# WordPress.org Compliance Checklist

Complete checklist for WordPress.org plugin directory submission compliance.

**Last Updated**: 2026-01-26
**Plugin Version**: 1.0.0

---

## Overview

This checklist ensures Multilingual Press Zone meets all WordPress.org plugin directory requirements and guidelines.

**Status Legend**
- ✅ Complete
- ⏳ In Progress
- ❌ Not Started
- ⚠️ Needs Review

---

## 1. Code Quality & Standards

### 1.1 WordPress Coding Standards

- [ ] **PHPCS Scan Passes**
  ```bash
  vendor/bin/phpcs --standard=WordPress includes/ multilingual-press-zone.php
  ```
  - Expected: 0 errors, 0 warnings
  - Run: `cd /path/to/plugin && vendor/bin/phpcs --standard=WordPress includes/`

- [ ] **PHPCompatibility Check**
  ```bash
  vendor/bin/phpcs --standard=PHPCompatibility --runtime-set testVersion 8.3- includes/
  ```
  - Verify PHP 8.3+ compatibility

- [ ] **WordPress VIP Coding Standards** (Optional but recommended)
  ```bash
  vendor/bin/phpcs --standard=WordPress-VIP-Go includes/
  ```

- [ ] **Namespace Usage**
  - All code in `MultilingualPressZone\` namespace ✅
  - No global namespace pollution
  - PSR-4 autoloading

- [ ] **No Deprecated Functions**
  - Check for deprecated WordPress functions
  - Run: `grep -r "deprecated" includes/`
  - Review WordPress version compatibility

### 1.2 PHP Quality

- [ ] **No PHP Errors/Warnings**
  - Enable `WP_DEBUG`, `WP_DEBUG_LOG`, `WP_DEBUG_DISPLAY`
  - Test all plugin features
  - Check debug.log for errors

- [ ] **Strict Types Declared**
  - All files have `declare(strict_types=1);`
  - Verify: `grep -L "declare(strict_types=1);" includes/**/*.php`

- [ ] **No Short PHP Tags**
  - Use `<?php` not `<?`
  - Verify: `grep -r "<?" includes/`

- [ ] **ABSPATH Check**
  - All PHP files have:
    ```php
    if (!defined('ABSPATH')) {
        exit;
    }
    ```

### 1.3 JavaScript Quality

- [ ] **No JavaScript Console Errors**
  - Test all admin pages
  - Test frontend language switcher
  - Check browser console

- [ ] **ES6+ Compatibility**
  - Transpiled to ES5 for broad support
  - Polyfills included if needed

- [ ] **Minified Assets**
  - All JS/CSS minified in production
  - Source maps available for debugging

---

## 2. Security

### 2.1 Input Sanitization

- [ ] **All POST/GET Data Sanitized**
  - Use `sanitize_text_field()`, `absint()`, etc.
  - Audit: `grep -r "\$_POST\|\$_GET" includes/`
  - Verify each input is sanitized

- [ ] **Database Queries Use Prepared Statements**
  - All `$wpdb->query()` uses `$wpdb->prepare()`
  - No direct SQL string concatenation
  - Audit: `grep -r "\$wpdb->query" includes/`

- [ ] **No Direct File Includes**
  - No `$_GET`/`$_POST` in `include`, `require`
  - Use `load_template()` for templates

### 2.2 Output Escaping

- [ ] **All Output Escaped**
  - HTML: `esc_html()`, `esc_html__()`, `esc_html_e()`
  - Attributes: `esc_attr()`, `esc_attr__()`, `esc_attr_e()`
  - URLs: `esc_url()`, `esc_url_raw()`
  - JavaScript: `esc_js()`
  - Audit: Look for `echo` without escaping

- [ ] **No Unsafe HTML Output**
  - Use `wp_kses_post()` for HTML content
  - Whitelist allowed HTML tags
  - No `innerHTML` with user data in JS

### 2.3 Nonce Verification

- [ ] **All Forms Use Nonces**
  - `wp_nonce_field()` in forms
  - `wp_verify_nonce()` on submission
  - Audit: `grep -r "wp_nonce" includes/`

- [ ] **All AJAX Calls Use Nonces**
  - `wp_localize_script()` passes nonce
  - `check_ajax_referer()` verifies nonce
  - Audit AJAX handlers

