Plugin Check 2.2.0: use .pcpignore in your CI without fighting false positives

Plugin Check is the official WordPress.org tool for reviewing plugins. It scans your code and flags issues with security, performance, compatibility, internationalization and best practices. It's the same foundation the Plugins Team uses, so if your plugin passes Plugin Check, you're in good shape for approval.

Version 2.2.0 just shipped, and it includes something a lot of people have been asking for.

The big one: .pcpignore

Until now, running Plugin Check in your CI (GitHub Actions, GitLab CI, etc.) was annoying. The scan covered folders that don't matter, like vendor, node_modules or tests. The result: errors that weren't yours and red pipelines.

With .pcpignore (opt-in, so only if you enable it) you define which files and folders are excluded from the scan.

For example: your plugin bundles third-party libraries in vendor/. You add that folder to .pcpignore and the check focuses on your own code. Now you can add Plugin Check to your CI and have it fail only when something is actually wrong.

Everything else, in plain English

New warnings

• Detects React code that may break with React 19.
• Warns if you use raster images (PNG, JPG) as admin menu icons instead of SVG or dashicons.
• Warns if your code directly accesses AI Connector API keys.

More accuracy (fewer false positives)

• "Tested up to" is now checked only in the readme file.
• Includes of safe files are allowed in the direct file access check.
• Fixed a false positive with the auto_update_plugins option.
• The AI sanitization review no longer flags password, token or API key fields by mistake.

Clearer and more polished

• WP-CLI now rejects unknown categories in wp plugin check and wp plugin list-checks instead of silently ignoring them.
• The Blue Oak license is now allowed.
• The Requires Plugins warning is clearer.
• The AI false-positive summary is now translatable.
• Better accessibility in the admin UI.

Fixes

• The "Check it!" button was failing silently with a nonce error. Fixed.
• cli.php now defines its constants even when the plugin isn't active.

Under the hood

• Documented result codes and severity, more unit tests, and updated dependencies.

How to update

Update from WordPress.org or your plugins screen, and if you use CI, try adding your own .pcpignore.

Thanks to the contributors

Plugin Check is an open source project, and this release wouldn't exist without the people who sent pull requests. Huge thanks to:

@faisalahammad, @ernilambar, @gunjanjaswal, @ishitaj34, @jsnajdr, @KhushalSainS, @kmfoysal06, @marekdedic, @mukeshpanchal27, @murshed, @noruzzamans, @obenland, @zahidgh, @zeeshansardar08 and @ekamran.

Want to help in the next release? Take a look at the Plugin Check repository on GitHub.

Plugin Check (PCP)