01
Integrations
Plugins that connect WordPress to your CRM, ERP, payment provider or internal API, with retries, logs and error alerts.
FIG 01 · WordPress Plugin Development
WordPress plugin development, secure and directory-ready
Custom WordPress plugins written like products: Plugin Check clean, capability and nonce checks on every action, PHP 8.3-ready and shipped with a disclosure policy, whether the plugin stays private or goes to WordPress.org.
See how it works
FIG 02 · Quick answer
What is WordPress plugin development?
WordPress plugin development is writing code that adds features to WordPress without editing core or the theme. Elgrith builds custom plugins for private sites, WooCommerce and the WordPress.org directory, passes them through Plugin Check, applies capability, nonce and escaping rules on every action, and tests them on current WordPress and PHP 8.3.
- WordPress version we test on (7.1.3, 6 Oct 2026)
- 7.1
- Projects delivered since 2015
- 1,000+
- Clients across the USA, UK and India
- 250+
- Your plugin code and repository
- 100%
FIG 03 · Why it matters
Plugins are where WordPress gets hacked.
From Patchstack’s State of WordPress Security in 2026 report (updated 25 Feb 2026).
01
11,334
New WordPress-ecosystem vulnerabilities in 2025
Patchstack counted 11,334 new vulnerabilities across WordPress core, plugins and themes in 2025. Only 6 were in core.
Source: Patchstack, State of WordPress Security in 2026 (updated 25 Feb 2026)(opens in a new tab)02
91%
Of them were in plugins
Plugins accounted for 91% of the new vulnerabilities and themes for 9%. The code you add is the code attackers look at first.
Source: Patchstack, State of WordPress Security in 2026 (updated 25 Feb 2026)(opens in a new tab)03
46%
Had no fix when they were disclosed
46% of vulnerabilities did not get a fix from the developer in time for public disclosure. A plugin needs an owner who answers reports.
Source: Patchstack, State of WordPress Security in 2026 (updated 25 Feb 2026)(opens in a new tab)
FIG 04 · Decide
Extend, fork or build?
The WordPress.org directory held about 72,000 plugins on 23 Oct 2026, so start by asking whether one already does most of the job. Here is how the options compare.
| Configure an existing plugin | Extend it with a companion plugin | Fork it | Build a custom plugin | |
|---|---|---|---|---|
| Best for | A maintained plugin that already fits | A good plugin missing one feature | Rarely: an abandoned plugin you depend on | Your own workflow, data or integration |
| How | Settings only | Its hooks, filters and REST API | Copy the code and maintain it yourself | Written for your requirement |
| Updates | From the plugin’s author | Author updates the base; we update the add-on | You own every future security fix | We or your team, as agreed |
| Risk | Features you don’t control | Breaks if the base plugin’s hooks change | Security debt grows with every upstream fix | Upfront build cost |
Plugin count from the WordPress.org plugins API, read 23 Oct 2026. We check an existing plugin’s update history, open security reports and support threads before recommending it.
Themes and blocks instead? See WordPress developmentFIG 05 · What you get
Custom WordPress plugins we build
Anything WordPress should do that your theme shouldn’t: features that survive a redesign because they live in a plugin.
02
Custom post types and admin tools
Custom post types, taxonomies, fields and admin screens that fit how your team actually publishes and manages content.
03
Gutenberg blocks
Custom blocks registered with block.json, with editor controls your team understands and markup that stays accessible.
04
WooCommerce extensions
Checkout fields, pricing rules, shipping methods, gateways and order workflows built on WooCommerce’s hooks and APIs.
05
REST API endpoints
Custom REST routes with permission callbacks and validated input, for headless front ends, apps and other systems.
06
Multisite tools
Network-wide settings, provisioning and content sharing for WordPress multisite installs.
07
WP-CLI commands
Command-line tools for imports, migrations and maintenance jobs that are too heavy for a browser request.
08
Directory and commercial plugins
Plugins built for the WordPress.org directory or for sale, with readme.txt, licensing, update paths and support processes.
Deliverables
10
deliverables, in writing
Included in every build, written into your fixed quote before work starts.
FIG 06 · Integrations
Plugins that connect WordPress to the rest of your business
Most custom plugins we write move data between WordPress and another system. Which side owns each piece of data is agreed in your written scope.
- WordPress hooks
- REST API
- WP-CLI and cron
Your custom plugin
- CRM
- ERP and accounting
- Payments
Forms to CRM
- Trigger
- Form entry or new user
- Result
- Lead or contact in your CRM, with consent recorded
WooCommerce to ERP
- Trigger
- New order, refund or stock change
- Result
- Sales orders, stock and invoices kept in step
Payments and memberships
- Trigger
- Payment provider webhook
- Result
- Access, renewals and receipts updated in WordPress
Content sync
- Trigger
- Scheduled job or WP-CLI command
- Result
- Products, listings or documents imported from another system
Headless content API
- Trigger
- App or front-end request
- Result
- Custom REST routes with permission checks
Admin and audit tools
- Trigger
- Editor or admin action
- Result
- Approvals, logs and role-based screens
FIG 07 · Security
Security as a feature
With most WordPress vulnerabilities found in plugins, security is part of the build, not a review at the end.
