How to Create a WordPress Plugin With AI (Safely, Step by Step)

Quick answer: To create a WordPress plugin with AI, write a clear specification (what it does, where it appears, settings, who can use it), ask an AI coding assistant to generate a minimal plugin following WordPress coding standards and security practices, then install it on a staging site, test every feature and edge case, and ask the AI to review its own code for security issues. Keep the first version small, add features one at a time, and never put untested AI code on a live site.

When a custom plugin makes sense

Before building, check whether an existing, well-maintained plugin already does the job. Custom plugins make sense when:

• You need something small and specific that existing plugins overcomplicate.
• You want a custom tool, such as a calculator or quiz, that matches your site exactly.
• You want to replace a heavy plugin you only use one feature of.
• You need a small integration between your site and another service.
• You want theme-independent functionality that survives a theme change.

What AI can build well (and what needs a developer)

Good fit for AI-built plugins	Get experienced developer review
Shortcodes and simple Gutenberg blocks	Payment processing and financial data
Calculators and interactive widgets	User accounts, roles and permissions systems
Custom post types and fields	Handling personal or sensitive data
Admin notices, dashboard widgets, small settings pages	Complex integrations with external APIs and webhooks
Small front-end tweaks (scripts, styles on specific pages)	Plugins you plan to distribute publicly
Simple scheduled tasks and data exports	Anything performance-critical on high-traffic sites

Step 1: Write a clear specification

Plugin name: [name]
Purpose: [one sentence]
Where it appears: [shortcode / block / widget / admin page / specific pages]
User interaction: [inputs, buttons, what happens]
Output: [what is displayed or saved]
Settings: [options in the admin, if any]
Who can use it: [visitors / logged-in users / admins only]
Data stored: [none / options / post meta / custom table]
Constraints: [no external libraries, must work with [theme], mobile-friendly,
accessible, translation-ready]
Out of scope: [what it should NOT do]

The “out of scope” line prevents the AI from adding features you did not ask for.

Step 2: Ask for a minimal, standards-compliant plugin

Create a WordPress plugin from this specification: [spec].
Requirements:
- Single plugin folder with a main PHP file and a proper plugin header
- Prefix all functions, classes, options and handles with [prefix]
- Sanitize all input, escape all output, check user capabilities,
  and use nonces for any form or AJAX action
- Enqueue scripts and styles only where the feature is used
- No external libraries; vanilla JavaScript if needed
- Follow WordPress coding standards; add brief comments
- Provide installation steps and a list of things to test.

Ask for the smallest working version first. It is much easier to review and debug than a large first draft.

Step 3: Understand what you received

Before installing anything, ask the AI to explain the code:

Explain this plugin file by file and function by function in plain English:
what each part does, which WordPress hooks it uses, what data it reads or
writes, and anything that could affect site performance or security.

You do not need to be a developer, but you should know what runs on your site. If an explanation mentions something you did not ask for, remove it.

Step 4: Install on staging and test

1. Create a staging copy of your site (many hosts offer one-click staging).
2. Zip the plugin folder and upload it via Plugins → Add New → Upload, or place the folder in wp-content/plugins.
3. Activate it and test every feature as a visitor, a logged-in user and an admin.
4. Try edge cases: empty inputs, very large numbers, special characters, repeated submissions, mobile screens.
5. Turn on debug logging (WP_DEBUG_LOG) and check for warnings.
6. Test with your real theme and key plugins active.

When something fails, paste the exact error or unexpected behavior into the AI and ask for a fix with an explanation. See how to fix WordPress errors with AI for reading debug logs.

Step 5: Security review

AI-generated code frequently contains security gaps. Ask for a dedicated review, and check the answers against these WordPress fundamentals:

Practice	What it prevents	What to look for
Sanitize input	Malicious or malformed data being saved	Functions such as sanitize_text_field, absint, sanitize_email on all incoming data
Escape output	Cross-site scripting (XSS)	esc_html, esc_attr, esc_url, wp_kses when printing data
Check capabilities	Unauthorized users changing settings	current_user_can checks on admin actions
Use nonces	Cross-site request forgery (CSRF)	wp_nonce_field / check_admin_referer or check_ajax_referer on forms and AJAX
Prepared queries	SQL injection	$wpdb->prepare for any custom database query
No secrets in code	Leaked API keys	Keys stored in settings or wp-config, never in public files or JavaScript
Direct access guard	Files run outside WordPress	A check that ABSPATH is defined at the top of PHP files

Review this plugin for security issues against WordPress best practices:
input sanitization, output escaping, capability checks, nonces, SQL queries,
file access and secrets. For each issue, quote the code, explain the risk,
and give the fixed code.