- [ ] **REST API Uses Nonce/Authentication**
  - `X-WP-Nonce` header checked
  - `current_user_can()` permission checks

### 2.4 Capability Checks

- [ ] **Admin Pages Check Capabilities**
  - All admin pages: `if (!current_user_can('manage_options'))`
  - Role-specific pages check appropriate capabilities

- [ ] **AJAX Actions Check Capabilities**
  - Each AJAX handler checks user capabilities
  - No privileged actions without checks

- [ ] **REST API Endpoints Check Permissions**
  - `permission_callback` defined for all routes
  - Returns WP_Error if permission denied

### 2.5 File Operations

- [ ] **Safe File Uploads**
  - Validate file types
  - Check MIME types
  - Use `wp_handle_upload()`
  - Sanitize filenames

- [ ] **No Direct File System Access**
  - Use WordPress Filesystem API
  - `WP_Filesystem()` for file operations

### 2.6 Security Scanning

- [ ] **Wordfence Scan Passes**
  - Run: Wordfence → Scan
  - Fix all "High" and "Medium" issues

- [ ] **Sucuri SiteCheck Passes**
  - Visit: https://sitecheck.sucuri.net/
  - Enter test site URL

- [ ] **WPScan Passes**
  - Run: `wpscan --url https://test-site.com --enumerate vp`

---

## 3. Internationalization (i18n)

### 3.1 Text Domain

- [ ] **Correct Text Domain**
  - All strings use: `multilingual-press-zone`
  - Plugin header declares: `Text Domain: multilingual-press-zone`

- [ ] **All Strings Translatable**
  - Use `__()`, `_e()`, `_n()`, `_x()`, etc.
  - No hardcoded English strings
  - Audit: Look for raw English strings in `echo`

- [ ] **Text Domain Loaded**
  - `load_plugin_textdomain()` called on init
  - Check: `grep -r "load_plugin_textdomain" includes/`

### 3.2 String Translation

- [ ] **No Dynamic Text Domains**
  - Text domain must be literal string
  - NOT: `__('text', $text_domain)`
  - YES: `__('text', 'multilingual-press-zone')`

- [ ] **Context Provided Where Needed**
  - Use `_x()` for ambiguous strings
  - Example: `_x('Read', 'verb', 'multilingual-press-zone')`

- [ ] **Plural Forms Handled**
  - Use `_n()` for countable strings
  - Example: `_n('%d language', '%d languages', $count, 'multilingual-press-zone')`

### 3.3 POT File Generation

- [ ] **POT File Generated**
  - Run: `wp i18n make-pot . languages/multilingual-press-zone.pot`
  - Includes all translatable strings
  - No missing strings

- [ ] **POT File Included in Plugin**
  - Located at: `languages/multilingual-press-zone.pot`
  - Updated with each release

---

## 4. Database

### 4.1 Table Prefix Usage

- [ ] **No Hardcoded Prefixes**
  - Always use `$wpdb->prefix`
  - Never: `wp_posts`
  - Always: `{$wpdb->prefix}posts`

- [ ] **Custom Tables Use Prefix**
  - Tables: `{$wpdb->prefix}mpz_languages`, etc.
  - Check migration files

### 4.2 Database Operations

- [ ] **dbDelta() Used for Table Creation**
  - All migrations use `dbDelta()`
  - Proper SQL syntax for dbDelta

- [ ] **Foreign Keys Documented**
  - Document foreign key relationships
  - Handle orphaned records

- [ ] **Indexes Defined**
  - Performance-critical columns indexed
  - Covering indexes for complex queries

### 4.3 Data Cleanup

- [ ] **Uninstall Cleanup**
  - `uninstall.php` removes all plugin data
  - Tables, options, user meta deleted
  - Only if user opts in to cleanup

- [ ] **No Data Leaks**
  - Deactivation doesn't delete data (only uninstall does)
  - Clear distinction between deactivate and uninstall

---

## 5. Licensing & Legal

### 5.1 License Compliance

- [ ] **GPL-Compatible License**
  - Plugin header declares license
  - `License: Commercial`
  - License is GPL-compatible

- [ ] **LICENSE File Included**
  - Root directory: `LICENSE.txt` or `LICENSE.md`
  - Full license text

