Nine WordPress plugins on one shared foundation

Overview

These are nine WordPress plugins that I write in the SilverAssist organization on GitHub. They run on the production WordPress sites of the same client as my Next.js platforms. Some of them connect WordPress to a Next.js front end, some add forms, and some protect or watch the site.

All nine have the same shape. They load three Composer packages, and they are checked by two coding standards. A change to one of those packages, or to a standard, reaches every plugin when its version is raised.

The plugins are not in the public WordPress.org directory. They are installed from GitHub releases, and WordPress finds new versions through one of the shared packages.

The challenge

I started at SilverAssist to move sites from WordPress to Next.js. The sites needed more and more from WordPress: a cache refresh for the front end, forms that send data to other systems, a security audit to pass. Each need was a small plugin, and each plugin needed the same pieces: a bootstrap, an admin page, an updater and the checks before a release.

Copying those pieces into every repository means copying every fix as well. So the shared parts became packages and standards, and each plugin keeps only the code that belongs to it. The work was less about one plugin and more about making the ninth plugin as cheap and as safe to build as the second.

Key features

The plugins:

• Silver Assist Security Essentials (silver-assist-security): hardens a site against the problems that a security audit finds. It limits failed logins, sets session timeouts, sends the HttpOnly and SameSite cookie flags, lets the admin URL be changed, and limits GraphQL queries by depth, complexity and introspection.
• Silver Assist Post Revalidate (silver-assist-post-revalidate): when a post, category or tag is saved, published, unpublished or deleted, it sends the relative path of each affected page to a token-protected endpoint, so a Next.js site refreshes only those pages.
• NextJS GraphQL Hooks (nextjs-graphql-hooks): adds the default WPGraphQL queries that a Next.js site needs, with filters to register more types and fields.
• CF7 to API (contact-form-to-api): sends the submissions of a Contact Form 7 form to any API, with field mapping, retries and a log of every request.
• Paubox CF7 (paubox-cf7): sends the mail of a Contact Form 7 form through the Paubox encrypted email API, with the settings of each form in its own tab.
• LeadCapture Form (leadcapture-form) and LeadGen App Form (leadgen-app-form): embed the forms of the two lead services with a shortcode, a Gutenberg block or an Elementor widget. The form script loads on the first interaction with the page.
• ACF Clone Fields (acf-clone-fields): copies Advanced Custom Fields between posts, with a choice of fields, a preview of what will be overwritten and a backup before each copy.
• CloudWatch Logs (cloudwatch-logs): searches and follows an Amazon CloudWatch log group from the WordPress admin, with three ways to give it credentials, so nobody needs the AWS console to read a log.

What all nine share:

• wp-plugin-kernel: a LoadableInterface and an AbstractPlugin base. A plugin lists its components in get_components() and does not write the bootstrap again.
• wp-settings-hub: one top-level Silver Assist menu with a dashboard of every installed plugin. Each plugin registers its own page with it.
• wp-github-updater: the updater that connects WordPress to the GitHub releases, for public or private repositories, with cached version checks.
• wp-coding-standards and coding-standards: the architecture rules, the PHPCS and PHPStan settings, the lint rules and the reusable CI workflows. coding-standards is the PHP base, with PHPStan at level 8, and the WordPress one builds on it.

Technologies used

• Plugins: PHP 8.2 with PSR-4 autoloading, WordPress, and WPGraphQL for the GraphQL parts.
• Packages: Composer. They are installed from their GitHub repositories, with a token in CI.
• Quality: PHPStan at level 8, PHPCS with the WordPress coding standards, and PHPUnit tests against the WordPress test suite.
• Delivery: GitHub Actions for the tests and the releases, with CodeQL scanning, Dependabot and a setup file for the GitHub Copilot agent, the same CI setup I use across my repositories.