The WordPress 5.7 Email Has been Sent

The field guide is out and the email has been sent.

If you find your pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party has been closed, it would be for one of the following reasons:

  • Email bounces
  • Auto replies continue after a warning
  • Email reply says the email address is no longer checked/in use
  • We have received the exact same out of office for 3 releases in a row

If your plugin is still open? Please re-read the field guide. It has some pretty cool stuff 🙂

WordPress 5.7 Field Guide

#email #field-guide #reminder

Reminder: Forked Premium Plugins Are Not Permitted

tl;dr: We do not permit copies or forks of premium (pay for) plugins to be hosted on WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/.

Caveat: While this topic always brings up people arguing that the GPLGPL GPL is an acronym for GNU Public License. It is the standard license WordPress uses for Open Source licensing https://wordpress.org/about/license/. The GPL is a ‘copyleft’ license https://www.gnu.org/licenses/copyleft.en.html. This means that derivative work can only be distributed under the same license terms. This is in distinction to permissive free software licenses, of which the BSD license and the MIT License are widely used examples. means they can (and yes, you can copy GPL plugins and do whatever you want with them), we wish to remind developers that just because the GPL allows something doesn’t mean we will host it here. Our guidelines are considered above and beyond the GPL. After all, the GPL doesn’t say you can’t punch someone, but if you get into a fistfight at a WordCampWordCamp WordCamps are casual, locally-organized conferences covering everything related to WordPress. They're one of the places where the WordPress community comes together to teach one another what they’ve learned throughout the year and share the joy. Learn more., we’re not going to host your plugins.

Taking someone’s pay-for code and re-releasing it as free-of-charge is considered (by us — the PluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party Review Team) to be a form of piracy and is not welcome here. It doesn’t matter if the code is GPL, it matters that When you do that, when you copy and re-release someone’s code without any changes, you’re stealing the opportunity of the original developers to make a living, and we feel that is detrimental to the community. In addition, it’s often in violation of the terms you agreed to when you downloaded the plugin from the developer in the first place.

By you doing that, and rehosting here, you put the entire directory in peril. Arguably we become responsible for your actions. As such, we do not permit plugins that are sold off WordPress.org to be re-hosted here.

The only exception to this (besides it being your own plugin) is if you have made a significant fork, properly credited in the readme and inline code, and everything was 100% GPL compatible, including the terms from where you bought the plugin. If you pirated a plugin, or if you violated the license purchasing terms (which may say things like you cannot resell it), then we cannot host the code.

Edit: It’s important to note that adding non-GPL compliant terms to a license may in fact invalidate the license, which means we can’t host it here anyway. The above comment is not in support of people violating licenses nor are we attempting to protect and help those people in any way. We are trying to point out that even if a license says it’s GPL, if it’s sold with terms that violate the GPL, it cannot be hosted here either. tl;dr? If the license or terms are sus, we can’t host it.

If the plugin is your own plugin and you just want to re-host here, we will do our best to validate that claim, and may pend your plugin while this is researched. We appreciate your patience when that happens.

If you feel someone took your plugin and hosted a copy of it here, please email plugins@wordpress.org with a link to the plugin as it’s hosted here, a link to your original plugin, and (if the plugin is hosted outside WordPress.org) attach a zip of the plugin so that we may compare the two.

Edited to add: This post is not about the GPL. This is only about the existing WordPress.org Plugin Developer Guidelines. You should not, under any circumstances, use this post to frame your understanding or interpretation of the GPL as it is not intended as such. Again, this post is about the plugin guidelines, the ones all plugin devs already committed to following, which have long since stated that immoral or ethical practices are not permitted here.

#reminder, #theft

Reminder: Plugins Must Not Interfere with Updates

While we do look for plugins that touch the update services on submission, we do not monitor existing plugins, which is where this reminder stems from.

Unless your pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party has the purpose of managing updates, you must not change the defaults of WordPress’ update settings.

You may offer a feature to auto-update, but it has to honor the coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. settings. This means if someone has set their site to “Never update any of my plugins or themes” you are not to change those for them unless they opt-in and request it.

