Custom WordPress Plugin Development

WordPress Custom Plugin Development

When ready-made plugin does 90% needed, remaining 10% impossible without hacking its code — time to write custom. Custom plugin not necessarily mega-library: sometimes 200 lines of code adding specific business logic unavailable in marketplace. Medium complexity plugin development takes 3–10 working days.

Plugin Structure

WordPress doesn't require strict folder structure, but established conventions exist:

wp-content/plugins/my-plugin/
├── my-plugin.php          # Main file, entry point
├── includes/
│   ├── class-my-plugin.php        # Main class
│   ├── class-my-plugin-admin.php  # /wp-admin logic
│   └── class-my-plugin-public.php # Frontend logic
├── admin/
│   ├── css/admin.css
│   └── js/admin.js
├── public/
│   ├── css/public.css
│   └── js/public.js
└── languages/
    └── my-plugin-ru_RU.po

Main file contains header and bootstrapping:

<?php
/**
 * Plugin Name:       My Custom Plugin
 * Plugin URI:        https://example.com/my-plugin
 * Description:       Plugin functionality description.
 * Version:           1.0.0
 * Requires at least: 6.0
 * Requires PHP:      8.1
 * Author:            Company Name
 * Text Domain:       my-plugin
 */

if (!defined('ABSPATH')) {
    exit;
}

define('MY_PLUGIN_VERSION', '1.0.0');
define('MY_PLUGIN_DIR', plugin_dir_path(__FILE__));
define('MY_PLUGIN_URL', plugin_dir_url(__FILE__));

require_once MY_PLUGIN_DIR . 'includes/class-my-plugin.php';

function my_plugin_init(): void {
    $plugin = new My_Plugin();
    $plugin->run();
}
add_action('plugins_loaded', 'my_plugin_init');

Main Class and Hook Registry

"Loader" pattern — register all hooks in one place instead of scattered add_action:

class My_Plugin {
    private array $actions = [];
    private array $filters = [];

    public function __construct() {
        $this->define_admin_hooks();
        $this->define_public_hooks();
    }

    private function define_admin_hooks(): void {
        $admin = new My_Plugin_Admin();
        $this->add_action('admin_enqueue_scripts', $admin, 'enqueue_styles');
        $this->add_action('admin_menu', $admin, 'add_plugin_admin_menu');
    }

    private function add_action(string $hook, object $component, string $callback, int $priority = 10): void {
        $this->actions[] = compact('hook', 'component', 'callback', 'priority');
    }

    public function run(): void {
        foreach ($this->actions as $hook) {
            add_action($hook['hook'], [$hook['component'], $hook['callback']], $hook['priority']);
        }
        foreach ($this->filters as $hook) {
            add_filter($hook['hook'], [$hook['component'], $hook['callback']], $hook['priority'], $hook['accepted_args'] ?? 1);
        }
    }
}

Database Work

For custom tables — create via dbDelta on activation:

register_activation_hook(__FILE__, function () {
    global $wpdb;
    $table = $wpdb->prefix . 'my_plugin_data';
    $charset = $wpdb->get_charset_collate();

    $sql = "CREATE TABLE {$table} (
        id bigint(20) NOT NULL AUTO_INCREMENT,
        user_id bigint(20) NOT NULL,
        data_key varchar(255) NOT NULL,
        data_value longtext,
        created_at datetime DEFAULT CURRENT_TIMESTAMP,
        PRIMARY KEY (id),
        KEY user_id (user_id),
        KEY data_key (data_key)
    ) {$charset};";

    require_once ABSPATH . 'wp-admin/includes/upgrade.php';
    dbDelta($sql);

    add_option('my_plugin_db_version', MY_PLUGIN_VERSION);
});

For queries — only via $wpdb->prepare(), never concatenate strings with user data:

$results = $wpdb->get_results(
    $wpdb->prepare(
        "SELECT * FROM {$wpdb->prefix}my_plugin_data WHERE user_id = %d AND data_key = %s",
        get_current_user_id(),
        $key
    )
);

Settings Page in Admin

Settings API — standard way to add native WordPress settings page:

class My_Plugin_Admin {
    public function add_plugin_admin_menu(): void {
        add_options_page(
            'My Plugin Settings',
            'My Plugin',
            'manage_options',
            'my-plugin',
            [$this, 'display_plugin_setup_page']
        );
    }

    public function __construct() {
        add_action('admin_init', [$this, 'register_settings']);
    }

    public function register_settings(): void {
        register_setting('my_plugin_options', 'my_plugin_api_key', [
            'type'              => 'string',
            'sanitize_callback' => 'sanitize_text_field',
        ]);

        add_settings_section('my_plugin_main', 'Main Settings', null, 'my-plugin');

        add_settings_field('api_key', 'API Key', function () {
            $value = get_option('my_plugin_api_key', '');
            printf('<input type="text" name="my_plugin_api_key" value="%s" class="regular-text">', esc_attr($value));
        }, 'my-plugin', 'my_plugin_main');
    }

    public function display_plugin_setup_page(): void {
        if (!current_user_can('manage_options')) {
            return;
        }
        echo '<div class="wrap"><h1>' . esc_html(get_admin_page_title()) . '</h1>';
        echo '<form method="post" action="options.php">';
        settings_fields('my_plugin_options');
        do_settings_sections('my-plugin');
        submit_button();
        echo '</form></div>';
    }
}

AJAX Handlers

// Register handler
add_action('wp_ajax_my_plugin_action', [$this, 'handle_ajax']);
add_action('wp_ajax_nopriv_my_plugin_action', [$this, 'handle_ajax']); // for guests

public function handle_ajax(): void {
    check_ajax_referer('my_plugin_nonce', 'nonce');

    $input = sanitize_text_field($_POST['data'] ?? '');

    // business logic
    $result = $this->process($input);

    wp_send_json_success(['result' => $result]);
    // or wp_send_json_error(['message' => 'Error'], 400);
}

On client:

fetch(childTheme.ajaxUrl, {
  method: 'POST',
  body: new URLSearchParams({
    action: 'my_plugin_action',
    nonce: childTheme.nonce,
    data: inputValue,
  }),
})
  .then(r => r.json())
  .then(r => { if (r.success) console.log(r.data.result) });

REST API Instead AJAX

For modern React/Vue interfaces prefer REST API. Separate service details.

Internationalization

All strings wrapped with translation functions with text domain:

__('String for translation', 'my-plugin')
_e('Output string', 'my-plugin')
esc_html__('Safe output', 'my-plugin')
sprintf(__('Hello, %s!', 'my-plugin'), $username)

.pot file generated via WP-CLI: wp i18n make-pot . languages/my-plugin.pot.

Deactivation and Uninstall

register_deactivation_hook(__FILE__, function () {
    // Remove cron tasks, temporary data
    wp_clear_scheduled_hook('my_plugin_cron');
});

register_uninstall_hook(__FILE__, 'my_plugin_uninstall');

function my_plugin_uninstall(): void {
    // Delete only if user agreed
    if (get_option('my_plugin_delete_data_on_uninstall')) {
        global $wpdb;
        $wpdb->query("DROP TABLE IF EXISTS {$wpdb->prefix}my_plugin_data");
        delete_option('my_plugin_api_key');
    }
}

Complexity Timelines

Simple plugin (shortcode + settings page) — 2–3 days. Plugin with custom tables, AJAX interface, external API integration — 5–8 days. Plugin with metaboxes, custom list columns, complex role logic — from 10 days.