05principles
Nonces and capabilities
Every form, AJAX call and REST route checks a nonce or permission callback and the user’s capability before it changes anything.
Sanitize in, escape out
Input sanitized and validated on the way in, output escaped for its context on the way out, and database queries prepared.
WordPress Coding Standards
PHPCS with the WordPress Coding Standards and Plugin Check in the workflow, so issues are caught on every change.
Vulnerability disclosure
A published way to report security issues, and an agreed process for fixing and releasing patches, as set out in your written scope.
Maintenance after launch
WordPress, PHP and dependency updates tested against your plugin.
Website maintenance
FIG 08 · Directory
Getting onto WordPress.org
A public plugin goes through the Plugin Review Team. Since 1 Oct 2024 the first checks happen before a human ever looks at it.
04principles
Plugin Check first
Since 1 Oct 2024, new submissions are pre-checked with Plugin Check’s Plugin Repo category, and a submission with an error is blocked until it is fixed.
2FA on every account
Two-factor authentication is required on all plugin owner and committer accounts, per Make WordPress Plugins (1 Oct 2024).
The guidelines
GPL-compatible code, no trialware, no tracking without consent and no hijacking the admin dashboard: we check the detailed guidelines before submission.
readme.txt and SVN
A readme.txt with an accurate "Tested up to" version, screenshots and changelog, then releases tagged through the directory’s SVN.
FIG 09 · EU
Selling a plugin in the EU: the Cyber Resilience Act
If you sell a plugin to EU customers, the EU’s Cyber Resilience Act may apply. General guidance from the European Commission’s page, checked 23 Oct 2026; not legal advice.
04principles
In force since 10 Dec 2024
The Act entered into force on 10 December 2024 and applies in stages.
Reporting from 11 Sep 2026
Reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026.
Main obligations from 11 Dec 2027
The Commission says the Act’s main obligations will apply from 11 December 2027.
Open source is treated differently
The Act has a special approach to free and open-source software. How your plugin is supplied and monetized affects whether it is in scope; your counsel confirms what applies to you.
FIG 10 · Ownership
Hire a WordPress plugin developer
You should own the plugin, understand its licence and be able to hand it to any developer later.
04principles
GPL v2 or later, explained
WordPress is licensed GPL v2 or later, and plugins in the directory must be GPL-compatible. If you distribute the plugin, recipients get GPL rights; a private plugin you run on your own site isn’t distributed. General guidance, not legal advice.
Code ownership
Your contract assigns the code to your company, and the repository lives in your account from day one.
Hand-over
Documentation, a test suite, coding-standards config and a release checklist, so your team or another developer can take over.
Built by the team behind our flagship
Kenerate AI, our flagship build, designed and engineered by Elgrith. It is an AI image and video studio, not a WordPress plugin.
See Kenerate AI
FIG 11 · Process · 6 steps
Specify, build, then harden
A fixed written quote after a free call, a plugin built against WordPress Coding Standards and Plugin Check, and security review before release.
- Step 01
Free call
Tell us what you need to build or fix and what you have already tried. We ask about your store or site, team, systems and deadlines first.
- Step 02
Discovery
We map what the plugin must do, the data it touches, the systems it talks to, who can use each feature and whether it stays private or goes to WordPress.org.
- Step 03
Fixed written quote
A written scope and a fixed quote, with the timeline, access, acceptance tests and hand-over agreed before any work starts.
- Step 04
Sprints with weekly demos
Features built in a version-controlled repository with automated checks, each shown working in a weekly demo on a staging site.
- Step 05
Launch
Plugin Check, coding-standards and security review, tests on current WordPress and PHP 8.3, then a release to your site or the directory.
- Step 06
Support
Updates for new WordPress and PHP releases, security fixes and new features, as agreed in your written scope.
FIG 12 · What you get
Everything included
Written into your fixed quote, so you know exactly what you are paying for before work starts.
10items
- Written scope and fixed quote
- Build-or-extend recommendation
- Custom plugin in your Git repository
- Capability, nonce, sanitization and escaping checks
- Plugin Check and WordPress Coding Standards reports
- Tests on current WordPress and PHP 8.3
- readme.txt and directory assets where needed
- Vulnerability disclosure policy
- Developer and admin documentation
- Your plugin code and repository stay yours
FIG 13 · Tech & tools
The tools behind the work
Proven, well-supported tools, chosen for your project and set up in accounts your business owns.
- WordPress
- PHP 8.3
- WooCommerce
- Gutenberg
- block.json
- REST API
- WP-CLI
- Plugin Check
- PHPCS
- WordPress Coding Standards
- PHPUnit
- Composer
- GitHub
- MySQL
- MariaDB
FIG 14 · Who it’s for
Custom plugins for teams that run on WordPress.
Same method everywhere: build only what isn’t already maintained, write it securely, keep it in your name.
4 audiences
Businesses
Plugins for your own site.
Integrations, admin tools and workflows that fit how your business runs, kept in a plugin so they survive the next redesign.