The reason for this is that plugins should not over-reach their authority. When a plugin is made, it is self-defined by the developers as what it will do and why. There are some logical reasons to expand that of course (an anti-spam comment plugin may grow to also handle feedback forms), but for most plugins, the arbitrary management of plugin updates is outside their stated goals.

Plugins crossing over purposes, overriding settings that are unrelated to the function of their specific goal, can and will cause unexpected outcomes. It also destroys the faith users have in you to not break their sites. Sadly, this happened recently to a well used plugin, and the fallout has been pretty bad.

We do understand that many plugins want to take advantage of the new features within WordPress. But if your plugin is a custom blockBlock Block is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience., you really don’t have a need to be changing how the uploader works, or even setting your plugin to default-auto-update.

At this time, we have no plans to spell this out in a guideline. We do currently, regularly flag plugins that go outside their dictated (self defined) boundaries, and this is not a change. Please, respect your users.

#reminder, #updates

Reminder: Compatibility with Core Matters

Over the years we’ve gone from always showing all plugins in searches to devaluing plugins that aren’t updated in a time span to devaluing them if they’re not compatible with the latest few releases of coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress.. All of this is done to improve the user experience and to ensure they only find plugins that are actively maintained and compatible with the versions of WordPress they use.

As part of this, when a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party is closed we currently require the ‘tested up to’ value to be, at least, the latest stable version of WordPress core. We have updated our emails for closures and re-scans to reiterate that, but it’s for a slightly different reason than helping users.

We want to help you developers. If no one can find your plugin, because it’s not compatible with (say) WP 5.5, then no one uses your plugin. Presumably, if your code is hosted here, you want people to use it. To help you and ensure your plugins can be found and used, we are requiring you update that, should we have any reason to close your plugin.

Just like you have to bump the plugin version so people get notified of updates, you need to make sure that “tested up to” value is current 🙂

So! Please keep that up to date! It’ll help people find your plugin, give them confidence in your work, and help make you more successful! Wins all around 🙂

#guidelines #reminder

Don’t Get Scammed

There’s a company who regularly emails people telling them that for $50 or $100 they’ll review your pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party or theme and you’ll get 5 star ratings on WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/. They’ll tell you that doing this will get you SEO and traffic and they’ll link to their domain as proof of their success.

They’re lying.

Don’t fall for this. Never pay anyone for a review, it’s all a scam and the worst case scenario is that they actually do write a review. Why is that worst? Because if we find out you paid for reviews, we remove your plugins from hosting.

If you got a mail from a certain company offering a Valentine’s sale, know that we already know about them. They’ve been banned from here for years but we’ll be monitoring reviews just in case they slip through.

#reminder

Reminder about Behavior

This really shouldn’t need to be said however, based on three recent incidents, it is clear we need a reminder.

You are responsible for your own actions and choices. If you decide to do a thing, you are assuming responsibility for the outcome and, like it or not, the repercussions fall on you and you alone.

When you work with a team of people to support and maintain your pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party, everyone is required to follow the plugin and forum guidelines. Choices made by the team will impact the group as a whole, for good or ill.

Recently a company was banned due to having never briefed their employees on the plugin guidelines. This led to a new, un-monitored employee, egregiously violating the guidelines, harassing and abusing the volunteers of the forums as well as the end-users, who were just trying to get help with the plugin.

The company had been warned about this kind of behaviour before. In fact, they had been issued a final warning. As this was a repeat of the exact behaviour they’d been warned on, their plugin was closed and the company prohibited from hosting anymore.

Sadly this isn’t the only time that’s happened in the last 4 months.

If you work with a team of people, the company/group is responsible for each other. If one person in your group/company violates the guidelines, it’s the whole group who will suffer as you’ve demonstrated an inability to manage your team. The same is true if a rogue intern or SEO marketer spams the forums. They’re doing those actions in the name of the company, which makes the company accountable for their actions.

Don’t hire random people from companies like Fourer to do your marketing. Don’t let people loose in the forums without making sure they understand the guidelines and our expectations.

