Every WordPress.org plugin release now faces an automated security check before distribution through the update system. Developers should watch committer emails, allow for the release delay, and fix only the flagged version if blocked. The WordPress.org update API is the service that sends plugin updates to site dashboards for one-click installs. The September change places the security review inside that delivery step.
Official resources:
- Read the Plugins Team announcement on automated release reviews — Verify the cooldown, security scoring, and what to do if a release is blocked.
- Review WordPress secure-coding requirements for plugin code — Check sanitization, validation, and escaping practices to reduce block risk.
Table of Contents
- How the scan fits into release timing
- What happens when a release is blocked
- Can safe code trigger a block?
- What to check before your next release
How the scan fits into release timing
Since 5 June 2026, every plugin and theme release waits in a cooldown before distribution. The pause now lasts 6 hours and creates the window for the scan, according to Make WordPress Plugins in the September security review announcement.
Dashboard one-click updates do not go out at once. During cooldown, several AI models work with Jetpack Scan to review release changes. Make WordPress Plugins says the tools cross-check results and produce a security score where a higher number means higher potential risk.
What happens when a release is blocked
A high risk score blocks that release automatically. Make WordPress Plugins says all plugin committers then receive the findings by email. Releases below the threshold proceed normally, and authors who get no email need take no action.
One early case shows the goal. A backdoor committed 28 July to a plugin with about 20,000 installs earned a high score and never reached sites through the update API. Make WordPress Plugins reports downloads closed 26 minutes after Wordfence notified the team in the September review post on the backdoor case.
Can safe code trigger a block?
Make WordPress Plugins warns that cross-checking keeps accuracy high and false positives low, but not zero. A high score measures risk, not intent.
So an accidental flaw can block a release just like injected malware. Thresholds and models stay unpublished, so teams cannot tune releases around a known limit.
What to check before your next release
Make WordPress Plugins says a blocked author should review the emailed findings, fix the issues, and publish a new release. Only the flagged version stays blocked. The same workflow appears in the October developer roundup on the WordPress Developer Blog.
- Confirm each committer address receives mail and check spam for block notices
- Plan launches and client updates around the 6-hour cooldown
- After a block, fix the flagged code and ship a new version number
- If a finding looks wrong, contact the Plugins Team before re-shipping the same code