For plugins that handle personal data, payments or user accounts, have an experienced WordPress developer review the code as well.

Step 6: Add features one at a time

Once the basic version works, add one feature per request, test it, and keep a copy of each working version. Large “add these five features” prompts tend to break things that already worked. This is the same small-steps discipline described in what is vibe coding.

Example project: a tip calculator block

Here is how a small, real-world plugin comes together with AI (an illustrative walkthrough).

Specification

• Purpose: a tip calculator visitors can use inside blog posts.
• Where: a shortcode [tip_calculator] (simpler than a block for a first version).
• Inputs: bill amount, tip percentage buttons (15, 18, 20, 25) and custom, number of people.
• Output: tip amount, total and per-person total, updating as the user types.
• Constraints: no data stored, vanilla JavaScript, accessible labels, CSS scoped to the calculator, assets loaded only on pages that use the shortcode.

Build steps

1. Generate the minimal plugin with the prompt from Step 2.
2. Test on staging with test cases worked out by hand (for example, a 100 bill at 20% for 4 people: 20 tip, 120 total, 30 each).
3. Fix edge cases: empty bill shows 0.00, zero people treated as one.
4. Security review: even with no stored data, confirm output is escaped and shortcode attributes are sanitized.
5. Add a second version later: a Gutenberg block wrapper so editors can insert it visually.

For the math and content around calculators, see how to build a calculator website with AI.

Shortcode, block or widget?

Format	Pros	Cons
Shortcode	Simplest to build; works in any editor	Less visual for editors
Gutenberg block	Native, visual insertion and settings	More code (JavaScript build step for complex blocks)
Widget / template function	Good for sidebars and theme areas	Less relevant with block themes
Admin page	Settings and tools for site owners	Needs careful permission checks

A common path: start with a shortcode, then ask the AI to add a simple block that renders the same output once the feature is stable.

Other plugin ideas you can build with AI

• Reading time and last-updated notice at the top of posts.
• Affiliate disclosure box that appears automatically on posts in chosen categories.
• Custom post type for recipes, projects, case studies or products with custom fields.
• Simple FAQ block that outputs accessible accordions and matching structured data.
• Asset cleanup: load a heavy plugin’s scripts only on pages where it is used. See how to speed up WordPress with AI.
• Admin dashboard widget showing posts that have not been updated in a year, for content refreshes (see updating old posts with AI).
• Small WooCommerce tweaks, such as a custom notice on product pages. See AI for WooCommerce.

Tools for building plugins with AI

Tool type	How it helps	Best for
Chat assistants (ChatGPT, Claude, Gemini)	Generate and explain plugin files you copy into a folder	Small, single-file plugins
AI code editors and coding agents	Create and edit multi-file plugins, run commands and tests	Larger plugins and iterative development
Local WordPress environments	Run WordPress on your computer for safe testing	Developing before staging
Code snippets plugins	Add small snippets without a full plugin	One-off tweaks
AI agents connected to WordPress	Create and test code directly on a site through a plugin connection	Fast iteration on staging, with backups and review

Maintaining your custom plugin

• Keep a copy: store the plugin code in version control or at least dated zip backups.
• Test after updates: after WordPress, PHP or theme updates, check that your plugin still works.
• Document it: a short README with what it does, settings and how to remove it.
• Review occasionally: ask AI to check the code against current WordPress practices and flag deprecated functions.
• Uninstall cleanly: if the plugin stores data, ask the AI to add an uninstall routine that removes its options.

Distributing a plugin publicly

If you want to share your plugin on WordPress.org, it must meet the directory’s guidelines (security, licensing compatible with the GPL, no tracking without consent, proper prefixing and more) and pass review. Public plugins also need ongoing support and updates. For AI-built plugins, a thorough human code review is strongly recommended before submitting.

Common mistakes

• Vague requests: “make a plugin for my site” produces generic code. Write a specification.
• Testing on the live site: a fatal error can take the site down. Use staging.
• Skipping the security review: missing escaping or nonces are common in generated code.
• Loading assets everywhere: scripts and styles should load only where the feature is used.
• Unprefixed names: functions and options can clash with other plugins.
• Editing theme files instead: functionality in a plugin survives theme changes.
• Accepting code you don’t understand: ask for explanations until you do.

