Project structure · More
WordPress plugin project structure
Opens with creditsA modern WordPress plugin that adds product reviews: blocks scaffolded with @wordpress/create-block and built by @wordpress/scripts, PHP classes autoloaded by Composer, a REST API, a React settings page, and tests running inside wp-env. For students who can write a little PHP and JavaScript and want to build a plugin the way WordPress core contributors and serious plugin teams lay it out.
Curated by Tauseef FayyazIntermediate124 files and foldersWordPress 7.1 (tested up to; requires 6.8), PHP 8.1 or newer, @wordpress/create-block 4.99Checked October 2026How it grows
Each stage opens the explorer there
- 1Day 1What the scaffold and your first hour give you19 files and folders
- 2GrowingWhat a real app with features and tests adds+63 files and folders
- ProductionWhat running it for real users adds+21 files and foldersOpens with credits
- ExpertWhat a team needs to keep it healthy for years+21 files and foldersOpens with credits
How it is organised
- One main plugin file with the header, a few constants and a call to boot the plugin. Everything else is a class in `includes/` loaded by Composer.
- Blocks are defined by block.json and live one folder each under `src/`; @wordpress/scripts builds them into `build/` and the plugin registers them all from the generated manifest.
- Prefer dynamic blocks (render.php) for data that changes, and the Interactivity API for front end behaviour, so visitors do not download React.
- Every input is sanitised, every output is escaped, every write checks a capability and a nonce. Assume every request is hostile.
- Prefix everything global: function names, option names, post types, hooks, REST namespace and text domain, so your plugin never clashes with another.
- Use WordPress APIs (WP_Query, options, meta, REST, cron, transients) before writing your own SQL or HTTP handling.
- Develop and test in wp-env, against the oldest and newest WordPress and PHP versions your header promises.
- What ships is the built plugin, not the repository: .distignore and package.json "files" decide what goes into the zip.
At the top of the project
Open one in the explorer for the full story
- simple-reviews/
- .git/Git history, created by `git init`.
- bin/Helper scripts for development.1 inside
- build/Compiled blocks and scripts from `npm run build`, plus blocks-manifest.php.
- includes/Your PHP classes, autoloaded by Composer under the `SimpleReviews\` namespace.10 inside
- languages/Translation template and bundled translations.1 inside
- node_modules/npm packages: @wordpress/scripts and everything it needs.
- src/Block sources compiled by @wordpress/scripts into build/: one folder per block, plus other entry points.4 inside
- templates/PHP templates for HTML that is not a block, such as emails.1 inside
- tests/PHP tests with the WordPress test suite, JavaScript unit tests, and Playwright tests in a real editor.2 inside
- vendor/Composer packages and the generated autoloader.
- .editorconfigTabs for PHP and JS, LF line endings, following the WordPress coding standards.
- .gitignoreIgnores node_modules, logs, coverage, .env and the plugin zip.
- .nvmrcThe Node version for building, read by nvm and actions/setup-node.
- .wp-env.jsonThe local WordPress setup: core version, PHP version, plugins and themes to load.
- .wp-env.override.jsonYour personal wp-env changes, such as a different port or PHP version.
- composer.jsonPSR-4 autoloading for includes/ and dev tools: WPCS, PHPStan, PHPUnit.
- composer.lockExact versions of every Composer package.
- package.jsonnpm scripts from create-block: build, start, format, lint:css, lint:js, plugin-zip, env.
- package-lock.jsonExact npm package versions.
- phpcs.xml.distPHP_CodeSniffer rules: WordPress standards, your prefixes and text domain, PHP version range.
- phpstan.neon.distPHPStan settings with the WordPress extension and stubs.
- phpunit.xml.distPHPUnit config: bootstrap file and the Integration and Unit test suites.
- README.mdThe developer readme for GitHub: setup, scripts, architecture, contributing.
- readme.txtThe WordPress.org readme: description, installation, FAQ, screenshots, changelog and the Stable tag.
- simple-reviews.phpThe main plugin file: the plugin header, an ABSPATH guard and the code that boots the plugin.
- uninstall.phpRuns when a site owner deletes the plugin: removes options, reviews and scheduled events.
- webpack.config.jsExtends the wp-scripts webpack config to add the admin settings entry point.
Learn more on Sefism
Roadmaps, cheat sheets and projects that go with WordPress plugin.
- Roadmap· WordPressWordPress and Shopify roadmapBusiness sites and online stores
- Roadmap· PHPBackend development roadmapAPIs, databases, auth, deploys
- Roadmap· ReactFrontend development roadmapHTML, CSS, JavaScript and a framework
- Cheat sheetWordPress and Shopify cheat sheetBusiness sites and online stores.
- Cheat sheetFrontend development cheat sheetHTML, CSS, JavaScript and a framework.
- FYP idea· AdvancedAI Agent Readiness Audit for Websites: Can a Browser Agent Complete Your Key Tasks?Build an audit tool that sends real browser agents to complete a site's key tasks, such as finding a product, booking a slot or filling a form, then explains every failure in terms of the page: unlabelled buttons, hidden state, broken focus order or missing structured data. More customers will reach small businesses through AI agents, and most sites have never been tested that way. The output is a repeatable score and a fix list a web developer can act on.
