WordPress.org plugin repository, a year in review

WordPress.org plugin repository, a year in review 🔗 **Source:** [WordPress.org plugin repository, a year in review](https://www.youtube.com/watch?v=AfinnT3XhxY) > [!note]+ Document Notes > tags: [wordpress, plugin-repository, community, open-source] > author: Francesco Torres > source: YouTube > reference: https://www.youtube.com/watch?v=AfinnT3XhxY > date created: 2024-12-19 16:45 > > # 🏷️ Title: WordPress.org Plugin Repository: A Year in Review >  ## 🧰 Action Inbox - [H1] Use Plugin Check tool before submitting plugins — prevent common issues and speed up review #security - [H2] Read and follow plugin guidelines — basic community expectation #documentation - [H3] Prefix all functions/classes with 4+ character unique string — prevent conflicts #development ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [Make WordPress Plugins](https://make.wordpress.org/plugins/) - [Plugin Check Tool](https://wordpress.org/plugins/plugin-check/) ## 📝 Summary - WordPress Plugin Review team underwent major transition after longtime leader Mika Epstein stepped down in 2023 - New volunteer team tackled massive backlog of 1,300+ plugins, reducing wait times from 3 months to 20-25 days - Common plugin issues include security flaws (80%+ of submissions), improper prefixing, and broken guidelines - New Plugin Check tool launched to help developers identify issues before submission - Community expectations include following guidelines, maintaining plugins, and applying security best practices ## 📖 Main Content The WordPress.org plugin repository serves nearly 60,000 plugins to millions of websites, maintained entirely by volunteers. In 2023, the Plugin Review team faced a crisis when Mika Epstein, who had reviewed over half of all plugin submissions since 2012, announced her departure. Francesco Torres led the transition to a new volunteer team structure. They inherited a massive backlog that peaked at 1,300 pending plugins with 3-month wait times. Through improved processes, automated tools performing 171 checks, and better communication, the team reduced review times to 20-25 days while approving 2,200 plugins in the past year. The review process involves both automated security scanning and manual code review, with each plugin requiring an average of 5 reviews before approval. Common issues include security vulnerabilities (sanitization, escaping, nonces), improper function prefixing, and guideline violations. Sadly, about half of plugin authors never respond to reviewer feedback. The new Plugin Check tool helps developers identify issues before submission, potentially reducing reviewer workload and accelerating approvals for everyone. ## 🗒️ Notes #### ⏱️ [00:00](https://www.youtube.com/watch?v=AfinnT3XhxY&t=0) — [H1] Introduction and Background - Key idea: Francesco Torres joined Plugin Review team when longtime leader stepped down - Evidence: "Francesco became a member of the plugin team when Mika Epstein stepped down about a year ago" #### ⏱️ [03:45](https://www.youtube.com/watch?v=AfinnT3XhxY&t=225) — [H1] Repository History: Origins in 2005 - Key idea: WordPress plugin repository started as WP-plugins.org with just 60 plugins - Evidence: "This is 2005 but it is news for me... this is a repository with 60 plugins that is actually the same repository we have today" #### ⏱️ [06:12](https://www.youtube.com/watch?v=AfinnT3XhxY&t=372) — [H2] First Official Directory Launch 2007 - Key idea: Official WordPress.org plugin directory launched with WordPress 2.2 featuring modern interface - Evidence: "In 2007 along with WordPress 2.2 the first version of the official WordPress.org plugin directory is released" #### ⏱️ [09:30](https://www.youtube.com/watch?v=AfinnT3XhxY&t=570) — [H2] Community Legacy: Alex Mills Story - Key idea: Deceased developer's plugins continue serving 1M+ websites through community maintenance - Evidence: "Today plugins developed by Alex Mills are used for more than 1 million websites built on WordPress" #### ⏱️ [12:45](https://www.youtube.com/watch?v=AfinnT3XhxY&t=765) — [H1] Current Scale: 60,000 Plugins - Key idea: Repository approaching 60,000 total plugins maintained by all-volunteer team - Evidence: "Somehow the plugin directory is today close to get to a total of 60,000 plugins available" #### ⏱️ [15:20](https://www.youtube.com/watch?v=AfinnT3XhxY&t=920) — [H1] Team Crisis: Mika Epstein's Departure - Key idea: Main contributor who reviewed half of all submissions announced departure in March 2023 - Evidence: "In March 2023 she announced that she will be stepping down from plugins review by July 2023" #### ⏱️ [18:10](https://www.youtube.com/watch?v=AfinnT3XhxY&t=1090) — [H1] Reluctant Recruitment Process - Key idea: Francesco initially refused multiple times before joining the new team - Evidence: "Obviously the first I say is no are you crazy... no no no no no" #### ⏱️ [21:30](https://www.youtube.com/watch?v=AfinnT3XhxY&t=1290) — [H2] Review Process: Technical Analysis - Key idea: Automated tools perform 171 checks including security, internationalization, and code quality - Evidence: "This tool performs 171 checks and 56 of those