How to View WordPress Plugin Source Code: Admin, WordPress.org, WP-CLI

This article is a localized edition of the Japanese original. Read the Japanese original

When you want to understand how a plugin behaves, check its security, or find a way to customize it, reading the source code is the shortest path. WordPress plugins are distributed as PHP, JavaScript and CSS files, so you can look inside without any special tools.

This article explains how to check the source code "before installing" and "after installing," and points out what to look at when reading it. The WP-CLI steps were tested on WordPress 6.9 (as of November 2026).

Before installing: WordPress.org

For plugins listed in the WordPress.org plugin directory, you can review the code before you install them.

1. Open the plugin's page (https://wordpress.org/plugins/slug/)
2. Use the links in the "Development" section to browse the code, the SVN repository and the development log

The URLs look like this. Replace akismet with the slug of the plugin you want to check.

In the code browser you can see trunk, which is under development, and tags/version-number/ for each released version. The version actually distributed is the one named in Stable tag in readme.txt.

If you open "Advanced View" on the plugin's page, you can pick a previous version and download it.

If you want to try the plugin, you can use WordPress Playground, which runs WordPress inside your browser. Opening https://playground.wordpress.net/?plugin=slug starts a disposable WordPress with that plugin installed. You can check its screens and files without affecting your own site.

After installing: the admin screen

For plugins that are already installed, you can view the contents in the admin screen's "Plugin File Editor." Where the menu item appears depends on your theme.

• Classic themes: "Plugins" → "Plugin File Editor"
• Block themes: "Tools" → "Plugin File Editor"

Choose the plugin in "Select plugin to edit" at the top right, and the file list and contents appear.

Use this screen only for "viewing," and avoid editing there. A typo can take the site down, and updating the plugin overwrites and erases your changes. On sites that have define( 'DISALLOW_FILE_EDIT', true ); in wp-config.php, or depending on the hosting company's settings, the screen itself is not shown.

After installing: reading on the server

If you can use SSH, reading the files directly on the server is efficient. Plugins live in wp-content/plugins/slug/. With WP-CLI you can start by finding the location.

# Find the plugin directory
wp plugin path akismet --dir

# Check the version and status
wp plugin get akismet --fields=name,title,version,status

Look at the file layout and start with the main file and readme.txt.

cd "$(wp plugin path akismet --dir)"

# List the files (works even where tree is not installed)
find . -type f -name '*.php' | sort

# The top of readme.txt lists the supported WordPress and PHP versions and more
head -20 readme.txt

The top of the main file (often a PHP file with the same name as the plugin folder) has headers such as Plugin Name, Version and Requires PHP. Following the files it loads with require and include gives you the overall structure.

To find a specific feature, use grep.

# Find where functions and hooks are defined or registered
grep -rn "function akismet_" --include='*.php' . | head
grep -rn "add_action\|add_filter" --include='*.php' . | head -30

Check that files have not been tampered with: WP-CLI

For plugins distributed on WordPress.org, wp plugin verify-checksums checks whether the files on your server match the files from the source.

# Verify one plugin
wp plugin verify-checksums akismet

# Verify all plugins
wp plugin verify-checksums --all

If they match, you see something like Success: Verified 1 of 1 plugins. If there are modified files or files that are not in the distribution, you get warnings. Plugins distributed outside WordPress.org, such as paid plugins, cannot be verified because there are no checksums from the source.

See the differences between versions

To find out what changed in an update, download the ZIPs of two versions and compare them. WordPress.org plugins can be downloaded from URLs of the form https://downloads.wordpress.org/plugin/slug.version.zip.

mkdir -p /tmp/plugin-diff && cd /tmp/plugin-diff
wget -q https://downloads.wordpress.org/plugin/akismet.5.5.zip -O old.zip
wget -q https://downloads.wordpress.org/plugin/akismet.5.6.zip -O new.zip
unzip -q old.zip -d old && unzip -q new.zip -d new
diff -ru old/akismet new/akismet | less

You can also see the changes per commit in the development log (https://plugins.trac.wordpress.org/log/slug/).

What to look at when reading

If your goal is to check security, start with the places below. Having code that matches is not a problem in itself; what you check is whether there are proper permission checks and input validation and escaping.

Search like this in the plugin directory.

grep -rn "wp_ajax_nopriv_" --include='*.php' .
grep -rn "register_rest_route" --include='*.php' .
grep -rnE "current_user_can|check_admin_referer|check_ajax_referer|wp_verify_nonce" --include='*.php' .
grep -rnE '\$_(GET|POST|REQUEST)\[' --include='*.php' .
grep -rnE '\$wpdb->(query|get_results|get_row|get_var|get_col)' --include='*.php' .
grep -rnE "wp_remote_(get|post|request)|curl_init" --include='*.php' .
grep -rnE "eval\(|base64_decode\(|gzinflate\(" --include='*.php' .

To find out whether there are known vulnerabilities, checking a vulnerability database is faster than reading the code, and you miss less. The steps are in How to check WordPress plugins for vulnerabilities: WP-CLI, WPScan, Wordfence and manual checks.

Check automatically with Plugin Check

The "Plugin Check" plugin provided by WordPress.org automatically runs many of the checks used in the plugin directory review. It was built for developers to check their own plugins before submitting them, but you can also use it to get a sense of the code in someone else's plugin.

• Admin screen: activate the plugin, go to "Tools" → "Plugin Check," choose the target and run it
• WP-CLI: wp plugin check akismet (for a single-file plugin, specify the file name, as in wp plugin check hello.php)

The results include many coding-standards notes, so "has findings" does not mean "dangerous." Focus on the security-related items (such as missing escaping). Once you are done, it is fine to deactivate Plugin Check.

If you want to change the code

Even if what you find makes you want to change the behavior, avoid editing the plugin's files directly. Your changes disappear with every update, and if you stop updating, you also stop receiving security fixes.

• Use the hooks the plugin provides (you can find them by searching for apply_filters and do_action) and change the behavior from your child theme's functions.php or your own plugin
• If there is no hook, ask for one on the author's support forum or GitHub
• If you really must modify it, manage it as a separate plugin with a different name and merge the original plugin's updates yourself

# Find the hooks the plugin provides
grep -rn "apply_filters\|do_action" --include='*.php' . | head -30

Summary

• Before installing, you can check the code and behavior with the WordPress.org development links (Trac, SVN) and Playground
• After installing, view the code in the admin screen's Plugin File Editor or read the files over SSH. Avoid editing in the editor
• wp plugin verify-checksums shows differences from the distributed files (tampering)
• For security, read the permission checks, nonces, input validation, $wpdb->prepare() and external communication first
• To change behavior, use hooks instead of editing the files directly

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)