Wordpress Plugin Development

When to Use This Workflow

Use this workflow when:

• Creating custom WordPress plugins
• Extending WordPress functionality
• Building admin interfaces
• Adding REST API endpoints
• Integrating third-party services
• Implementing WordPress 7.0 AI/Collaboration features

Workflow Phases

Phase 1: Plugin Setup

Skills to Invoke

• app-builder - Project scaffolding
• backend-dev-guidelines - Backend patterns

Actions

1. Create plugin directory structure
2. Set up main plugin file with header
3. Implement activation/deactivation hooks
4. Set up autoloading
5. Configure text domain

WordPress 7.0 Plugin Header

/*
Plugin Name: My Plugin
Plugin URI: https://example.com/my-plugin
Description: A WordPress 7.0 compatible plugin with AI and RTC support
Version: 1.0.0
Requires at least: 6.0
Requires PHP: 7.4
Author: Developer Name
License: GPL2+
*/

Copy-Paste Prompts

Use @app-builder to scaffold a new WordPress plugin

Phase 2: Plugin Architecture

Skills to Invoke

• backend-dev-guidelines - Architecture patterns

Actions

1. Design plugin class structure
2. Implement singleton pattern
3. Create loader class
4. Set up dependency injection
5. Configure plugin lifecycle

WordPress 7.0 Architecture Considerations

• Prepare for iframed editor compatibility
• Design for collaboration-aware data flows
• Consider Abilities API for AI integration

Copy-Paste Prompts

Use @backend-dev-guidelines to design plugin architecture

Phase 3: Hooks Implementation

Skills to Invoke

• wordpress-penetration-testing - WordPress patterns

Actions

1. Register action hooks
2. Create filter hooks
3. Implement callback functions
4. Set up hook priorities
5. Add conditional hooks

Copy-Paste Prompts

Use @wordpress-penetration-testing to understand WordPress hooks

Phase 4: Admin Interface

Skills to Invoke

• frontend-developer - Admin UI

Actions

1. Create admin menu
2. Build settings pages
3. Implement options registration
4. Add settings sections/fields
5. Create admin notices

WordPress 7.0 Admin Considerations

• Test with new admin color scheme
• Consider DataViews for data displays
• Implement view transitions
• Use new validation patterns

DataViews Example

import { DataViews } from '@wordpress/dataviews';

const MyPluginDataView = () => {
    const data = [/* records */];
    const fields = [
        { id: 'title', label: 'Title', sortable: true },
        { id: 'status', label: 'Status', filterBy: true }
    ];
    const view = {
        type: 'table',
        perPage: 10,
        sort: { field: 'title', direction: 'asc' }
    };

    return (
        <DataViews
            data={data}
            fields={fields}
            view={view}
            onChangeView={handleViewChange}
        />
    );
};

Copy-Paste Prompts

Use @frontend-developer to create WordPress admin interface

Phase 5: Database Operations

Skills to Invoke

• database-design - Database design
• postgresql - Database patterns

Actions

1. Create custom tables
2. Implement CRUD operations
3. Add data validation
4. Set up data sanitization
5. Create data upgrade routines

RTC-Compatible Post Meta

// Register meta for Real-Time Collaboration
register_post_meta('post', 'my_custom_field', [
    'type' => 'string',
    'single' => true,
    'show_in_rest' => true,  // Required for RTC
    'sanitize_callback' => 'sanitize_text_field',
]);

// For WP 7.0, also consider:
register_term_meta('category', 'my_term_field', [
    'type' => 'string',
    'show_in_rest' => true,
]);

Copy-Paste Prompts

Use @database-design to design plugin database schema

Phase 6: REST API

Skills to Invoke

• api-design-principles - API design
• api-patterns - API patterns

Actions

1. Register REST routes
2. Create endpoint callbacks
3. Implement permission callbacks
4. Add request validation
5. Document API endpoints

WordPress 7.0 REST API Enhancements

• Abilities API integration
• AI Connector endpoints
• Enhanced validation

Copy-Paste Prompts

Use @api-design-principles to create WordPress REST API endpoints

Phase 7: Security

Skills to Invoke

• wordpress-penetration-testing - WordPress security
• security-scanning-security-sast - Security scanning

Actions

1. Implement nonce verification
2. Add capability checks
3. Sanitize all inputs
4. Escape all outputs
5. Secure database queries

WordPress 7.0 Security Considerations

• Test Abilities API permission boundaries
• Validate AI connector credential handling
• Review collaboration data isolation
• PHP 7.4+ requirement compliance

Copy-Paste Prompts

Use @wordpress-penetration-testing to audit plugin security

Phase 8: WordPress 7.0 Features

Skills to Invoke

• api-design-principles - AI integration
• backend-dev-guidelines - Block development

AI Connector Implementation

// Using WordPress 7.0 AI Connector
add_action('save_post', 'my_plugin_generate_ai_summary', 10, 2);

function my_plugin_generate_ai_summary($post_id, $post) {
    if (wp_is_post_autosave($post_id) || wp_is_post_revision($post_id)) {
        return;
    }
    
    // Check if AI client is available
    if (!function_exists('wp_ai_client_prompt')) {
        return;
    }
    
    $content = strip_tags($post->post_content);
    if (empty($content)) {
        return;
    }
    