Abuse, name calling, harassment, stalking, and spamming the forum moderators is not permitted behaviour by anyone. Users are banned for this, and developers will find their companies and all plugins similarly removed. We feel it’s unfair of people to put the burden of monitoring and managing their team on the volunteers of the forums and the plugin team. This is especially true of companies.

Please make sure the people who work with you understand not just the guidelines, but the stakes. Quite often we find an enthusiastic intern is the cause of sockpuppeting, or a well-meaning SEO consultant who took the wrong lessons to heart and made a readme filled with spam.

If we have to contact you multiple times about your behaviour, or that of the people you’re working with, we’re simply not going to permit you to use our services any longer.

#guidelines, #policy, #reminder

Bounces, AutoReplies, and You

Over 150 plugins were closed during WCUS due to auto replies, bounces, and confusing pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party ownership.

In our plugin developer expectations, we say this:

It is the responsibility of the plugin developer to ensure their contact information on WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ is up to date and accurate, in order that they receive all notifications from the plugins team. Auto-replies and emails that route to a support system are not permitted as they historically prevent humans from addressing emails in a timely fashion.

Your email has to work. If we can’t get a hold of you, we’re going to either remove you from your plugin or, if you’re the owner, close it. This is especially true if we can’t figure out who’s meant to own a plugin, or the ‘official’ company account is bouncing.

If your email sends an auto-reply, or a partial bounce (that is, you have a group email and one address in the group bounces) we ALWAYS email you with as much detail as needed to resolve the issue.

Since we sent out a mass email in October, pre 5.0, and another last week, we had a 50 day window for many people to correct the issues.

Let’s hit up some of the reasons why we do this:

Auto-Replies are a bad developer practice

Two reasons, besides the fact that they’re spammy, that a developer account should never auto-reply:

1. Security
2. Communication

Security is the biggest. An auto-reply generally comes from a SUPPORT account. A support account should NEVER be receiving our emails because they’re likely to be related to insecurity in your plugins. We don’t 0-day you, ever, that would be cruel. We want you to fix things ASAP, though, for your users, and if support gets that message, now you have more people, who may not understand not to tell customers about the problems. Also we have no way to be sure the developer got the email. You’re trusting support to escalate properly every time.

Communication is obviously related. We’ve got to be able to get a hold of you, and putting layers between us and you isn’t going to help.

Auto-replies cause developers to not get notifications

We actually DO inform everyone about the status of auto-replies. Once we determine what plugin causes the reply, we email everyone with commit access (i.e. your developers) that there is a problem and to please resolve it. The fact that a high number of you aren’t seeing those emails is indicative of the problem.

Developers aren’t support

For the majority of plugins, this is actually not true. That is, most people are developers and their own support. But those aren’t the people who make auto-replies. The people who have auto-replies tend to be companies. And for a company, there’s a reason they want the auto-replies for people contacting support. That’s perfectly sensible.

The disconnect here is that we expect the people who have commit access to be developers. We

Thankfully we have a solution for you! You can add your support users as Support Representatives for your plugin!

WordPress isn’t your user

All of that said, having an auto-reply on the account you use here to manage your plugin and support your users creates a poor experience. People can’t email you from WordPress.org and while you can chose to get emails for all new posts in your plugin’s forum, having that sent to an auto-reply is rather odd. Why would you want to auto-reply to an automated notification email?

Shared accounts are dangerous

This goes back to security. Don’t share accounts. NEVER share accounts. Give developers individual access to commit code. Add support reps individually. Doing this gives you an easy way to track who commits what code, who answered what question, and you can now hold them accountable for their individual actions! Got one support tech who goes off the rails? You can explain that it was one person and you’re handling it. Or the forums team can help you blockBlock Block is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience. their account if needed.

Bounces are harder to unravel than you think

Sometimes a bounce is obvious. If a user no longer exists, we can close the plugin. If a domain no longer exists, you’d think we could close it, but what if that happened because a company renamed themselves and forgot to update the emails? And what about when the bounce is from the domain, but doesn’t say WHICH user account bounced? It takes time.