- [ ] **Third-Party Licenses Documented**
  - All dependencies have compatible licenses
  - Licenses documented in README

### 5.2 Trademark Compliance

- [ ] **No Trademark Violations**
  - Plugin name doesn't infringe trademarks
  - "Press Zone" is owned by us

- [ ] **No Misleading Names**
  - Doesn't imply WordPress.org endorsement
  - Doesn't use "WordPress" in plugin name

### 5.3 Copyright Notices

- [ ] **Copyright Notices Included**
  - All files have copyright header
  - Example: `* @copyright 2026 Press.Zone`

---

## 6. readme.txt Validation

### 6.1 Format Compliance

- [ ] **Valid readme.txt Format**
  - Validate: https://wordpress.org/plugins/developers/readme-validator/
  - Upload `readme.txt` and check for errors

- [ ] **Required Sections Present**
  - [x] Plugin name and description
  - [x] Tags (12 tags max)
  - [x] Requires at least
  - [x] Tested up to
  - [x] Stable tag
  - [x] License
  - [x] Description
  - [x] Installation
  - [x] FAQ
  - [x] Screenshots
  - [x] Changelog

### 6.2 Content Quality

- [ ] **Description Clear and Accurate**
  - No exaggerated claims
  - Features accurately described
  - No spammy keywords

- [ ] **FAQ Answers Common Questions**
  - At least 10 FAQ items
  - Covers installation, usage, pricing

- [ ] **Changelog Detailed**
  - Lists all changes by version
  - Follows semantic versioning

### 6.3 Tags

- [ ] **Relevant Tags Only**
  - Max 12 tags
  - All tags relate to plugin functionality
  - Current tags: multilingual, translation, wpml, language, i18n, localization, multilanguage, translate, polylang, internationalization

---

## 7. Assets

### 7.1 Required Assets

- [ ] **Plugin Icon 256×256**
  - File: `assets/icon-256x256.png`
  - Dimensions correct
  - Transparent background
  - File size < 100 KB

- [ ] **Plugin Icon 128×128**
  - File: `assets/icon-128x128.png`
  - Dimensions correct
  - Transparent background
  - File size < 50 KB

- [ ] **Plugin Banner 1544×500**
  - File: `assets/banner-1544x500.png`
  - Dimensions correct
  - Professional appearance
  - File size < 1 MB

- [ ] **Plugin Banner 772×250**
  - File: `assets/banner-772x250.png`
  - Dimensions correct
  - Professional appearance
  - File size < 500 KB

### 7.2 Screenshots

- [ ] **All Screenshots Added**
  - At least 5 screenshots
  - Max 10 screenshots
  - Files: `screenshot-1.png` through `screenshot-8.png`

- [ ] **Screenshot Dimensions Correct**
  - All 1200×900 or 1600×1200
  - Aspect ratio 4:3

- [ ] **Screenshot Captions Written**
  - Each screenshot has description in readme.txt
  - Descriptions are clear and helpful

---

## 8. Performance

### 8.1 Page Load Impact

- [ ] **No Significant Slowdown**
  - Test with Query Monitor
  - Admin page load < 2s
  - Frontend overhead < 100ms

- [ ] **Assets Loaded Conditionally**
  - Admin CSS/JS only on plugin pages
  - Frontend assets only where needed

- [ ] **Enqueue Scripts Properly**
  - Use `wp_enqueue_script()` and `wp_enqueue_style()`
  - No hardcoded `<script>` or `<link>` tags

### 8.2 Database Queries

- [ ] **No N+1 Query Problems**
  - QueryOptimizer handles prefetching
  - Test with Query Monitor

- [ ] **Queries Are Optimized**
  - Use indexes
  - Avoid `SELECT *`
  - Use `WP_Query` arguments efficiently

### 8.3 Caching

- [ ] **Object Cache Compatible**
  - Works with Redis/Memcached
  - Uses WordPress object cache API

- [ ] **Transients Used Appropriately**
  - Expensive operations cached
  - Reasonable expiration times

---

## 9. Compatibility

### 9.1 WordPress Compatibility

- [ ] **Works on Latest WordPress**
  - Tested on WordPress 6.7
  - No deprecated function usage