Anatomy of a simple plugin

Understanding the basic structure helps you review what AI generates:

• Plugin folder: for example wp-content/plugins/my-tip-calculator/.
• Main PHP file: starts with a plugin header comment (name, description, version, author, license, text domain) that WordPress reads to list the plugin.
• Direct-access guard: a line that stops the file running outside WordPress.
• Hooks: actions and filters that attach your code to WordPress events, such as registering a shortcode on init or loading scripts on wp_enqueue_scripts.
• Assets: CSS and JavaScript files in subfolders, loaded only when needed.
• Optional: an includes folder for larger code, a languages folder for translations, an uninstall.php for cleanup, and a readme.

Show me the minimal folder structure and main file header for a plugin called
"[name]", with a direct-access guard and a shortcode registered on init.
Explain each line in a comment.

Prompt pack for plugin development

• Explain: “Explain this plugin in plain English, including hooks, data stored and performance impact.”
• Security review: “Audit for sanitization, escaping, capability checks, nonces and SQL safety; quote issues and give fixes.”
• Accessibility: “Review the front-end output for accessibility: labels, focus states, keyboard use and screen reader announcements.”
• Performance: “Where does this plugin load assets or run queries? Make it load only where the shortcode or block is used.”
• Debug: “Here is the error from debug.log and the steps to reproduce it: [details]. Find the cause and fix it.”
• Tests: “List manual test cases, including edge cases, that I should run before going live.”
• Readme: “Write a short README: what it does, how to use it, settings, and how to uninstall.”

For writing prompts like these, see how to write AI prompts, and for running multi-step development safely, prompt chaining.

Settings pages without the headaches

Many useful plugins need a few options, such as a default value, a color or an on/off switch. Ask the AI to use WordPress’s Settings API, which handles saving and security consistently:

Add a settings page under Settings → [Plugin name] with these fields: [fields].
Use the WordPress Settings API, register and sanitize each option, restrict the
page to administrators, and escape values when displaying them. Show defaults
when no value is saved.

Test by saving unusual values (empty fields, very long text, special characters) and confirm they are handled safely.

Translation and accessibility from the start

• Translation-ready: ask the AI to wrap user-facing strings in WordPress translation functions with your text domain, even if you only publish in English now.
• Accessible output: visible labels for inputs, keyboard-usable controls, sufficient contrast and results announced to screen readers for interactive tools.
• Mobile-friendly: test on a phone; interactive features should work with touch.

Checklist before going live

• Specification met; nothing extra added.
• Code explained and understood.
• Security review passed (sanitize, escape, capabilities, nonces, prepared queries).
• Tested on staging as visitor, user and admin, including edge cases.
• No warnings in the debug log.
• Assets load only where needed; no noticeable speed impact.
• Accessible and mobile-friendly.
• Backup taken and a copy of the plugin stored.

From snippet to plugin: a gentle learning path

If you are new to WordPress development, build confidence in stages:

1. CSS tweaks: ask AI for small style changes and add them in the Customizer’s Additional CSS.
2. Code snippets: use a code snippets plugin for tiny PHP changes, such as changing an excerpt length.
3. A single-file plugin: a shortcode or dashboard widget with no settings.
4. A plugin with settings: add an options page using the Settings API.
5. A block: wrap your feature in a Gutenberg block for visual editing.
6. A multi-file plugin: organized includes, assets and an uninstall routine, ideally built with an AI coding agent and version control.

At each stage, ask the AI to explain what it wrote and why. Within a few projects, you will understand enough to spot problems yourself, which is the real safeguard when building with AI. If your plugin is part of a bigger site project, building a WordPress website with AI covers the rest of the setup.

Frequently asked questions

Can AI write a WordPress plugin?

Yes, especially small, well-defined plugins such as shortcodes, simple blocks, calculators and admin tweaks. You still need to test, review security and understand what the code does.

Do I need to know PHP to create a plugin with AI?

Not to get started, but basic understanding helps you review and debug. Ask the AI to explain each part of the code.

Is AI-generated plugin code safe?

Not automatically. It often misses security practices. Ask for sanitization, escaping, capability checks and nonces explicitly, run a security review, and test on staging.

Should I use a plugin or a code snippet?

Use a snippet for tiny tweaks, and a plugin for anything with multiple parts, settings or assets you want to keep organized and theme-independent.

Can I sell or share an AI-built plugin?

You can, but public plugins need careful review, licensing compatible with WordPress, ongoing support and, for WordPress.org, compliance with directory guidelines.

What if the plugin breaks my site?

Rename or remove the plugin folder via your host’s file manager to deactivate it, then check the debug log. Always test on staging first.