Every AJAX handler in my plugin had a nonce check. Every one of them also verified manage_options. I’d been deliberate about that from the start, and when I sat down to do a security pass before submitting to WordPress.org, I expected it to be a formality. It wasn’t. I found two high-severity issues and one … Read more
You wrote the plugin. You submitted it. After some back-and-forth on the name and a rejection or two, you got the approval email with your repository URL — and then you discovered that WordPress.org runs on Subversion, which you have possibly never used, and the official documentation assumes you have. I hadn’t. I’ve been building … Read more
I built a plugin to solve a problem I kept hitting on client sites. It detects database errors, plugin mass-deactivations, 404 floods, and PHP errors, and it reports them in plain English instead of stack traces. I tested it, I wrote the readme, I packaged it up, and I submitted it to the WordPress.org plugin … Read more
If you landed here from a rejection email that says plugin_updater_detected, skip to the second section. You don’t need to gut your SDK and you don’t need to build a second plugin. If you’re earlier than that — considering Freemius for a plugin you intend to list on WordPress.org — read the whole thing first. … Read more
A client site started turning itself off. Not the site — the plugins. All of them. Every morning I’d get a report that something was broken, log in, and find the plugins list completely deactivated. Turn them back on, everything works, site’s fine all day. Next morning, off again. Somewhere between 3 and 6 AM, … Read more