Release Checklist

Use this checklist before every WPZylos plugin release.

Pre-Release

• All tests passing (composer test)
• PHP syntax checked (find app -name "*.php" -exec php -l {} \;)
• No PHP notices/warnings (WP_DEBUG = true on test site)
• Version number updated in main plugin file header
• Version number updated in composer.json
• readme.txt Stable tag updated
• readme.txt Tested up to updated (latest WordPress)
• Changelog updated in readme.txt

Security

• All user inputs sanitized with sanitize_*() functions
• All outputs escaped with esc_*() functions
• All forms protected with nonces (wp_nonce_field, wp_verify_nonce)
• All admin pages protected with current_user_can()
• All SQL queries use $wpdb->prepare()
• defined('ABSPATH') || exit; present in all PHP files

CodeCanyon / WordPress.org

• License is GPL-2.0-or-later in plugin header, composer.json and LICENSE file
• .pot translation file is up to date
• Admin code separated from public code via is_admin()
• Assets loaded via wp_enqueue_script / wp_enqueue_style
• jQuery not deregistered
• Plugin does not delete data on deactivation (only on uninstall)
• Uninstall prompts user before deleting data

Assets

• npm run build completes without errors
• Compiled assets in dist/ are up to date
• No console.log or debug code left in JS

Deployment

• git tag vX.X.X created
• git push --tags origin main pushed
• Packagist webhook triggered (auto via GitHub push)
• Plugin ZIP built for distribution

Post-Release

• Test plugin install on fresh WordPress
• Test plugin activate/deactivate/uninstall
• Test plugin with latest WooCommerce (if applicable)
• Update documentation if needed