- [ ] **Works on Minimum WordPress**
  - Tested on WordPress 6.0
  - All features functional

- [ ] **No Version-Specific Code**
  - Check for version conditionals
  - Ensure graceful degradation

### 9.2 PHP Compatibility

- [ ] **Requires PHP 8.3+**
  - Clearly stated in readme.txt
  - Activation check prevents installation on older PHP

- [ ] **No PHP 8.3+ Breaking Changes**
  - Tested on PHP 8.3
  - No warnings or notices

### 9.3 Plugin Conflicts

- [ ] **No Known Conflicts**
  - Tested with popular plugins:
    - [ ] WooCommerce
    - [ ] Yoast SEO
    - [ ] Rank Math
    - [ ] Elementor
    - [ ] Advanced Custom Fields
    - [ ] Contact Form 7

- [ ] **Graceful Conflict Handling**
  - Detects conflicts
  - Shows admin notice if conflict found

### 9.4 Theme Compatibility

- [ ] **Works with Default Themes**
  - Tested with Twenty Twenty-Four
  - Tested with Twenty Twenty-Three
  - Tested with Twenty Twenty-Two

- [ ] **Works with Popular Themes**
  - Tested with Astra
  - Tested with GeneratePress
  - Tested with OceanWP

---

## 10. Multisite Compatibility

### 10.1 Network Activation

- [ ] **Network Activation Supported**
  - Plugin can be network activated
  - Works correctly when network activated

- [ ] **Network Settings Page**
  - Network admin menu item (if applicable)
  - Network-wide settings (if applicable)

### 10.2 Per-Site Activation

- [ ] **Per-Site Activation Works**
  - Can activate on individual sites
  - Settings are per-site

### 10.3 Database Tables

- [ ] **Multisite Table Handling**
  - Tables created per-site or globally as appropriate
  - Uses correct blog_id

---

## 11. Accessibility

### 11.1 Keyboard Navigation

- [ ] **All Interactive Elements Keyboard Accessible**
  - Tab through all forms
  - Enter/Space activate buttons
  - Esc closes modals

- [ ] **Focus Indicators Visible**
  - `:focus` styles defined
  - Visible outline on focused elements

### 11.2 Screen Reader Compatibility

- [ ] **Semantic HTML Used**
  - Proper heading hierarchy (h1, h2, h3)
  - Form labels associated with inputs
  - Tables have proper headers

- [ ] **ARIA Labels Present**
  - Icon-only buttons have `aria-label`
  - Modals have `aria-modal="true"`
  - Dropdown triggers have `aria-expanded`

- [ ] **Alt Text on Images**
  - All images have meaningful alt text
  - Decorative images have `alt=""`

### 11.3 Color Contrast

- [ ] **WCAG AA Compliance**
  - Text contrast ratio ≥ 4.5:1
  - Large text ≥ 3:1
  - Use WebAIM Contrast Checker

---

## 12. Error Handling

### 12.1 User-Facing Errors

- [ ] **Clear Error Messages**
  - Users understand what went wrong
  - Suggest fixes where possible

- [ ] **No PHP Errors Displayed**
  - Errors logged, not shown to users
  - Production site: `WP_DEBUG = false`

### 12.2 Admin Notices

- [ ] **Notices Are Dismissible**
  - Success notices auto-dismiss
  - Error notices can be manually dismissed

- [ ] **Notices Use Standard WordPress Styles**
  - Classes: `notice`, `notice-success`, `notice-error`

### 12.3 Logging

- [ ] **Errors Logged Appropriately**
  - Use `error_log()` for errors
  - Don't log sensitive data
  - Log file location documented

---

## 13. Documentation

### 13.1 Code Documentation

- [ ] **PHPDoc on All Classes/Methods**
  - Class-level doc blocks
  - Method-level doc blocks with @param and @return

- [ ] **Inline Comments Where Needed**
  - Complex logic explained
  - Magic numbers have comments

- [ ] **README.md in Repository**
  - Developer setup instructions
  - Contributing guidelines

### 13.2 User Documentation

- [ ] **Complete User Guide**
  - Getting started
  - Feature documentation
  - Troubleshooting

- [ ] **Video Tutorials Created**
  - Basic setup tutorial
  - WPML migration tutorial
  - Advanced features tutorial