are new automated checks" #### ⏱️ [24:15](https://www.youtube.com/watch?v=AfinnT3XhxY&t=1455) — [H2] Workflow Improvements: 400+ Commits - Key idea: Team made over 400 commits to internal tools to increase efficiency and accuracy - Evidence: "In this period we did more than 400 commits to these internal tools adding functionality and fixing bugs" #### ⏱️ [26:45](https://www.youtube.com/watch?v=AfinnT3XhxY&t=1605) — [H1] Backlog Crisis: 1,300 Plugin Peak - Key idea: Plugin queue peaked at 1,300 submissions with 3-month wait times before improvement - Evidence: "There were over 700 plugins in the queue when we join and that peaked at 1,300 plugins back in October" #### ⏱️ [29:20](https://www.youtube.com/watch?v=AfinnT3XhxY&t=1760) — [H2] Review Statistics: 4-8 Minutes Each - Key idea: Each plugin review takes 4-8 minutes with average 5 reviews needed before approval - Evidence: "Each plugin review takes an average of 4 to 8 minutes and every plugin requires an average of five reviews" #### ⏱️ [31:40](https://www.youtube.com/watch?v=AfinnT3XhxY&t=1900) — [H2] Communication Problems: 50% No Response - Key idea: About half of plugin authors never respond to reviewer feedback, wasting volunteer time - Evidence: "We never receive a response for around half of the plugins we review" #### ⏱️ [35:15](https://www.youtube.com/watch?v=AfinnT3XhxY&t=2115) — [H2] Success Metrics: 2,200 Approvals - Key idea: Team approved 2,200 plugins in past year despite challenges - Evidence: "In the last 12 months we have been able to approve 2,200 plugins" #### ⏱️ [38:50](https://www.youtube.com/watch?v=AfinnT3XhxY&t=2330) — [H1] Security Issues: 80% of Submissions - Key idea: Over 80% of submitted plugins have sanitization, escaping, or nonce security issues - Evidence: "We find this kind of issues in more than 80% of the submitted plugins to the directory" #### ⏱️ [42:30](https://www.youtube.com/watch?v=AfinnT3XhxY&t=2550) — [H1] Plugin Check Tool Launch - Key idea: New Plugin Check tool helps developers identify common issues before submission - Evidence: "This is a new plugin developed by the WordPress performance and Plugin Review teams" ## 📚 References - [WordPress Plugin Directory Guidelines](https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin-guidelines/) - [Plugin Check Tool](https://wordpress.org/plugins/plugin-check/) - [Make WordPress Plugins](https://make.wordpress.org/plugins/) ## 🗣️ Paraphrase - The WordPress plugin repository transformed from a 60-plugin collection requiring manual email to Matt Mullenweg into a 60,000-plugin ecosystem with automated review processes - A volunteer team crisis occurred when the longtime leader reviewing half of all submissions departed, creating massive backlogs that new volunteers had to resolve - Plugin security remains the biggest issue, with over 80% of submissions lacking proper sanitization, escaping, and nonce implementation ## 📰 Newsletter The WordPress Plugin Review team just shared their incredible year-in-review story, and it's both inspiring and concerning for our community. **The Challenge**: When longtime team lead Mika Epstein stepped down after 11 years of reviewing over half of all plugin submissions, the review backlog exploded to 1,300+ plugins with 3-month wait times. **The Recovery**: A new volunteer team led by Francesco Torres implemented automated tools (171 security and quality checks), streamlined workflows, and reduced wait times to 20-25 days while approving 2,200 plugins. **The Reality Check**: Over 80% of plugin submissions have basic security flaws - missing sanitization, escaping, or nonces. About half of plugin authors never respond to feedback, wasting precious volunteer time. **Your Action**: Use the new [Plugin Check tool](https://wordpress.org/plugins/plugin-check/) before submitting or updating plugins. It catches the most common issues automatically, speeding up reviews for everyone. **Community Impact**: This story perfectly illustrates WordPress's volunteer-driven nature - from Alex Mills' plugins continuing to serve 1M+ sites after his passing to new volunteers stepping up during crisis. Resources: [Plugin Guidelines](https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin-guidelines/), [Make Plugins Team](https://make.wordpress.org/plugins/), [Plugin Check Tool](https://wordpress.org/plugins/plugin-check/) ## ✅ Action Items #### WordPress - Core: Evaluate dashboard warnings for outdated plugins to improve security awareness - Core Program Team: Support Plugin Check tool integration and development resources - Community: Promote Plugin Check tool adoption through meetups and educational content - Support: Create knowledge base articles for common plugin submission issues - Design: Improve plugin author onboarding experience and communication flows - Documentation: Expand plugin security best practices with practical examples #### Community - Contributors: Volunteer for Plugin Review team during next recruitment cycle - Maintainers: Implement Plugin Check tool in development workflows before submissions - Sponsors: Consider supporting Five for the Future program to provide reviewer time ## 🧪 Hypotheses - Plugin