WordPress.org standards

WordPress.org is the most trusted plugin repository on the web. Its guidelines encode two decades of hard-won safety and interoperability rules — and WBP treats them as non-negotiable. Every plugin release passes a 13-item pre-submission checklist and honours every core repository policy, including the ones users often notice most: no premium-upsell nag banners, no tracking without opt-in.

TL;DR: Non-negotiable pillars: no RCE, proper sanitisation / escaping / nonces, no premium nagging (§12), no tracking without consent, stable tag + changelog on every release. A 13-item pre-submission checklist gates every tag.

1. Key guidelines + our compliance

No remote code execution

No eval(), no base64_decode() for code, no dynamic includes from user input — even for licensing enforcement.

Sanitisation, escaping, nonces

Sanitise every input, escape every output, verify a nonce + capability check on every write.

No premium upsell nagging (§12)

One non-intrusive premium link in the plugin UI. No dashboard nag banners, no dismissible-then-returning popups.

No tracking without consent

Anonymous telemetry off by default. Any tracking requires explicit opt-in via WBP Consent Manager.

2. 13-item pre-submission checklist

PHP 7.4+ minimum, 8.1+ tested and preferred, 8.3 in CI.
Every SQL query uses $wpdb->prepare(). Zero string interpolation.
Every user-supplied string is escaped on output (esc_html, esc_attr, esc_url, wp_kses).
Every write endpoint verifies a nonce (wp_verify_nonce or REST permission_callback).
Every write endpoint checks capabilities (current_user_can) — never trusts the nonce alone.
Every user-facing string is translatable via __()/_e()/_n() with the plugin's text domain.
load_plugin_textdomain called on init, not plugins_loaded (WP 6.5+ JIT translation).
Stable Tag in readme.txt matches the tagged release.
Changelog updated in readme.txt for every release, grouped Added / Changed / Fixed / Security.
Tested up to and Requires at least declared and verified.
Enqueue scripts/styles via wp_enqueue_script/_style — never inline <script> tags.
No PHP notices/warnings/errors on WP_DEBUG.
Plugin Check (PCP) clean.

3. What we do

Ship a single non-intrusive Premium link in each free plugin — footer or settings row, never a banner.
Ship anonymous telemetry as opt-in only, disclosed on activation.
Ship a public changelog on the repo and in readme.txt for every release.
Ship semantic versioning with a full MAJOR-release deprecation window for public APIs.

4. What we don't do

We do not use eval() or base64_decode() for code execution — ever.
We do not push dashboard nag banners, review-request popups, or dismissible-then-returning notices.
We do not enable tracking or telemetry by default.
We do not require the paid tier for baseline plugin functionality.