- [ ] **API Documentation**
  - All REST API endpoints documented
  - Hook documentation complete

---

## 14. Testing

### 14.1 Unit Tests

- [ ] **PHPUnit Tests Pass**
  - Run: `vendor/bin/phpunit`
  - Code coverage > 70%

### 14.2 Integration Tests

- [ ] **Database Integration Tests Pass**
  - Test migrations
  - Test CRUD operations

### 14.3 E2E Tests

- [ ] **Playwright Tests Pass**
  - Run: `npm test`
  - All critical paths covered

### 14.4 Manual Testing

- [ ] **Clean Install Test**
  - Fresh WordPress install
  - Activate plugin
  - Run through setup wizard

- [ ] **Update Test**
  - Install previous version
  - Upgrade to new version
  - Verify data migrated

- [ ] **Uninstall Test**
  - Activate plugin
  - Use features
  - Uninstall
  - Verify all data removed

---

## 15. External Services

### 15.1 Service Disclosure

- [ ] **Services Documented in readme.txt**
  - List all external services used
  - Explain why each is used
  - Link to service privacy policies

- [ ] **Opt-In for External Calls**
  - User must consent to external service usage
  - Clear explanation of what data is sent

### 15.2 No Undisclosed Tracking

- [ ] **No Hidden Analytics**
  - No tracking without user consent
  - All telemetry is opt-in

- [ ] **No Phone Home**
  - Plugin doesn't call home without permission
  - License checks are documented

---

## 16. Code Review

### 16.1 Security Review

- [ ] **Code Reviewed by Security Expert**
  - Professional security audit completed
  - All findings addressed

- [ ] **No Obfuscated Code**
  - All code is readable
  - No base64 encoding of PHP code

### 16.2 Peer Review

- [ ] **Code Reviewed by Senior Developer**
  - Architecture reviewed
  - Best practices followed

---

## 17. Submission Preparation

### 17.1 Final Checks

- [ ] **Version Numbers Match**
  - Plugin header version
  - readme.txt stable tag
  - Constant MPZ_VERSION

- [ ] **All Files Committed to SVN**
  - `/trunk/` has latest code
  - `/assets/` has all graphics
  - `/tags/1.0.0/` created for release

- [ ] **Assets Uploaded to SVN**
  - Banner images
  - Plugin icons
  - Screenshots

### 17.2 WordPress.org Account

- [ ] **Account Created**
  - WordPress.org account registered
  - Email verified

- [ ] **Plugin Slug Reserved**
  - Slug: `multilingual-press-zone`
  - Reserved on WordPress.org

---

## 18. Post-Submission

### 18.1 Review Process

- [ ] **Initial Response Received**
  - WordPress.org team responds within 7-14 days

- [ ] **All Review Comments Addressed**
  - Fix any issues raised
  - Respond to reviewer questions

### 18.2 Approval

- [ ] **Plugin Approved**
  - Listed in WordPress.org directory
  - Public download available

- [ ] **Monitor Initial Reviews**
  - Watch for user feedback
  - Address issues quickly

---

## Verification Commands

Run these commands to verify compliance:

```bash
# PHPCS scan
vendor/bin/phpcs --standard=WordPress includes/ multilingual-press-zone.php

# PHPStan analysis
vendor/bin/phpstan analyse -l 8 includes/

# PHPUnit tests
vendor/bin/phpunit

# Playwright E2E tests
cd tests/e2e && npm test

# i18n POT generation
wp i18n make-pot . languages/multilingual-press-zone.pot

# Check for hardcoded prefixes
grep -r "wp_" includes/ | grep -v "\$wpdb->prefix"

# Check for unsafe output
grep -r "echo \$" includes/

# Check for unsanitized input
grep -r "\$_POST\|\$_GET" includes/
```

---

## Sign-Off

**Reviewed By**: _______________________
**Date**: _______________________
**Approved**: [ ] Yes [ ] No

**Notes**:

---

**Next Steps After Approval**:
1. Commit final code to SVN `/trunk/`
2. Create tag `/tags/1.0.0/`
3. Upload assets to `/assets/`
4. Submit for WordPress.org review
5. Monitor review process
6. Launch marketing campaign

---

**Last Updated**: 2026-01-26
**Checklist Version**: 1.0.0