PluginLyzer

The problem

WordPress.org rejects plugins for a specific, documented set of reasons, and developers usually find out which ones after they submit. Generic PHP scanners help very little: they do not understand WordPress hooks, nonces or capability checks, so they flag intentional patterns and miss the WordPress-specific mistakes that actually cause rejections and security holes.

What we built

An analysis platform that understands the WordPress plugin API. One upload produces six kinds of analysis: a security audit, a WordPress.org submission check, a code-quality review, a performance review, monetisation recommendations, and fixes for what it finds - ranked by severity so the developer knows what to do first.

The fixes are the point. Every vulnerability comes with the vulnerable code and a corrected version ready to paste, generated with Anthropic's Claude, because a list of problems without a fix sends the developer straight back to a search engine.

Pricing built around how developers work

A free full scan every month, a one-time pack of three scans for occasional builders, and monthly plans with GitHub integration, scheduled scans and CI/CD webhooks for teams shipping regularly. The first scan needs no account at all, because the fastest way to prove the product is to let someone drop a zip file on the homepage.

Why it works

It replaces the slowest loop in plugin development - submit, wait, get rejected, guess - with a report in minutes. An affiliate programme lets WordPress educators recommend it for a recurring commission, which suits a product whose buyers learn from YouTube and blogs.