authors using Plugin Check tool before submission will have 50% fewer review cycles needed - Automated security scanning reduces manual review time while maintaining accuracy standards - Volunteer team sustainability depends on structured onboarding and tool automation rather than individual heroics - Community-maintained legacy plugins can successfully serve millions of sites without original authors ### 📊 Methodology - Track review cycle reduction for plugins pre-scanned with Plugin Check tool - Measure automated tool accuracy against manual security findings - Survey plugin authors about communication preferences and response barriers - Analyze correlation between plugin complexity and review time requirements ### ❓ Questions - How can the community better support plugin authors who abandon their submissions mid-review? - What governance model prevents single points of failure in critical volunteer teams? - Should WordPress core integrate plugin security scanning to catch issues earlier? ### 🔮 Future Research - AI-assisted code review for reducing false positives in automated scanning - Sustainable volunteer recruitment and retention models for technical teams - Plugin lifecycle management strategies for unmaintained but functional code ### 💡 Implications - Practice: Plugin developers must integrate security scanning into their development workflow - Policy: WordPress.org may need updated guidelines for AI-assisted reviews and plugin lifecycle management - Security: Repository security depends heavily on volunteer capacity and tool automation quality - Education: Community needs expanded security training for plugin developers - Funding: Five for the Future program demonstrates importance of sponsor-supported volunteer time ### 🧠 Learning Styles Assessment Reading level estimate: 10th Grade #### 👀 Visual learners - Present: Historical screenshots, tool interface examples, statistical charts - Improve: Process flowcharts, security vulnerability diagrams, team structure visuals #### 🔊 Aural learners - Present: Full video presentation available with clear narration - Improve: Podcast version focusing on community lessons learned #### 🗣️ Verbal learners - Present: Clear definitions, community stories, technical explanations - Improve: Glossary of review terminology, analogy-based security explanations #### 🧩 Kinesthetic learners - Present: Plugin Check tool for hands-on testing - Improve: Interactive security scanning tutorial, step-by-step submission guide #### 🧠 Logical learners - Present: Review statistics, process timelines, tool performance metrics - Improve: Decision trees for common review outcomes, cost-benefit analysis of automation #### 🧑‍🤝‍🧑 Social learners - Present: Team transition story, community collaboration examples - Improve: Plugin author support forums, peer review opportunities #### 🧘‍♀️ Solitary learners - Present: Self-service Plugin Check tool, written guidelines - Improve: Checklist-based submission preparation, self-assessment rubrics #### 🌿 Naturalistic learners - Present: Open source ecosystem connections, community lifecycle examples - Improve: Plugin ecosystem health metaphors, sustainability thinking ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear heading structure, descriptive talk progression - Improve: Transcript formatting with proper heading hierarchy #### Keyboard navigation - Present: Standard video controls available - Improve: Chaptered navigation for key sections #### Contrast and readability - Present: Clear presentation slides with good contrast - Improve: High contrast versions of statistical charts #### Text resizing and reflow - Present: Responsive transcript formatting - Improve: Mobile-optimized note structure #### Media and captions - Present: Full transcript provided - Improve: Time-synced captions, downloadable transcript #### Forms and interactions - Present: Plugin Check tool follows WordPress accessibility standards - Improve: Keyboard-accessible scanning interface ### 🌍 DEIB Assessment #### Cultural breadth - Present: Spanish language references, international community perspective - Improve: Examples from non-English WordPress communities #### Inclusive language - Present: Gender-neutral terms, accessible technical explanations - Improve: Plain language summaries for non-developers #### Neurodiversity support - Present: Clear structure with timestamped sections - Improve: Visual summary cards, reduced cognitive load in explanations #### Representation - Present: Volunteer leadership from diverse backgrounds - Improve: Highlight contributors from underrepresented regions #### Psychological safety - Present: Acknowledgment of reviewer mistakes, welcoming tone for new contributors - Improve: Clearer communication about learning-friendly review process ### ✅ Logical Validity #### Strong reasoning - Causal reasoning: Volunteer departure clearly linked to backlog crisis and community response - Statistical evidence: Specific metrics support claims about review times and success rates - Analogical strength: Community maintenance of deceased developer's plugins illustrates open source sustainability #### Fallacies - Survivorship bias: