A client reached out last week, furious. He had submitted a custom integration plugin to the directory and it came back rejected for the third time. “Ahmad,” he said, “I’ve been using these same hooks since 2014. Why are they suddenly acting like I’m a novice?” He was convinced the reviewer had it in for him. What I had to explain is that a person reading your code is no longer the whole review. The old review team is now the WordPress Plugins Team, and much of the work is automated.
The rename from “Plugin Review Team” to “Plugins Team” reads like corporate housekeeping, but it reflects a real change in how the ecosystem is run. The team is not only checking your syntax. It is building the infrastructure that keeps millions of sites from falling over. Submissions have climbed enough that automation was the only way through the queue, so code that ignores the current WordPress Plugins Team standards gets stopped early.
The 220-plus automated checks
My first move on his plugin was to fix the specific PHP warnings the reviewer had listed, which was nowhere near enough. The team runs more than 220 automated checks through its Scanner tool, and there is AI looking for trademark violations in plugin names before anyone human opens the code. A naming convention that is slightly off gets killed by the bot. Efficient, and unforgiving if you have not prepared for it.
The team is also pushing the “Plugin Check” (PCP) tool hard, because they want developers doing this work before hitting submit. My own local testing suite had not kept up with their standards, so I was handing out advice based on how the process worked in 2022. Once I installed PCP, about half of my standard boilerplate came back flagged for modern security issues.
/**
* Example of a common mistake the new scanner catches.
* We used to just check nonces, but the Plugins Team
* now looks for specific data validation patterns.
*/
function bbioon_save_custom_meta( $post_id ) {
if ( ! isset( $_POST['bbioon_meta_nonce'] ) || ! wp_verify_nonce( $_POST['bbioon_meta_nonce'], 'bbioon_save_data' ) ) {
return;
}
// The old way: just grabbing the value.
// The new Plugins Team standards will flag this for lack of specific sanitization.
if ( isset( $_POST['bbioon_field'] ) ) {
update_post_meta( $post_id, '_bbioon_key', sanitize_text_field( $_POST['bbioon_field'] ) );
}
}What the change means for your business
This has been building since mid-2023, and it is about more than clearing a queue. According to a recent update on the official WordPress Make blog, the team is working more closely with the Meta team on the directory features themselves. Less inspecting, more building.
If your business runs on WordPress, this is good news. Bad code has a harder time getting into the ecosystem. It also means your developers have to keep up, because you cannot bolt something together and hope the review misses it. The scanners keep getting better and the security requirements keep tightening. A developer who has never mentioned automated scanners or PCP is probably leaving you technical debt you will pay for later.
This gets complicated quickly. If you are tired of debugging someone else’s setup and you just want your site to work under the current rules, drop my team a line. We have probably seen it before.
So is your developer still writing plugins the way they did in 2014, or have they kept up with what the Plugins Team expects now?
