For SaaS teams shipping a connector plugin to WordPress.org
WP.org ReadyWill your connector plugin pass review - and what do you send the reviewer?
Paste your SaaS connector plugin's readme.txt, main-file header and the code that calls your service, and get it checked against the WordPress.org review rules, then the submission plan and the reply to the reviewer's email. Your browser flags trialware, an undocumented external service, a call home without opt-in, remote code in wp-admin, a brand-first name that is not yours, an agency or free-mail account, the slug, the Stable tag, the tags and any compliance claim, ranks where paid value lives and lays out your stage's plan.
The plugin free
The interview - each answer moves a check or a rung free
The checks free
What the page flags
Your stage's plan
Every check, rule by rule
External hosts
Where paid value lives
What the code scan found
Your corrected readme header free
Only the fields your input gives, a [placeholder] for every unknown, and an External services block for each host the code calls - fill in what, data sent, when, terms and privacy.
readme.txt header
The submission plan metered
Pricing as soon as the session is ready...
Sign inThe reply could not be read. Here it is as it came back:
Caveats
Caveats
The page's check of this reply
Saved plugins
How it works - and what is sourced
The checks follow the skill's seven review rules. The code is scanned with a fixed set of signal kinds - remote calls, external hosts, license locks (license and plan checks, a locked or greyed Pro UI, local trials and quota counters), iframes in admin code, scripts and styles enqueued from a remote URL, custom update checkers, activation hooks that call home, telemetry, powered-by credits, compliance claims and opt-ins - and every check reads those signals, never a pattern of its own. A license lock or paid features enforced in the plugin is trialware; every host the code calls must be named in an External services section with terms and privacy; telemetry or an activation ping needs a default-off opt-in; an iframed admin page, an admin script from a CDN (fonts excepted) and a custom updater are remote code in wp-admin; a name that starts with another company's brand, an agency account or a free-mail domain, a slug with "wordpress" or "plugin" or starting with "woo", and a text domain that is not the slug fail; Stable tag must be a real tag; more than 12 tags is spam and only the first five count; a compliance claim fails.
Where paid value lives follows the skill's ranking: a directory connector with paid features enforced by your service first, a directory plugin plus a premium add-on sold on your site second, a self-hosted zip only last. Paid features that must run inside WordPress promote the add-on; keeping an iframed admin app or your own updater as core, when the code has one, promotes the self-hosted zip. The checks that come from the skill's submission packet (the short description, Contributors, Requires at least and Requires PHP in the main header) are marked "packet". The page never guesses which WordPress version is current, and cannot see your zip.
Every figure the skill quotes carries a dagger: about 1,050† plugins in the queue at its peak, a cooldown of 6 hours† per release, a zip under 10 MB†, 3 months† before an incomplete review is rejected, about 10 business days† per review reply, 6 to 14 days† to appear in search, 6 months† before an approved plugin with no code can be closed, a 24-hour† update delay, 10,000† installs. † verify against the current developer.wordpress.org handbook and make.wordpress.org/plugins; the release process changes often.