Development Skill
Angular Migration
Migrate from AngularJS to Angular using hybrid mode, incremental component rewriting, and…
$15
WP Plugin Development
Custom WordPress plugin development
An end-to-end guide for building secure, well-architected WordPress plugins, from a clean single-bootstrap structure and hook-based loading to the full activation/deactivation/uninstall lifecycle. Its core is a security baseline that has stopped the most common WordPress exploits: nonce-plus-capability double checks, prepared statements, and late escaping at every output point.
$15 one-time
Add to a kit → Prices include 20% VAT. · Forged on real agency work · one-time, no lock-in
- Type Skill
- Category Development
- Delivery Email · instant
- License One-time
Inside the run · no black box
See the actual work before you buy it.
Most WordPress plugin holes come from a nonce check standing alone. Here every write path pairs nonce with capability, every query goes through prepare, and the lifecycle from activation to uninstall leaves nothing orphaned.
- Triages the repo first with deterministic scripts: detect_wp_project.mjs identifies the project shape and detect_plugins.mjs scans plugin headers, so in a full-site repo the exact target under wp-content/plugins or mu-plugins is locked before any code changes.
- Lays the architecture: one bootstrap file with the plugin header, zero side effects at file-load time, all behavior registered through hooks via a loader class, and admin-only code gated behind is_admin so the frontend carries no extra weight.
- Wires the lifecycle correctly: activation hooks registered at top level (never inside other hooks), flush_rewrite_rules called only after CPT registration, deactivation clears every scheduled cron, and uninstall.php removes user data explicitly so nothing orphans the database.
- Builds settings through the Settings API: register_setting plus sections and fields, every input passing a sanitize_callback, and large data routed to a custom table instead of an autoloaded option.
- Applies the security baseline on every write path: nonce verification AND capability check together (nonce alone is the most common WP hole), wp_unslash plus sanitize on input, $wpdb->prepare for every query, and late escaping (esc_html/esc_attr/esc_url) at output.
- Verifies before release: plugin activates with no fatals or notices, settings save and read under the enforced nonce and capability, uninstall removes intended data and nothing else, and repo lint/tests (PHPCS, PHPUnit) pass.
One power source. 6 lines out.
wp-plugin-development · core
core active · 6 lines
- ✓ creating or refactoring
Creating or refactoring plugin structure and hook registration
- ✓ implementing activation,…
Implementing activation, deactivation and uninstall behavior
- ✓ building settings api ad…
Building Settings API admin pages with sanitized options
- ✓ fixing security gaps (no…
Fixing security gaps (nonces, capabilities, SQL safety, escaping)
- ✓ designing data storage
Designing data storage, cron tasks and schema migrations
- ✓ packaging a plugin release
Packaging a plugin release with correct headers
Yours to keep.
Drag time forward. Watch what stays.
Forever
That's what owning means.
The rented stack
ai writing tool: subscription
expired · access lostanalytics suite: subscription
expired · access lostdesign platform: subscription
expired · access lost(nothing left)
Your forge
-
Nonce + capability double checks close the most common WordPress access-control hole at once
license: perpetual -
Prepared statements and late escaping eliminate SQL injection and XSS by construction
license: perpetual -
Correct lifecycle hooks prevent orphaned cron events and bloated DB tables on uninstall
license: perpetual -
Options-API discipline (autoload off for big data) keeps page load fast
license: perpetual
subscriptions expire · deeds don't
Everything in the box.
Pick a piece up. Watch it work.
Predictable architecture: single bootstrap, hook-based loading, admin code behind is_admin()
6 parts · one working system · ships instantly by email
This wasn't forged for everyone.
- Not for you if you'd rather rent a tool than own one.
- Not for you if you want someone else to run your stack.
- Not for you if you're happy guessing.
WordPress developers building or auditing plugins who need a security-first architecture instead of inventing patterns ad hoc.
then this was forged for you.Works with
Universal by design: these run in any AI. Delivered in the open Agent Skills + MCP format (native in Claude); ChatGPT, Gemini, Cursor and Copilot adapt the same files their own way.
- Claude Native format
- ChatGPT Adapts via open standards
- Gemini Adapts via open standards
- Cursor Adapts via open standards
- Copilot Adapts via open standards
Catch what's on your mind.
the air is clear. nothing between you and the forge.
catch a spark: the forge will answer
-
I only need a small plugin with one settings page, is this overkill for that?
The structure scales down: a single bootstrap file, hook-based loading and a Settings API page with sanitized options is exactly the small-plugin case it covers. The security baseline (nonce plus capability checks, late escaping) matters just as much at that size, because small plugins ship the same common holes.
-
What makes its security approach different from just following the WordPress codex?
It packages the defenses as enforced patterns with right-vs-wrong code examples: nonce-plus-capability double checks together (most exploits slip through when only one is present), $wpdb->prepare() for every query, and late escaping at every output point. You copy a working defensive pattern instead of reassembling rules from scattered docs.
-
Will it also build the frontend app or SaaS my plugin talks to?
No. Its scope is the plugin itself: architecture, hooks, lifecycle (activation through uninstall), settings, data storage, cron and release packaging. External services, frontend frameworks or the business logic of a remote API sit outside what it covers.
-
How is it delivered?
By email right after purchase: ready to run, downloaded instantly, no setup wait.
-
One-time or subscription?
A one-time purchase; no subscription or hidden fees. VAT (20%) is included.
-
Can I get a refund?
As a digital product, it can’t be refunded once downloaded. That’s why we show exactly what’s inside and who it’s for, right here.