    // Build prompt - direct string concatenation for input
    $result = wp_ai_client_prompt(
        'Create a compelling 2-sentence summary for social media: ' . substr($content, 0, 1000)
    );
    
    if (is_wp_error($result)) {
        return;
    }
    
    // Set temperature for consistent output
    $result->using_temperature(0.3);
    $summary = $result->generate_text();
    
    if ($summary && !is_wp_error($summary)) {
        update_post_meta($post_id, '_ai_summary', sanitize_textarea_field($summary));
    }
}

Abilities API Registration

// Register ability categories on their own hook
add_action('wp_abilities_api_categories_init', function() {
    wp_register_ability_category('content-creation', [
        'label' => __('Content Creation', 'my-plugin'),
        'description' => __('Abilities for generating and managing content', 'my-plugin'),
    ]);
});

// Register abilities on their own hook
add_action('wp_abilities_api_init', function() {
    wp_register_ability('my-plugin/generate-summary', [
        'label' => __('Generate Summary', 'my-plugin'),
        'description' => __('Creates an AI-powered summary of content', 'my-plugin'),
        'category' => 'content-creation',
        'input_schema' => [
            'type' => 'object',
            'properties' => [
                'content' => ['type' => 'string'],
                'length' => ['type' => 'integer', 'default' => 2]
            ],
            'required' => ['content']
        ],
        'output_schema' => [
            'type' => 'object',
            'properties' => [
                'summary' => ['type' => 'string']
            ]
        ],
        'execute_callback' => 'my_plugin_generate_summary_cb',
        'permission_callback' => function() {
            return current_user_can('edit_posts');
        }
    ]);
});

// Handler callback
function my_plugin_generate_summary_cb($input) {
    $content = isset($input['content']) ? $input['content'] : '';
    $length = isset($input['length']) ? absint($input['length']) : 2;
    
    if (empty($content)) {
        return new WP_Error('empty_content', 'No content provided');
    }
    
    if (!function_exists('wp_ai_client_prompt')) {
        return new WP_Error('ai_unavailable', 'AI not available');
    }
    
    $prompt = sprintf('Create a %d-sentence summary of: %s', $length, substr($content, 0, 2000));
    
    $result = wp_ai_client_prompt($prompt)
        ->using_temperature(0.3)
        ->generate_text();
    
    if (is_wp_error($result)) {
        return $result;
    }
    
    return ['summary' => sanitize_textarea_field($result)];
}

PHP-Only Block Registration

// Register block entirely in PHP (WordPress 7.0)
// Note: For full PHP-only blocks, use block.json with PHP render_callback

// First, create a block.json file in build/ or includes/blocks/
// Then register in PHP:

// Simple PHP-only block registration (WordPress 7.0+)
if (function_exists('register_block_type')) {
    register_block_type('my-plugin/featured-post', [
        'render_callback' => function($attributes, $content, $block) {
            $post_id = isset($attributes['postId']) ? absint($attributes['postId']) : 0;
            
            if (!$post_id) {
                $post_id = get_the_ID();
            }
            
            $post = get_post($post_id);
            
            if (!$post) {
                return '';
            }
            
            $title = esc_html($post->post_title);
            $excerpt = esc_html(get_the_excerpt($post));
            
            return sprintf(
                '<div class="featured-post"><h2>%s</h2><p>%s</p></div>',
                $title,
                $excerpt
            );
        },
        'attributes' => [
            'postId' => ['type' => 'integer', 'default' => 0],
            'showExcerpt' => ['type' => 'boolean', 'default' => true]
        ],
    ]);
}

Disable Collaboration (if needed)

// Disable RTC for specific post types
import { addFilter } from '@wordpress/hooks';

addFilter(
    'sync.providers',
    'my-plugin/disable-collab',
    () => []
);

Phase 9: Testing

Skills to Invoke

• test-automator - Test automation
• php-pro - PHP testing

Actions

1. Set up PHPUnit
2. Create unit tests
3. Write integration tests
4. Test with WordPress test suite
5. Configure CI

WordPress 7.0 Testing Priorities

• Test RTC compatibility
• Verify AI connector functionality
• Validate DataViews integration
• Test Interactivity API with watch()

Copy-Paste Prompts

Use @test-automator to set up plugin testing

Plugin Structure

plugin-name/
├── plugin-name.php
├── includes/
│   ├── class-plugin.php
│   ├── class-loader.php
│   ├── class-activator.php
│   └── class-deactivator.php
├── admin/
│   ├── class-plugin-admin.php
│   ├── css/
│   └── js/
├── public/
│   ├── class-plugin-public.php
│   ├── css/
│   └── js/
├── blocks/           # PHP-only blocks (WP 7.0)
├── abilities/        # Abilities API
├── ai/               # AI Connector integration
├── languages/
└── vendor/

WordPress 7.0 Compatibility Checklist

• PHP 7.4+ requirement documented
• Post meta registered with show_in_rest => true for RTC
• Meta boxes migrated to block-based UIs
• AI Connector integration tested
• Abilities API registered (if applicable)
• DataViews integration tested (if applicable)
• Interactivity API uses watch() not effect
• Tested with iframed editor
• Collaboration fallback works (post locking)

Quality Gates

• Plugin activates without errors
• All hooks working
• Admin interface functional
• Security measures implemented
• Tests passing
• Documentation complete
• WordPress 7.0 compatibility verified

Related Workflow Bundles

• wordpress - WordPress development
• wordpress-theme-development - Theme development
• wordpress-woocommerce - WooCommerce

Limitations

• Use this skill only when the task clearly matches the scope described above.
• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.