Introducing Plugin Check (PCP)

After the original proposal for a WordPress plugin check a little over two years ago, the Plugin Check plugin (or PCP for short) has become a reality. It saw its first stable release earlier this year and has since been used by hundreds of developers. This post provides more context about PluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party Check and why you should start using it.

Plugin Check is a tool for testing whether your plugin meets the required standards for the WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ plugin directory. With this plugin you will be able to run most of the checks used for new submissions, and check if your plugin meets the requirements. The plugins team is currently working on making it an integral part of the review process. If you are considering submitting a new plugin to the plugin directory, run these checks yourself beforehand to save time later on.

But there is more! In addition to things relevant for the review process, the tool flags violations or concerns around plugin development best practices, from basic requirements like correct usage of internationalization functions to accessibilityAccessibility Accessibility (commonly shortened to a11y) refers to the design of products, devices, services, or environments for people with disabilities. The concept of accessible design ensures both “direct access” (i.e. unassisted) and “indirect access” meaning compatibility with a person’s assistive technology (for example, computer screen readers). (https://en.wikipedia.org/wiki/Accessibility), performance, and security best practices. It does so using both static checks using PHP_CodeSniffer and dynamic checks, where it actually activates your plugin to test it “live”.

Because of this, PCP is useful even beyond the initial plugin submission, which is why it’s recommended to make it a part of your development workflow. This shortens your feedback loopLoop The Loop is PHP code used by WordPress to display posts. Using The Loop, WordPress processes each post to be displayed on the current page, and formats it according to how it matches specified criteria within The Loop tags. Any HTML or PHP code in the Loop will be processed on each post. https://codex.wordpress.org/The_Loop. as you can immediately address potential bugs as they come up, before they affect your users. To achieve this, simply install the plugin on a local environment and regularly run it against your plugin. The checks can be run either via WordPress admin or WP-CLIWP-CLI WP-CLI is the Command Line Interface for WordPress, used to do administrative and development tasks in a programmatic way. The project page is http://wp-cli.org/ https://make.wordpress.org/cli/.

For even more peace of mind you can continuously monitor your plugin using a dedicated GitHub action. It automatically runs Plugin Check against your plugin for every commit or PR, and posts all results as annotations on your source files so you know exactly where to look for resolving any errors or warnings.

Plugin Check is not a replacement for the manual review process, but it will help you speed up the process of getting your plugin approved for the WordPress.org plugin repository, and it will also help you avoid some common mistakes. Even if you do not intend to host your plugin in the WordPress.org directory, you are encouraged to use it so that your plugin follows the base requirements and best practices for WordPress plugins. Keep in mind that automated tools like this aren’t perfect, so there may occasionally be false positives.

All development for this plugin is handled via GitHub, and any bug reports or feature requests should be reported there. The GitHubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged be the repository owner. https://github.com/ Action is maintained in its own repository.

Download the Plugin Check plugin or install the Plugin Check GitHub Action today to get started.

Written and reviewed by swissspidy, flixos90, davidperez

Sarankumar 11:53 am on September 18, 2024

This pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party saves time for developers creating plugins for the repository. Thank you to everyone involved in its development!
Robin W 5:59 pm on September 19, 2024

this is all very worthy, but misses the whole point of this. If we as coders understood all the message you give, then we would not be making these errors in the first place. It is precisely because we don’t know that we make these errors.

so this all reads to us as equivalent of ‘engine error 500 detected, fix axion flex monitor’

Each error needs a link NOT to some developer handbook with more gobbledegook, but to an example of real code.

so for instance just 1 of the many messages one of my plugins gives is

WordPress.WP.I18n.MissingTranslatorsComment

A function call to __() with texts containing placeholders was found, but was not accompanied by a “translators:” comment on the line above to clarify the meaning of the placeholders.

WT heck is a ‘accompanied by a “translators:” comment’ – what does it look like so that I can comply?????

or

WordPress.Security.EscapeOutput.UnsafePrintingFunction

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found ‘_e’.

where is an example of what this should look like ??

and

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘$value2’.

no link to the security sections, and I suspect that since you indicate that these are sections and more than 1 it is loads of pages and that my very specific error will be buried in many pages of stuff – if you know the specific error, why not link to a specific best practice answer???

I would love to get better at all this, and the pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party is really fantastic as far as it goes, but I feel you need to address the audience not a degree level coder
- Ulrich 9:08 am on September 21, 2024
  
  I am not related to this project, but I have worked with the PHPPHP PHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. http://php.net/manual/en/intro-whatis.php. Sniffer before.
  
  From my experience, I expect it will be difficult to add sufficient documentation to the errors that can be read and understood with zero prior knowledge. Some of these things are WordPress-specific, and not even a degree level coder would know if they had no experience with WordPress.
  
  There is a lot of information online which can be found using Google. For example, here is an article that explains your question regarding “WordPress.WP.I18n.MissingTranslatorsComment” https://sanjeebaryal.com.np/vs-code-user-snippets-to-create-for-wordpress-development/
  
  For “WordPress.Security.EscapeOutput.UnsafePrintingFunction” I would try and understand what the functions esc_html_e() and esc_attr_e() do.
  
  There is not always a specific fix that you can copy and paste. Depending on your code and context, the fix will look different.
  
  For example, for the following error, the fix would be different if the content of “$value2” was a number or text.
  “All output should be run through an escaping function, found ‘$value2’”.
  
  There is still a need for a human analyse of the code. Maybe one day there will be an AI tool that can do Code Reviews and consider all the context and understand the code perfectly.
  
  I hope this gives you a better understanding of the challenges and helps you find fixes for your messages.
  - Robin W 5:23 pm on September 24, 2024
    
    thanks for your useful post, I appreciate the info
Robin W 5:06 pm on September 27, 2024

ok, so the developer handbook tells me to use

but this creates an error in PCP saying

ERROR WordPress.Security.EscapeOutput.UnsafePrintingFunction All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found ‘_e’.

so which is right, and if the latter, what should I be doing???
- Robin W 5:07 pm on September 27, 2024
```
<?php _e( 'Some text to translate and display.', 'textdomain' ); ?>
```
  is what the handbook says to use
  - Drew Jaynes 6:52 am on September 30, 2024
    
    Realistically the handbook should probably be updated to referenced the escaped versions of these functions. In your case, converting `_e()` to `esc_html_e()` should theoretically giving you a passing result.
Robin W 7:09 am on September 28, 2024

ignore the above – bad day at the office !!!

Communication

Share this: