WordPress loads every active plugin on every request into one shared namespace. AI-written plugins often work in a demo and still miss a nonce, leave data behind on uninstall, or run heavy code on every page load. This agent's checklist exists to catch exactly those.
When to use the WordPress Plugin Engineer agent
- Building a custom plugin for a client site
- Adding a settings page, REST route or AJAX handler
- Reviewing an existing plugin for security problems
- Adding background jobs or a versioned upgrade routine
What is in the agent file
| Name | wordpress-plugin-engineer |
|---|---|
| Tools | Read, Write, Edit, Grep, Glob, Bash. It can edit files and run commands, so review its diff. |
| Model | sonnet, up to 40 turns per task |
| Kit | Platform kit, 115 lines |
How it works. Beyond its role statement, the file sets out 5 rules it follows: Security: both checks, every endpoint; Sanitize in, escape out; Four distinct lifecycle events; Load-time discipline; Severity rubric.
What it reports. Every run ends in the same structure: Plugin structure, Security checklist, Lifecycle, Load-time cost, Verification, Findings.
Excerpt from the agent file
The settings and opening instructions, as they appear in .claude/agents/wordpress-plugin-engineer.md:
---
name: wordpress-plugin-engineer
description: Builds maintainable WordPress plugins — structure, secure hooks, settings, REST and AJAX endpoints, background jobs, versioned upgrades and complete uninstall. Invoke by name for WordPress plugin development or plugin code review.
model: sonnet
maxTurns: 40
tools: Read, Write, Edit, Grep, Glob, Bash
---
You are a WordPress Plugin Engineer. WordPress loads every active plugin on every request, into one global namespace shared with thousands of others. Those two facts drive everything.
1. Check the existing structure and prefix. Match them.
2. Verify every endpoint has **both** a capability check and a nonce (this is the most common vulnerability).
3. Keep load-time work minimal.
4. Implement with the Settings API, proper enqueuing and translation.
5. Handle activation, deactivation, upgrade and uninstall as four distinct events.
6. Test with `WP_DEBUG` on and no PHP notices.The full file continues with the rules above and the exact report format. It is included in the Agentsforce kit.
Example requests
Name the agent to be sure Claude uses it, or describe the task and let its description trigger it:
- "Use wordpress-plugin-engineer to build a plugin that shows opening hours via a shortcode."
- "Add a settings page with the Settings API and a REST route for saving it."
- "Review this plugin's AJAX handlers for missing nonces and capability checks."
- "Write a clean uninstall routine that removes our options and custom tables."
When to use a different agent
| If you need | Use instead |
|---|---|
| Custom editor blocks | Use wordpress-gutenberg-engineer |
| Site speed and hardening across the whole install | Use wordpress-performance-security |
| SEO problems caused by WordPress archives and taxonomies | Use wordpress-seo-auditor |
Works well with
- WordPress SEO Auditor: finds the search problems WordPress itself creates
- Code Reviewer: checks what a change did, not whether a file looks fine
- Database Engineer: changes schemas and queries without risking your data
Related playbooks in the kit, which Claude loads when the task calls for them: wp-plugin-architecture, wp-security-hardening, wp-hooks-filters, wp-rest-api.
How to get it
- Write your own: the free Subagent Generator drafts a starter wordpress plugin engineer file you can edit and save in
.claude/agents/. - Use the tested version: Agentsforce includes this agent with 54 other specialists and 89 playbooks for a one-time $49, installed with one command.
Frequently asked questions
Can Claude Code build a WordPress plugin?
Yes. It works in your plugin folder on a local or staging site. This agent adds the WordPress rules generic code misses, such as nonces plus capability checks, escaping late and prefixing everything.
Does it test the plugin?
It tests with WP_DEBUG on and expects no PHP notices. Run it against a local WordPress install, such as Local or wp-env, so it can exercise the code.
Is this a WordPress plugin I install in wp-admin?
No. It is a Claude Code subagent, a Markdown file in your project's .claude/agents folder. The plugin it builds is ordinary PHP that you install in WordPress.