I had a client reach out last week, totally fuming. They had spent months building a custom internal tool they wanted to share on the official repo, and it kept getting kicked back. “Ahmad,” they said, “is the review team just ignoring us? It feels like we’re fighting a brick wall.” I had to explain that the game has changed. The WordPress plugin review process works differently than it did three years ago, and if you aren’t prepared for that, you will sit in the queue indefinitely.
The volume is what does it. Plugin directory stats shared after WordCamp US put the directory at over 60,187 plugins, with 7,670 new submissions this year alone. That is an 87.3% increase over the same period last year, or an average of 235 new plugins a week. No manual review team absorbs that.
The rise of the machines in plugin reviews
So how does the team keep the queue under a week at that volume? Automation, and specifically AI. About 85.3% of first reviews this year were started by automated systems that scan your code before a human ever opens it. The numbers come from the official Make WordPress blog, which goes into how AI is taking on the heavy lifting.
I have been there myself. Early in my career I thought I could get away with a clever way of fetching remote data that skipped the standard protocols. I thought it was efficient; the bot thought it was a security risk. I spent three review cycles arguing with an automated system before admitting I was the one in the wrong. You cannot outsmart the scanner, so you code for it. It looks for specific patterns, and anything outside the WordPress Way gets flagged.
The review team also reports a 17.1% higher engagement rate from authors who follow through on the fixes they are asked to make. The process is clearer than it used to be, and the bar to get in is higher. Your data handling has to be solid. Wrong hooks or sloppy prefixing and you are wasting everyone’s time.
/**
* Proper way to handle setting updates to pass the automated review.
* Always sanitize on input and escape on output.
*/
function bbioon_save_plugin_settings() {
if ( ! isset( $_POST['bbioon_nonce'] ) || ! wp_verify_nonce( $_POST['bbioon_nonce'], 'bbioon_settings_action' ) ) {
return;
}
if ( ! current_user_can( 'manage_options' ) ) {
return;
}
if ( isset( $_POST['bbioon_api_key'] ) ) {
$api_key = sanitize_text_field( wp_unslash( $_POST['bbioon_api_key'] ) );
update_option( 'bbioon_api_setting', $api_key );
}
}
add_action( 'admin_init', 'bbioon_save_plugin_settings' );What this costs a business
If you own the business, slow means expensive. A plugin parked in the review queue for six cycles, and the current average is about 6.19, is a plugin that isn’t generating leads or solving anything for your users. The team is also starting proactive scans of the existing directory, so a plugin already published is not exempt if it carries legacy code smells.
This stuff gets complicated fast. If you are tired of debugging someone else’s mess and just want your site or plugin to work inside the ecosystem standards, drop my team a line. We have probably seen it before.
The directory is growing faster than ever, and AI is speeding the reviews up, but it also leaves less room for cowboy coding. Audit your own plugins before the scanners get to them.
