadawais/) 5:34 am _on_ March 22, 2017 31. Thanks for the solid explanation in the article, Mika. 32. After reading comments I got more confused than I ever was, so, I went ahead and read this 33. * Can you have your pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. install things? No. * Can your service install things onto a connected site? Yes. 34. And I’m sticking with it . 🚀 35. ![](https://secure.gravatar.com/avatar/52df9c42cfe4b184c38db91deede9c10448a91716884dddd5bcf5fe35bf1ec4f? s=32&d=mm&r=g) 36. [Gioni](https://profiles.wordpress.org/gioni/) 9:43 pm _on_ April 7, 2017 37. So, from my understanding, I can add a registration form to the pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. admin UIUI UI is an acronym for User Interface - the layout of the page the user interacts with. Think ‘how are they doing that’ and less about what they are doing. that will do only one thing( clearly explained to a user): submit user’s name and email to a third party website and redirects user there to complete the registration. Needless to say that submiting will be initiated by the user. 38. * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 9:55 pm _on_ April 7, 2017 * I am hesitantly saying yes, because it sounds right, but a lot of this is stuff we have to look at make sure it’s really right in reality and not just theory. Comments are closed. # Post navigation [← Beware Your Zips!](https://make.wordpress.org/plugins/2017/03/05/beware-your-zips/) [The New Directory Is (Mostly) Live →](https://make.wordpress.org/plugins/2017/03/28/the-new-directory-is-mostly-live/)