WordPress/wp-plugin-directory-guidelines
skills/wp-plugin-directory-guidelines/SKILL.md
Use when reviewing WordPress plugins for GPL compliance, checking license headers or compatibility, evaluating upsell/freemium/trialware patterns, validating plugin naming or trademark rules, checking plugin slugs, understanding why a plugin was rejected from WordPress.org, or answering any question about the 18 WordPress.org Plugin Directory guidelines — even if the user doesn't mention 'guidelines' explicitly.
$ install --global
skillsauthnpx skillsauth add WordPress/agent-skills wp-plugin-directory-guidelinesInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 25, 2026, 5:53 AM155.1s4 files scanned
SKILL.md
- name:
- wp-plugin-directory-guidelines
- description:
- Use when reviewing WordPress plugins for GPL compliance, checking license headers or compatibility, evaluating upsell/freemium/trialware patterns, validating plugin naming or trademark rules, checking plugin slugs, understanding why a plugin was rejected from WordPress.org, or answering any question about the 18 WordPress.org Plugin Directory guidelines — even if the user doesn't mention 'guidelines' explicitly.
- compatibility:
- Targets WordPress 6.9+ (PHP 7.2.24+).
Overview
Authoritative reference for the 18 WordPress.org Plugin Directory guidelines. Covers GPL licensing, plugin naming/trademark rules, trialware restrictions, and all other submission requirements.
When to use
Use this skill when you need to:
- Review a WordPress plugin for compliance with the WordPress.org Plugin Directory guidelines
- Check GPL license compatibility for a plugin or its bundled libraries
- Verify license headers in plugin files
- Identify common guideline violations before submission
- Answer questions about what is or is not allowed on WordPress.org
- Evaluate premium/upsell flows, license checks, or freemium positioning
- Review "teaser" or "preview" UI for trialware violations
Inputs required
- Plugin source code (or specific files to review)
- Optional: plugin readme and plugin header metadata for naming and license checks
Procedure
- Check the plugin's license header against the Valid License Headers section below.
- Walk through the 18 Guidelines checklist, paying special attention to Guidelines 1, 4, 5, 7, 8, and 17.
- Confirm trialware/freemium compliance using the checklist in guideline-review-checklist.md (Guideline 5 section).
- For bundled third-party code, verify license compatibility against GPL-Compatible Licenses (Quick) below.
- Flag matches from Common GPL Violations (Quick) below.
- For edge cases, consult the detailed references and the GNU GPL FAQ.
18-Guideline Review Checklist
Use the detailed, per-guideline checklist in guideline-review-checklist.md. Load this reference file only when a full guideline audit is requested.
GPL Compliance (Guideline 1 in Detail)
Use gpl-compliance.md for full license tables, compatibility nuances, and examples. Keep this inline section as a quick decision aid.
Verification (Licensing)
- Every licensing-related issue must cite Guideline 1 and include the file path and exact license string.
- Confirm compatibility claims against GPL-Compatible Licenses (Quick) and escalate ambiguous licenses.
Failure modes (Licensing)
- If a license is not clearly GPL-compatible, do not guess. Check the GNU license list.
- For dual-license packages, verify both licenses and redistribution terms.
Quick Reference: WordPress GPL Requirements
- WordPress is GPLv2 or later.
- Plugins distributed on WordPress.org must be 100% GPL-compatible (code and assets).
- Include a valid
License:header andLicense URI:in the main plugin file. - Do not add restrictions that conflict with GPL freedoms.
Valid License Headers
GPL Versions Summary
| Version | Year | Key Addition | |---------|------|--------------| | GPLv1 | 1989 | Base copyleft: share-alike for modifications | | GPLv2 | 1991 | "Liberty or death" clause (Section 7), clearer distribution terms | | GPLv3 | 2007 | Anti-tivoization, explicit patent grants, compatibility provisions |
WordPress uses GPLv2 or later, meaning plugins can use GPLv2, GPLv3, or "GPLv2 or later".
For full license texts, see:
- GNU General Public License v1
- GNU General Public License v2
- GNU General Public License v3
License Compliance Checklist
When reviewing a plugin, verify:
- [ ] Main plugin file has a valid
License:header (e.g.,GPL-2.0-or-later,GPL-2.0+,GPLv2 or later) - [ ] Main plugin file has a
License URI:header pointing to the GPL text - [ ] If bundled libraries exist, each has a GPL-compatible license
- [ ] No "split licensing" (e.g., code GPL but premium features proprietary)
- [ ] No additional restrictions beyond what GPL allows
- [ ] No clauses restricting commercial use, modification, or redistribution
- [ ] No obfuscated code (violates the spirit of source code availability)
Valid License Headers for WordPress Plugins
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
License: GPL-3.0-or-later
License URI: https://www.gnu.org/licenses/gpl-3.0.html
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
GPL-Compatible Licenses (Quick)
- Safe defaults: GPL-2.0-or-later, GPL-3.0-or-later.
- Commonly accepted permissive families: MIT/Expat, BSD, ISC, zlib, Boost.
- Conditional compatibility requires care: Apache-2.0 and MPL-2.0 (verify usage context).
- For full accepted and rejected identifiers, use gpl-compliance.md.
Common GPL Violations (Quick)
- Split licensing that restricts distributed code.
- Obfuscated or non-corresponding source distribution.
- Restrictive clauses (non-commercial, no-resale, forced backlink).
- Bundling GPL-incompatible libraries or assets.
Plugin Naming Rules (Guideline 17)
Use naming-rules.md for full trademark lists, slug blocks, and naming examples. Keep this inline checklist for quick screening.
Naming Checklist (Quick)
- Name is not a placeholder and has at least 5 alphanumeric characters.
- Header name and readme name match.
- Name is specific and function-related; avoid keyword stuffing.
- Trademark/project names appear only after connectors like
for,with,using,and. - No banned/discouraged terms or trademark portmanteaus.
- Slug is lowercase, hyphenated, <= 50 chars, and avoids blocked terms.
Related Skills
WordPress/wp-abilities-verify
tools
VerifiedTrustedOfficial
Verify a WordPress plugin's Abilities API registrations: enumerate abilities, check that callback behavior matches each annotation's claim (the adversarial readonly-but-writes detection), validate permissions and schemas, and validate audit documents produced by wp-abilities-audit.
1,582SKILL.mdUpdated May 28, 2026
WordPress/wp-abilities-audit
tools
VerifiedTrustedOfficial
Audit a WordPress plugin's REST surface and produce a standardized audit document proposing Abilities API registrations. Produces a markdown doc with a YAML schema and prose sections that humans and agents can both consume when planning a registration rollout. Works on any WP plugin.
1,582SKILL.mdUpdated May 28, 2026
WordPress/wp-abilities-api
tools
VerifiedTrustedOfficial
Use when working with the WordPress Abilities API (wp_register_ability, wp_register_ability_category, /wp-json/wp-abilities/v1/*, @wordpress/abilities) including defining abilities, categories, meta, REST exposure, and permissions checks for clients.
1,582SKILL.mdUpdated Mar 19, 2026
WordPress/blueprint
tools
VerifiedTrustedOfficial
Use when creating, editing, or reviewing WordPress Playground blueprint JSON files. Triggers on mentions of blueprints, playground configuration, or requests to set up a WordPress demo environment.
1,015SKILL.mdUpdated Mar 27, 2026