- CRM and ERP integrations
- Custom post types and admin screens
- WooCommerce extensions
- Maintenance after launch
Agencies
Plugin development for agencies.
Agencies hand us the specification and we deliver a tested plugin in your client’s repository, under your process and NDA.
- Your client’s repository
- Coding-standards config included
- Hand-over documentation
- White-label delivery
Product teams
Directory and commercial plugins.
Product teams get a plugin built for the WordPress.org directory or for sale, with licensing, update paths and a disclosure policy.
- Plugin Check before submission
- readme.txt and SVN releases
- Licence and update paths
- EU CRA questions flagged early
UK
WordPress plugin development for UK organisations.
UK work runs through our London client-partnership centre, with delivery from our New Delhi HQ. We build in UK English and flag UK GDPR questions about personal data early.
- UK English throughout
- UK GDPR questions flagged
- CRA questions for EU sales
- Fixed written quote in GBP
FIG 15 · Working with us from the USA and UK
Built in New Delhi. Run on your hours.
Every project gets a point of contact in New York or London and an engineering team in New Delhi. Here is how today’s working days line up, live.
New York
North America
--:--ET
New Delhi team Your working day- Shared working time
- ≈ 3 hours today
- New Delhi is
- 10.5 h ahead
- Live calls, your time
- 9 a.m. to 12 p.m. ET
London
UK & Europe
--:--UK
New Delhi team Your working day- Shared working time
- ≈ 4.5 hours today
- New Delhi is
- 5.5 h ahead
- Live calls, your time
- 9 a.m. to 1:30 p.m. UK
Three ways to work together
- 01
Fixed-scope project
A written scope, one fixed price and a dated plan. Suits websites, apps and MVPs.
- 02
Dedicated team
Designers and engineers on your roadmap every month, billed monthly.
- 03
White label
For US and UK agencies: our work, your brand, unbranded deliverables.
Every engagement
- Fixed quote in USD, GBP or INR after a free 30-minute call
- NDA before discovery. You own all code, designs and content
- A working demo every sprint, not status slides
- Reply within one business day, calls inside your hours
Book a call
Calls on ET or UK hours
FIG 16 · Rules and dates
WordPress plugin rules and releases: what changed and when (checked 23 Oct 2026)
What changed for WordPress plugins, and when. Each date is from WordPress.org, Patchstack or the European Commission, checked on 23 Oct 2026.
| Date | What changed | What it means for your plugin |
|---|---|---|
| 1 Oct 2024 | Plugin Check errors block new WordPress.org submissions; 2FA required for plugin owners and committers | Run Plugin Check before you submit, and turn on 2FA |
| 10 Dec 2024 | The EU Cyber Resilience Act entered into force | Plan for its obligations if you sell plugins in the EU |
| 25 Feb 2026 | Patchstack’s 2026 report: 11,334 new vulnerabilities in 2025, 91% in plugins | Security review belongs in every plugin build |
| 11 Sep 2026 | CRA reporting obligations apply | Know how you would report an exploited vulnerability |
| 6 Oct 2026 | WordPress 7.1.3 released; PHP 8.3 or greater recommended | Test on 7.1 and PHP 8.3, and update "Tested up to" |
| 11 Dec 2027 | CRA main obligations apply | Products in scope must meet the Act’s requirements |
General guidance, not legal advice; your counsel confirms what applies to you.
FIG 17 · Compare
Private plugin vs WordPress.org directory plugin vs commercial plugin
| Private plugin | WordPress.org directory plugin | Commercial plugin | |
|---|---|---|---|
| Who uses it | Your sites only | Anyone who installs it | Your paying customers |
| Review | Your own code review | Plugin Check plus the Plugin Review Team | Your own review and release process |
| Licence | Yours; the GPL matters only if you distribute it | GPL-compatible, required | GPL-compatible, as WordPress plugins normally are |
| Updates | Deployed by you or us | Through the directory’s SVN | Your own update server or a store |
| Extra duties | Security fixes for your own sites | Guidelines, support forum, 2FA | Support, licensing and, for EU sales, the CRA |
FAQ
Frequently asked questions
Straight answers about WordPress Plugin Development with Elgrith.
It depends on the features, the systems it integrates with, admin screens, WooCommerce or multisite support, security review and whether it goes to the WordPress.org directory. We do not publish prices: after a free call you get a written scope and a fixed quote, so you know the full cost before work starts.
FIG 18 · Related
Keep exploring
WordPress Development
Custom themes, blocks & WooCommerceWooCommerce Development
WooCommerce stores, speed & integrationsAPI Integration
Connect your apps, CRM & paymentsWebsite Maintenance
Updates, backups, security & uptimeHeadless CMS Development
Sanity, Contentful, Strapi & headless WordPressWhite Label Web Development
Builds under your agency's brandWordPress agency, New York
WordPress builds for NYC businessesWordPress agency, London
WordPress sites for London businesses
Free 30-minute call
A plugin you own. Code that passes the checks.
Tell us what WordPress needs to do and which systems it talks to. After a free call you get a written scope and a fixed quote, with the security checks written in.
Pick a day for your call
OpenPick a day. You'll choose a time in your own time zone on the next step.