WordPress has proposed a proactive approach towards third-party plugins to enhance security and site performance.
The proposal discusses implementing a plugin checker to ensure plugins adhere to best practices.
Third-party plugins are a significant source of security vulnerabilities and performance issues. The proposal outlines three methods for developing a plugin checker and requests feedback on the concept.
The WordPress proposal identified the problem:
“While there are fewer infrastructure requirements for plugins compared to themes, some requirements are worth verifying. Checking plugins against security and performance best practices is just as essential as it is for themes.
However, as of today, there is no corresponding plugin checker.”
WordPress Vulnerabilities and Performance Issues
Despite its reputation for being vulnerable to hackers and slow, the WordPress core is highly secure.
Most vulnerabilities in the WordPress platform are due to third-party plugins. Although WordPress itself is fairly secure, these plugins have contributed to its association with hacked sites.
Website performance is similarly affected. While a WordPress Performance Team is dedicated to enhancing the core’s performance, third-party plugins can undermine this effort by loading unnecessary JavaScript and CSS or failing to implement lazy loading for images, thereby slowing down website performance.
Plugin Checker
WordPress already offers a theme checker that developers use to ensure their themes follow best practices and security measures. The same checker is also utilized on the official WordPress theme repository.
Now, WordPress aims to explore a similar tool for plugins.
The objective of the proposed plugin checker is defined as:
“There should be a WordPress plugin checker tool that analyzes a given WordPress plugin and flags any violations of plugin development best practices with errors or warnings, with a special focus on security and performance.”
The proposal outlines three potential approaches:
- A. Static analysis
This method, used for themes, has limitations like an inability to run code. - B. Server-side analysis
This approach allows plugin code to run and can also perform static analysis. - C. Client-side analysis
This method uses a headless browser to test the plugin for issues that might not be detected by server-side solutions. Although there are challenges, the proposal suggests ways to address them.
The proposal includes a graph comparing approaches A, B, and C, rating each for security and performance efficacy.
The evaluation concludes that Server-side analysis might be the most effective approach.
Best Practices for Plugins
The WordPress performance team has not yet committed to creating a plugin checker; this is only a proposal and serves as the starting point.
Nonetheless, ensuring third-party plugins follow security and performance best practices is beneficial for both WordPress users and site visitors.
Citations
Performance Team Meeting Summary With Link to Proposal
WordPress Performance Team Meeting Summary
Read the Plugin Checker Proposal
Proposal: WordPress plugin checker (Google Docs)
Featured Image: Mr.Exen/Shutterstock
