Skip to main content
plugin5 min

WordPress plugin checklist

Use the final shipping checklist for a block-first plugin with security, accessibility, and QA covered.

View source

Progress is stored locally in your browser.

Pre-Development

  • Create GitHub issue with feature specification
  • Define acceptance criteria and success metrics
  • Create plugin repository from template
  • Set up CI/CD pipeline
  • Configure code quality tools (PHPStan, PHPCS, ESLint)
  • Plan architecture and dependencies
  • Review existing solutions to avoid duplication

Development

Core Functionality

  • Implement main features per specification
  • Create WordPress blocks (if applicable)
  • Implement hooks and filters for extensibility
  • Add configuration options and settings

Code Quality

  • Write unit tests for business logic
  • Write integration tests for WordPress hooks
  • Ensure 80%+ code coverage
  • Pass all linting checks (PHPCS, WPCS)
  • Pass static analysis (PHPStan level 5+)
  • ESLint passes for JavaScript/TypeScript

Security

  • Escape all output with appropriate functions
  • Validate and sanitize all input
  • Use nonces for form submissions
  • Implement capability checks
  • Review for SQL injection vulnerabilities
  • Check for XSS vulnerabilities
  • Use prepared statements for database queries
  • No hardcoded credentials or secrets

Documentation

  • Write code comments (WHY not WHAT)
  • Create README.md with setup instructions
  • Document admin settings and options
  • Create developer documentation
  • Document hooks and filters
  • Add changelog with releases

Accessibility (WCAG 2.2 AA)

  • All interactive elements keyboard accessible
  • Proper heading hierarchy
  • Semantic HTML markup
  • Color contrast passes WCAG AA
  • Tested with screen reader
  • No focus traps

Performance

  • Minimize database queries
  • Implement caching where appropriate
  • Lazy-load JavaScript and styles
  • Test performance with WP-CLI or Performance Profiler
  • No render-blocking resources

Testing

Manual Testing

  • Test on multiple WordPress versions
  • Test with popular plugins enabled
  • Test on mobile devices
  • Test in modern browsers (Chrome, Firefox, Safari, Edge)
  • Test with WordPress multisite
  • Verify no console errors

Automated Testing

  • Unit tests pass
  • Integration tests pass
  • E2E tests pass (if applicable)
  • CI pipeline passes all checks

Documentation & Metadata

  • Plugin header comments complete
  • Plugin name follows naming conventions
  • Version number incremented
  • Changelog updated
  • License header in all files
  • CONTRIBUTORS.md updated

Pre-Release

  • Create PR with full description
  • All checks pass (CI, code review, tests)
  • Changelog entry written
  • Version bumped appropriately (semver)
  • Tested in clean WordPress installation
  • No deprecated WordPress functions used

Release

  • Create GitHub release with tag
  • Add release notes with features and fixes
  • Tag all contributors in release notes
  • Update plugin repository (if applicable)
  • Announce release in appropriate channels

Post-Release

  • Monitor for user issues and reports
  • Respond to support questions
  • Plan next iteration based on feedback
  • Keep dependencies updated
  • Monitor security advisories

Built by 🧱 LightSpeedWP with ☕, 🚀, and open-source spirit!