wordpress-plugin-development

WordPress Plugin Development Workflow

Overview

Specialized workflow for creating WordPress plugins with proper architecture, hooks system, admin interfaces, REST API endpoints, and security practices. Now includes WordPress 7.0 features for modern plugin development.

WordPress 7.0 Plugin Development

Key Features for Plugin Developers

1. Real-Time Collaboration (RTC) Compatibility
2. Yjs-based CRDT for simultaneous editing
3. Custom transport via sync.providers filter
4. Requirement: Register post meta with show_in_rest => true

1. AI Connector Integration
2. Provider-agnostic AI via wp_ai_client_prompt()
3. Settings > Connectors admin screen
4. Works with OpenAI, Claude, Gemini, Ollama

1. Abilities API
2. Declare plugin capabilities for AI agents
3. REST API: /wp-json/abilities/v1/manifest
4. MCP adapter support

1. DataViews & DataForm
2. Modern admin interfaces
3. Replaces WP_List_Table patterns
4. Built-in validation

1. PHP-Only Blocks
2. Register blocks without JavaScript
3. Auto-generated Inspector controls

When to Use This Workflow

Use this workflow when:

• Creating custom WordPress plugins
• Extending WordPress functionality
• Building admin interfaces
• Adding REST API endpoints
• Integrating third-party services
• Implementing WordPress 7.0 AI/Collaboration features

Workflow Phases

Phase 1: Plugin Setup

Skills to Invoke

• app-builder - Project scaffolding
• backend-dev-guidelines - Backend patterns

Actions

1. Create plugin directory structure
2. Set up main plugin file with header
3. Implement activation/deactivation hooks
4. Set up autoloading
5. Configure text domain

WordPress 7.0 Plugin Header

/*
Plugin Name: My Plugin
Plugin URI: https://example.com/my-plugin
Description: A WordPress 7.0 compatible plugin with AI and RTC support
Version: 1.0.0
Requires at least: 6.0
Requires PHP: 7.4
Author: Developer Name
License: GPL2+
*/

Copy-Paste Prompts

Use @app-builder to scaffold a new WordPress plugin

Phase 2: Plugin Architecture

Skills to Invoke

• backend-dev-guidelines - Architecture patterns

Actions

1. Design plugin class structure
2. Implement singleton pattern
3. Create loader class
4. Set up dependency injection
5. Configure plugin lifecycle

WordPress 7.0 Architecture Considerations

• Prepare for iframed editor compatibility
• Design for collaboration-aware data flows
• Consider Abilities API for AI integration

Copy-Paste Prompts

Use @backend-dev-guidelines to design plugin architecture

Phase 3: Hooks Implementation

Skills to Invoke

• wordpress-penetration-testing - WordPress patterns

Actions

1. Register action hooks
2. Create filter hooks
3. Implement callback functions
4. Set up hook priorities
5. Add conditional hooks

Copy-Paste Prompts

Use @wordpress-penetration-testing to understand WordPress hooks

Phase 4: Admin Interface

Skills to Invoke

• frontend-developer - Admin UI

Actions

1. Create admin menu
2. Build settings pages
3. Implement options registration
4. Add settings sections/fields
5. Create admin notices

WordPress 7.0 Admin Considerations

• Test with new admin color scheme
• Consider DataViews for data displays
• Implement view transitions
• Use new validation patterns

DataViews Example

import { DataViews } from '@wordpress/dataviews';

const MyPluginDataView = () => {
    const data = [/* records */];
    const fields = [
        { id: 'title', label: 'Title', sortable: true },
        { id: 'status', label: 'Status', filterBy: true }
    ];
    const view = {
        type: 'table',
        perPage: 10,
        sort: { field: 'title', direction: 'asc' }
    };

    return (
        <DataViews
            data={data}
            fields={fields}
            view={view}
            onChangeView={handleViewChange}
        />
    );
};

Copy-Paste Prompts

Use @frontend-developer to create WordPress admin interface

Phase 5: Database Operations

Skills to Invoke

• database-design - Database design
• postgresql - Database patterns

Actions

1. Create custom tables
2. Implement CRUD operations
3. Add data validation
4. Set up data sanitization
5. Create data upgrade routines

RTC-Compatible Post Meta

// Register meta for Real-Time Collaboration
register_post_meta('post', 'my_custom_field', [
    'type' => 'string',
    'single' => true,
    'show_in_rest' => true,  // Required for RTC
    'sanitize_callback' => 'sanitize_text_field',
]);

// For WP 7.0, also consider:
register_term_meta('category', 'my_term_field', [
    'type' => 'string',
    'show_in_rest' => true,
]);

Copy-Paste Prompts

Use @database-design to design plugin database schema

Phase 6: REST API

Skills to Invoke

• api-design-principles - API design
• api-patterns - API patterns

Actions

1. Register REST routes
2. Create endpoint callbacks
3. Implement permission callbacks
4. Add request validation
5. Document API endpoints

WordPress 7.0 REST API Enhancements

• Abilities API integration
• AI Connector endpoints
• Enhanced validation

Copy-Paste Prompts

Use @api-design-principles to create WordPress REST API endpoints

Phase 7: Security

Skills to Invoke

• wordpress-penetration-testing - WordPress security
• security-scanning-security-sast - Security scanning

Actions

1. Implement nonce verification
2. Add capability checks
3. Sanitize all inputs
4. Escape all outputs
5. Secure database queries

WordPress 7.0 Security Considerations

• Test Abilities API permission boundaries
• Validate AI connector credential handling
• Review collaboration data isolation
• PHP 7.4+ requirement compliance

Copy-Paste Prompts

Use @wordpress-penetration-testing to audit plugin security

Phase 8: WordPress 7.0 Features

Skills to Invoke

• api-design-principles - AI integration
• backend-dev-guidelines - Block development

AI Connector Implementation

// Using WordPress 7.0 AI Connector
add_action('save_post', 'my_plugin_generate_ai_summary', 10, 2);

function my_plugin_generate_ai_summary($post_id, $post) {
    if (wp_is_post_autosave($post_id) || wp_is_post_revision($post_id)) {
        return;
    }
    
    // Check if AI client is available
    if (!function_exists('wp_ai_client_prompt')) {
        return;
    }
    
    $content = strip_tags($post->post_content);
    if (empty($content)) {
        return;
    }
    
    // Build prompt - direct string concatenation for input
    $result = wp_ai_client_prompt(
        'Create a compelling 2-sentence summary for social media: ' . substr($content, 0, 1000)
    );
    
    if (is_wp_error($result)) {
        return;
    }
    
    // Set temperature for consistent output
    $result->using_temperature(0.3);
    $summary = $result->generate_text();
    
    if ($summary && !is_wp_error($summary)) {
        update_post_meta($post_id, '_ai_summary', sanitize_textarea_field($summary));
    }
}

Abilities API Registration

// Register ability categories on their own hook
add_action('wp_abilities_api_categories_init', function() {
    wp_register_ability_category('content-creation', [
        'label' => __('Content Creation', 'my-plugin'),
        'description' => __('Abilities for generating and managing content', 'my-plugin'),
    ]);
});

// Register abilities on their own hook
add_action('wp_abilities_api_init', function() {
    wp_register_ability('my-plugin/generate-summary', [
        'label' => __('Generate Summary', 'my-plugin'),
        'description' => __('Creates an AI-powered summary of content', 'my-plugin'),
        'category' => 'content-creation',
        'input_schema' => [
            'type' => 'object',
            'properties' => [
                'content' => ['type' => 'string'],