I ran Plugin Check on my own kits, and had AI do the fixing

WordPress has two free plugins that check other plugins and themes: Plugin Check and Theme Check. They run the same tests the WordPress.org review team uses. Before putting the kits on this site, I ran both over my own code.

The club kit’s plugin came back with 19 errors and 56 warnings. The cookie consent plugin had 19 errors and 21 warnings. The theme failed 9 required checks. I handed the reports to Claude Code and asked it to sort out which were real.

What was actually wrong

• A function with a clashing name. Both plugins had their own function called get_settings(). WordPress has a function of the same name, deprecated since 2007. Mine worked, because it lived in its own namespace, but one missing line at the top of a file would have quietly called the old one instead. Renamed.
• An unescaped label. A dropdown in the cookie plugin’s settings passed a label to a WordPress function that prints it without escaping. Harmless with my own text, wrong in principle. One word changed.
• Two warnings I thought I’d dealt with. I’d marked both as “checked, this is fine”, but one note had the rule’s name misspelt and the other was on the wrong line, so neither did anything.
• Files moved with raw PHP. Route uploads used PHP’s own file functions instead of WordPress’s upload handling. Now they go through wp_handle_upload().
• No readme. Including the part where a plugin has to list every outside service it talks to. The club kit talks to four, all optional.

What wasn’t

About half. The checker flagged forms for missing security checks when the check was there, one line further down. It flagged text as unsanitised because it didn’t recognise my own sanitising function. It flagged the cookie scanner for loading Google’s reCAPTCHA, when that was a list of things to look for, not load.

The AI was good at this part: reading the line, reading the lines around it, and saying why a warning didn’t apply. Each of those now has a short note in the code saying why, so the next check doesn’t flag it again.

The one that needed a decision

Most of the remaining warnings had one cause. My plugins prefixed everything with three letters, rpc_, and the checker wants at least four. Fixing it meant renaming every hook and setting name in both plugins and the theme, and those were live on clubs.racerpacer.com.

That’s not a call to leave to a tool. We renamed the code but left the stored data alone, deployed the plugins in an order that kept Google Analytics behind the cookie banner throughout, then checked the live pages one at a time.

Where the AI got it wrong

Twice. It put one of those “this is fine” notes in the middle of a line, which turned the rest of the line into a comment. The syntax check caught it straight away. And it moved the theme into a new folder to match its name, without knowing Theme Check works the name out from the theme’s title, not the folder. The second report caught that, and the fix was a one-word change to the title.

Both slips were caught by running the checks again, which is the real lesson. After this I wrote the checks into two small tools that run before anything gets deployed, so I don’t have to remember.