← WordPress Plugin Review Checker
WordPress Plugin Review Checker vs. Plugin Check
A shared goal, at very different depth and setup cost. Plugin Check is wordpress.org's own official plugin: install it into a real or virtual WordPress site and it runs a broad battery of automated checks. This page checks four specific, common review-rejection patterns directly from your readme.txt and PHP source -- free, with no WordPress install, no PHP runtime, and no upload.
What each tool is for
Plugin Check (wordpress.org/plugins/plugin-check/) is an official plugin
published by the WordPress Plugin Review Team. You install and activate it on an actual WordPress
site -- a live one, or a local environment such as wp-env -- and then run it from its
Tools admin screen or via wp plugin check <plugin> on WP-CLI. Once running, it
checks broadly: coding-standards sniffs, security patterns (including escaping and nonce/CSRF
issues), performance, accessibility, and internationalization, aiming to surface many of the same
automated issues the plugin review process looks for before you submit.
This checker does the narrower version of one part of that job: you paste or select
your plugin's readme.txt and PHP source, and it reports four specific, common
review-rejection patterns -- a Stable tag/Version mismatch, missing required
readme/header fields, a superglobal value echoed with no escaping function, and a
$_POST handler with no nonce check anywhere in the file. It runs entirely in your
browser or as a zero-dependency Node CLI, needs no WordPress install, no PHP runtime, and no
database, and makes no network call of its own -- so it works on a plugin's files before they have
ever been placed into a WordPress environment at all.
| Question | Where to answer it |
|---|---|
| I want the broad, official, in-environment pass -- coding standards, accessibility, performance and i18n, not just these four patterns. | Plugin Check -- that is its job, and this tool does not attempt the rest of it. |
| My plugin's files are not in a WordPress install yet -- a git checkout, an unzipped download, a folder I have not activated anywhere. | This checker -- it reads the files directly and needs no WordPress site, real or local, to run against. |
I just want to know if Stable tag matches Version, or catch an unescaped echo or a missing nonce check, right now, with nothing to install. | This checker -- a fast, narrow answer to exactly those four questions. |
| I want the official pre-submission gate the review team's own tooling is built around. | Plugin Check -- install it and run it before you submit or update. |
| I want this wired into my own CI with no PHP/WordPress runtime in the pipeline. | This checker's node check.mjs . -- zero dependencies, reads local files only. |
The two are complementary, not competing: install Plugin Check for the broad, official, in-environment pass, and reach for this tool the moment the question is only these four specific patterns on files that are not (yet) sitting inside a WordPress install.
Common questions
Should I use this checker or wordpress.org's own Plugin Check?
They cover an overlapping goal at different depth and setup cost. Plugin Check (the wordpress.org Plugin Review Team's own official plugin, published at wordpress.org/plugins/plugin-check/) is a broad, comprehensive gate: once installed and activated on a real or virtual WordPress site, it runs a wide battery of automated checks -- coding-standards, security patterns including escaping and nonce/CSRF issues, performance, accessibility, and internationalization -- through its wp-admin screen or wp plugin check on WP-CLI. This page checks four specific, narrow patterns straight from your readme.txt and PHP source -- a Stable tag/Version mismatch, missing required readme/header fields, unescaped superglobal output, and a $_POST handler with no nonce check -- with no WordPress install, no PHP runtime, and no database, because it never talks to WordPress at all. If you want the broad, official, in-environment gate, run Plugin Check. If you want a fast answer to these four specific questions on files sitting on your machine right now, with nothing to install, this is the narrower tool for that.
Does Plugin Check already do everything this tool does?
For the four patterns this tool checks, yes, Plugin Check's broader battery covers similar ground -- readme/header field validation and security-pattern sniffs are part of what it runs. The difference is where and how you get the answer. Plugin Check needs an actual WordPress environment (a real site or a local one such as wp-env) with the plugin installed and activated before it can run at all, then reports through wp-admin or WP-CLI. This tool needs only the readme.txt and PHP files themselves -- a git checkout, an unzipped download, a folder that has never been near a WordPress install -- opened in a browser tab or passed to a Node CLI, with no setup step in between.
Why would I need a WordPress-free checker if Plugin Check already exists?
Three reasons this tool exists alongside it. First, Plugin Check has to run inside WordPress -- you install it as a plugin and either open its admin screen or run it through WP-CLI against a live or local site -- so it cannot check a plugin's files before they are placed into a WordPress environment at all; this tool reads the files directly, wherever they sit. Second, Plugin Check's battery is broad by design (coding standards, performance, accessibility and i18n alongside security and repo requirements), which is exactly right for a full pre-submission pass but slower to reach for when the question is only one of these four specific, high-frequency rejection causes. Third, this tool's browser page uploads nothing and its CLI makes no network call, so it works the same on a private plugin you have not pushed anywhere as on one already live in the directory.
Is this page affiliated with wordpress.org, Plugin Check, or the WordPress Foundation?
No. This site is not affiliated with, endorsed by, or sponsored by the WordPress Foundation, Automattic Inc., wordpress.org, or the Plugin Check project. WordPress and Plugin Check are named here only to describe what this checker is and is not, using facts drawn from Plugin Check's own public wordpress.org listing at wordpress.org/plugins/plugin-check/. WordPress® is a registered trademark of the WordPress Foundation.