Top 11 Reasons Your Plugin Was Rejected

And no, we don't hate you.

Created for WordCamp Ventura 2014

https://slides.halfelf.org/wcventura2014

Mika "Ipstenu" Epstein

Among Other Things, I ...

Moderate the support forums
Review plugins
Beta test
Train people to support WP

Some people know me as a Half-Elf Support Rogue, and that's a pretty good description of what I do! I'm one of those WordPress busy bodies out there, and I wear a lot of hats. I write plugins, I debug everything, I beta test... and DreamHost pays me to do those things as well as wrangle our support and try to train everyone there about WordPress, what it is, why it's cool, and by the way have you had the Kool-Aid yet? For the last few years, I've been helping to review plugin submissions on WordPress.org and I've learned a LOT about coding, doing it wrong, and doing it right since there. But I get asked a lot why we reject so many plugins, and I'm going to give you a top-list of why this happens. One thing to keep in mind, only one reason is actually why it's going to be REJECTED. We really pend a plugin and email you, explaining why. Let's do this!

11. Trademarks

You aren't Google, last I checked.

10. Readme

Say what you mean!

9. Phoning Home

Unsolicited phone calls are annoying.

8. Updates

You're not your own deployment server.

7. Encryption

Don't burry the lede.

6. GPL!

Keep it legal folks.

5. wp-load.php

Keep WordPress in WordPress.

Including wp-config.php, wp-blog-header.php, wp-load.php, or pretty much any other WordPress core file that you have to call directly via an include is not a good idea. Usually plugins will include wp-config.php or wp-load.php to gain access to core WordPress functions, but there are much better ways to do this. You should tie your processing functions (the ones that need but don't have access to core functions) into an action hook, such as "init" or "admin_init". If you're trying to use it because you need to access WordPress functions outside of WordPress, just don't. Your plugin should be inside WordPress, only accessible to people who are logged in and authorized, if it needs that kind of access. Your plugin's pages should be called via the dashboard like all the other settings panels, and in that way, they'll always have access to WordPress functions.

4. Unsafe SQL

Be prepared!

3. jQuery

What you want, baby we've got it!

2. wp-content

Don't hardcode paths!

1. Reply to Email

We're waiting for you!

THE END

My tech blog: https://halfelf.org

These slides: https://slides.halfelf.org/wcventura2014