- FYP idea· BeginnerGovernment Website Accessibility and Performance Observatory with Monthly Public ReportsBuild an open observatory that checks a country's public sector websites every month for accessibility errors, mobile performance, HTTPS and security headers, and whether key pages are available in the local language, then publishes the results as open data and a simple league table. People depend on these sites for exams, licences, taxes and benefits, yet nobody tracks their quality over time. A good first project in crawling, automated testing and honest data presentation.
- FYP idea· IntermediateWeight-Sensing Stock Bins for Pharmacy and Spare Parts ShelvesA final year project that builds load cell stock bins for pharmacies, spare parts shops and workshop stores: each bin converts weight to item count, flags low stock and logs every pick. A small web app turns the readings into reorder lists, so owners stop running out of fast movers and stop counting shelves by hand.
- QuestionShould I start with freelancing on Fiverr or Upwork, or get a job first?For most beginners, a first job or internship teaches faster: code reviews, real systems and senior engineers. Freelancing can work early if you already have a sellable skill and treat it like a business, but it is slower to start and lonelier to learn from. Many people do best with a job first and freelancing on the side.
See 7 moreShow fewer
- QuestionI understand tutorials but cannot build anything myself. Why does coding feel so different when I am alone?Tutorials train recognition, not production. When you follow along, someone else makes every decision. Building alone requires you to break a problem down and make choices, which is a separate skill. Build it with small projects, planning on paper first, and a rule to struggle before you look anything up.
- QuestionHow do I learn Git and GitHub properly instead of just copying commands?Learn the model first: commits are snapshots, branches are pointers, and remotes are copies. Then use Git daily on your own projects, practise a team workflow with branches and pull requests, and break things on purpose, such as merge conflicts, so you learn to recover calmly.
- Resource· GuideWordPress Developer Resourcesdeveloper.wordpress.org is the official home of WordPress developer documentation: the Theme and Plugin handbooks, the Block Editor handbook, the Code Reference for every function, hook and class, the REST API and WP-CLI docs, coding standards and the Advanced Administration handbook with security hardening. It is the reference to keep open while building anything custom. The handbooks are written and maintained by the open source project.
- Resource· GuideWordPress Block Editor HandbookThe official handbook for building with the WordPress block editor (Gutenberg): creating custom blocks, extending the editor, and the APIs behind block themes. Its getting-started tutorial builds a real block with @wordpress/create-block and a local wp-env environment. Read it when you move from arranging blocks to writing your own.
- Resource· CourseLearn WordPressLearn WordPress is the official, free learning site run by the WordPress open source project, with self-paced courses, short lessons and live online workshops. Pathways cover using WordPress, designing with block themes and developing themes and plugins. It is the best place to start because it teaches the current block editor rather than older ways of working.
- Resource· GuideWooCommerce DocumentationThe official documentation for WooCommerce, the free, open source e-commerce plugin for WordPress. It covers store setup, products, payments, shipping zones, taxes, orders, customers, marketing and store design, with a separate developer site for code. Keep it open while you set up any WordPress store, because most store bugs are settings, not code.
- Resource· GuideOWASP Top TenOWASP's list of the ten most critical web application security risks, now in its 2025 edition, with explanations, example failures and prevention guidance for each. It is the baseline every developer who writes internet-facing code is expected to know, and it is short enough to read in an afternoon. Knowing these categories prevents most of the routine mistakes that cause real breaches.
Checked against 20 official sources, October 2026. If something has changed, the docs win.Show sourcesHide sources
- @wordpress/create-block templates
- Block Editor Handbook: Get started with create-block
- Block Editor Handbook: block.json metadata
- Block Editor Handbook: Interactivity API
- Block Editor Handbook: Block deprecation
- @wordpress/scripts
- @wordpress/env
- Plugin Handbook: Header requirements
- Plugin Handbook: Activation and deactivation hooks
- Plugin Handbook: Uninstall methods
- Plugin Handbook: Security
- Plugin Handbook: Internationalization
- Plugin Handbook: How your readme.txt works
- Plugin Handbook: Plugin assets
- REST API Handbook: Controller classes
- Plugin Check (PCP)
- WordPress Coding Standards for PHP_CodeSniffer
- phpstan-wordpress
- WordPress Playground: Blueprints
- 10up WordPress.org plugin deploy action
Best practices and checklists for this stack
Picked from the other libraries by shared topics.
Best practices
See all- TypeScript Best PracticesModern TypeScript best practices for 2026: strict settings, TypeScript 7, modeling data with unions, safe narrowing, runtime validation, generics and typed linting.
- Authentication Best PracticesBuild sign-in that holds up: password rules from NIST, Argon2id hashing, login throttling, MFA and passkeys, secure sessions and safe account recovery.
- Next.js App Router Best PracticesNext.js 16 App Router best practices: Server Components, Cache Components and use cache, secure Server Actions, proxy.ts, metadata and images.
Work with me
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com