We know a handful of people have been upset to find out we closed their plugins instead of trying to sort out who actually should own the plugin when the email bounced. We are sorry about that, but it was a case of prioritizing and expediency. It’s much more efficient for us to close the plugin and let you contact us than to spend a couple hours untangling who represents a company and is legally responsible for managing a plugin.

Questions?

As always, if your plugin was closed and you don’t know why, email us with a link to the plugin and ask. We’d rather have them up and active and usable too!

#reminder #email

Reminder: We can’t rename plugins post approval.

When you submit a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party, the plugin slug (i.e. the URLURL A specific web address of a website or web page on the Internet, such as a website’s URL www.wordpress.org) is determined from your plugin’s display name, as set in the main plugin file. The slug can be changed while a plugin is in review but we cannot change it once your plugin is approved.

That’s why, when you submit a plugin, we send you an automatic email telling you what your slug is, and asking you to please reply immediately if that slug is wrong. We also show you what the slug will be on the post-submission page.

If you fail to tell us before we approve your plugin, you’re going to be stuck with the name you got, unless there’s an extenuating circumstance (like a legal issue, or a typo). We do not accept ‘resubmissions’ to fix the name, as we’re making every reasonable effort to get the information out there for you to act on.

Please. Make sure you read the emails. Make sure you check the slug after you submit. Tell us right away when you spot something wrong. And above all? Remember you have full control of your slug in your own submission 🙂

#reminder #policy

Reminder: Plugins are closed if emails bounce

We emailed out the ‘5.0 is coming’ email and received a record high number of bounces. Over 2000. Normally we get a couple hundred, mixed in with vacation notifications (which we ignore) and auto-replies.

When your email bounces, we close your pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party because we no longer have a way to communicate with you. We even email you to tell you, just in case it’s a one-off glitch. If your email auto-replies, you get a warning. If you don’t fix this, the next auto-reply gets you closed. There are a couple exceptions to this, like the person who’s system got stuck in a loopLoop The Loop is PHP code used by WordPress to display posts. Using The Loop, WordPress processes each post to be displayed on the current page, and formats it according to how it matches specified criteria within The Loop tags. Any HTML or PHP code in the Loop will be processed on each post. https://codex.wordpress.org/The_Loop. and emailed us back 6 times for one plugin.

  • If the email was the owner of the plugin, and there’s no clear secondary owner, the plugin’s closed
  • If the email was the owner but we can tell another account is the co-owner, we transfer the plugin and email the new owner to explain
  • If the email is a committer, their account is removed and the owner emailed to explain why

Why so many?

But this number being so high was astounding to us. Like I said, it’s 10x the norm. In looking into it, we’ve determined the following facts led to this number:

  • Yahoo will delete your email account if you don’t use it for a year
  • Google reserves the right to deactivate your email after 9 months of inactivity
  • Free Windows Live Hotmail accounts become inactive if you don’t sign in for more than 270 days
  • Google email groups default to not allowing external emails.

My guess is that with GDPR being a thing, many email servers have gone ahead and deleted things. Also I suspect they changed the defaults on Google email groups, since a few of these accounts have been around for a while.

How do I get my plugin reopened?

First check that your user’s email is correct. If not, fix that. Then email us and ask if your plugin can be reopened. Most everyone has been reopened immediately. The stragglers are due to ownership issues. This is why we’re so pedantic about official accounts owning plugins. If the owner bounces but other people from the company have official accounts as committers, we’ll transfer the plugin.

What can I do to prevent this from happening?

The simple answer is “Make sure your email is up to date and functional.”

  • Add wordpress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ to your email’s white-list so you always get our emails
  • If you have a plugin that is a company plugin, make sure that the plugin owner’s email us up to date, and not an auto-reply
  • If your email is an alias, make sure everyone who gets the copy of the email is an active users
  • If you use a group/mailinglist account for your plugin, make sure wordpress.org can email it (groups need to allow ‘world’ access to send to)

#email, #reminder

Reminder: Check your Boilerplates

Boilerplates are hugely popular and can save you a lot of time getting started. That’s great.

However … The number one reason for pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party pushback this year is this:

define( 'PLUGIN_NAME_VERSION', '1.0.0' );

Please remember to check the defaults in those boilerplates.

#reminder