Web design, CMS and development, since 2014VR Games
11 November 2026
Two major pillars of the WordPress plugin ecosystem—WordPress.org and WooCommerce's commercial Woo Marketplace—have intensified their reviews of new plugins and extensions in recent years. New automated checks, AI-powered security scanning, and more rigorous submission requirements have been introduced, according to both marketplaces' official documentation.
After a plugin is submitted by an author, it enters a review queue and the author receives an automatic confirmation email. WordPress then manually reviews the plugin to determine if it meets guidelines, is free of common errors, and adheres to security protocols.
The review process involves a multi-step workflow:
The official review checklist for WordPress.org assures reviewers to verify that:
Third-party hosting and security guidance from companies like Liquid Web assumes that every new plugin in the official marketplace is vetted through this quality-assurance process.
The main takeaway from this is: don't skimp on this plugin development. WordPress libraries' guidelines are evolving every day, and so are their review guidelines for plugin authors.
While most plugins are processed within 1-10 days, that doesn't account for any potential red flags that could flag a plugin for more thorough review. Establishing a quality product, with clear naming, consistent documentation, and extensive testing can ensure you clear the WordPress Plugin that first step.
Unlike some leadership or decision-making processes within the WordPress community, plugin review and security release operations for the WordPress library are explicitly governed by published rules.
Automattic/WooCommerce's Woo Marketplace is the commercial counterpart to the WordPress.org directory. To sell on this platform, developers must first apply for and secure Marketplace vendor status.
Once a developer becomes a Marketplace vendor, extensions can be submitted for review. WooCommerce has created a multi-step process meant to ensure an extension's success on the marketplace:
Revendaors are also evaluated for maintenance post-launch, and developers found inattentive to user and investor feedback are penalized (rejected or delisted plugins, or potentially denied marketplace status).
If an extension clears all stages of the review, it undergos launch preparation and is onboarded as an active Woo Marketplace product.
WooCommerce providers can expect several rounds of revision before final approval or rejection, so be prepared for feedback, and be honored by it! Getting into the Woo Marketplace is a win, but making it take off is the real goal. So make sure to consider the WordPress, Woo user experience, as well as their desired commercial model as the first line of your design and business strategy.
The expansive review protocols of Woo-Commerce's market are supported by the Quality Insights Toolkit (QIT), WooCommerce's stand-alone testing platform for developers, and a key part of their structured, digital review system. Developers can test their own products pre-release using QIT, which not only validates their product, but searches for armchair issues before an extension is ever submitted for review.
Proving that they are not alone, even third-party marketplaces are charting the same course as their WordPress counterparts.
Independent hosts like WP Bay factor automated analysis, guided by human authors, and practical product testing into their review process. WP Bay makes it clear that "there is no single scanner or score baked into the plugin upon approval," re-asserting that their review is holistic and any plugin ultimately certified by them may still contain unknown vulnerabilities.
Their approach is called, in part, "risk-based." In a nutshell, an experienced team of reviewers manually assess the potential issues in an extension, using tools to guide their review. If something is identified as a critical issue, a developer must revise their product to address the issue before an extension is approved for review. WP Bay stops short of calling their certified plugins "safe," but doesn't claim a broader security withstanding by their review either.
Poor quality extensions opened serious vulnerabilities and exposed millions to threats. In the absence of backlash or regulation, independent marketplaces took it upon themselves to investigate their products' security and quality internally. They're tightening their stance in the face of these cracks, and regulators across the WordPress community are following suit with their own reviews, restrictions, and sanctions. And in doing so, they've elevated that responsibility even further down the line; with these regulations in motion, they absolve developers from responsibility in the face of leaks, even passing the costly burden of safeguard on to the end user. Consumer advocates argue that this legal turning point will have broad impact.
"The explosion in consumer arbitrations over the last decade should put it in perspective.. marketplaces have relied on code as your defense, like armor, for long enough." says the head of consumer protections at Mozilla, who unpacked the details for a colleague at Hootsuite. With a marketplaces headline buzzing over vulnerabilities that tie the potential product flaws to marketplace authors, their talk goes, "it's like they're ripping off the protective code, and serving consumers up vulnerable to their product."