ShouldCheck

ShouldCheck reads a plugin’s header and code without running it, compares what it finds with your site, and gives a verdict: blocking problems, things to verify, what passed, and what was not checked.

• Reviews ZIP uploads, WordPress.org plugin cards and pending plugin updates.
• Detects payments, WooCommerce, page builder, form, REST, scheduled task, database and email code patterns.
• Compares WooCommerce HPOS and Checkout Blocks declarations with how your store is set up.
• Compares the function, class and constant names a package declares with your active plugins, to find a “Cannot redeclare” crash before you activate.
• Marks reviews that touch your money path (payment gateways, WooCommerce itself) and warns when customers are checking out right now.
• Shows how your checkout is set up: currency, HTTPS, enabled payment methods, test mode, whether credentials were entered (never their values), and your quietest three hours from your own order times.
• Records plugin, theme and core changes on your site.

What it does not do: it does not run the plugin, it does not install, activate or deactivate any plugin, it is not a security scanner, it does not place orders or take payments, and a passed check never means a plugin works. When it left more unchecked than it checked, the verdict says so.

Learn more at shouldcheck.satyenaghor.com.

External services

ShouldCheck contacts two WordPress.org services, only when you ask it to review a plugin from the directory, and only after you have chosen.

1. api.wordpress.org: the plugin’s listing (name, version, requirements, tags). This is the same request WordPress makes on Plugins > Add New. Terms and privacy: https://wordpress.org/about/privacy/
2. downloads.wordpress.org: the published ZIP of the plugin, downloaded so its code can be read. ShouldCheck reads the file and deletes it. It does not extract it into your plugins folder, install it or run it. It asks first, once, and you can turn it off in ShouldCheck settings. Without it, a review reads the listing only.

Both requests carry WordPress’s usual user agent (your site address and WordPress version). ShouldCheck sends nothing to its authors, has no account, and runs no tracking or analytics.

After a review of a WordPress.org plugin or a pending update, Continue opens WordPress’s own installer or updater for that plugin. WordPress core does the install, with its usual checks. A ZIP you uploaded for review is only read: to install it, choose it again in Plugins > Add New > Upload Plugin. Activating is always your own step on the Plugins screen.

Privacy

ShouldCheck stores its reviews, a list of site changes (plugin, theme and WordPress updates) and its settings in your database. A review records the ID of the administrator who asked for it. It stores no visitor or customer data and no payment keys; it only notes whether keys were entered. Nothing is sent to the authors. There is no account, tracking or analytics. The only outside requests are the two WordPress.org ones listed above, made when an administrator asks. ShouldCheck adds suggested wording to Settings > Privacy > Policy Guide. Deleting the plugin removes its data unless you chose to keep reviews, history and settings.

Settings

• Reading plugins from WordPress.org: download the published ZIP to read its code, or read the listing only.
• Where ShouldCheck appears: next to the install buttons (adds a review button beside Install Now, Upload and updates; WordPress’s own buttons stay as they are), or only when you ask. Nothing is added until you choose.