When you upload a zip for a plugin or theme that is already installed, WordPress shows a small table (name, version, author, requirements) and a button to replace it. Patchmark takes over that screen and turns it into a proper review, with Cancel and Replace in its top bar. When there are serious findings, Replace takes a second click.<\/p>\n\n
The same review is available in three more places:<\/p>\n\n
wp patchmark diff<\/code>, wp patchmark update<\/code> and wp patchmark check<\/code> print the same findings as a table, JSON or Markdown, and exit with status 1 on serious findings, for deploy scripts and CI.<\/li>\n<\/ul>\n\nReview<\/h4>\n\n
Everything worth a second look, most serious first, each linked to the exact file and line:<\/p>\n\n
\n- Header changes<\/strong>: older version than installed, same version with different files, a different plugin name or author, a new Update URI<\/strong> (future updates would come from somewhere else), new requirements, missing required plugins, a renamed main file (the plugin would be deactivated), a changed text domain.<\/li>\n
- Unusual files<\/strong>: .htaccess and .user.ini, PHP files with odd extensions (.phtml, .phar, image.jpg.php), PHP in image or font folders, executables and shell scripts, bundled archives.<\/li>\n
- Risky code<\/strong> that is new in the upload: eval and decode-and-run, shell commands, includes and unserialize of request data, long encoded strings, names hidden in \\x escapes or chr() chains, minified PHP, code that creates users or roles or grants capabilities, browser beacons, new outgoing requests and new web addresses.<\/li>\n
- What it adds to the site<\/strong>: new scheduled events, database tables and admin screens.<\/li>\n
- Themes<\/strong>: a parent theme that isn't installed, a changed parent theme, and whether the theme (or its parent) is the one visitors see.<\/li>\n<\/ul>\n\n
PHP is read with the tokenizer, so $db->exec()<\/code> or \"eval\" in a comment is not mistaken for the real thing, and only code that was not in the installed copy of the same file is reported.<\/p>\n\nFiles<\/h4>\n\n\n- A folder tree of every added, removed, modified, moved and whitespace-only file, with line counts.<\/li>\n
- Split or unified diffs with syntax highlighting (PHP, JavaScript, TypeScript, CSS, SCSS, JSON, HTML, YAML, SQL, Markdown and more), word highlights, folded context you can expand, and an option to ignore whitespace.<\/li>\n
- Before and after previews for images.<\/li>\n
- Filter by name or status, search inside the changed files, and step through files with j and k.<\/li>\n
- Download .patch<\/strong>: a git-style patch of the text changes that
git apply<\/code> applies to the installed copy.<\/li>\n<\/ul>\n\nChangelog<\/h4>\n\n
The entries from readme.txt (or CHANGELOG.md) between the installed and the uploaded version, plus the Upgrade Notice for the new version. For a downgrade, the entries you would give up.<\/p>\n\n
API changes<\/h4>\n\n
Functions, classes, public methods, hooks, REST routes, shortcodes, post types, blocks, scheduled events, admin screens, database tables, options and capabilities the new version adds or removes, plus Composer libraries that are added, removed or updated. Removed names are what breaks themes, snippets and other plugins that rely on them.<\/p>\n\n
Export<\/h4>\n\n
Save any review as an HTML report (opens in any browser, prints to PDF), as Markdown for a ticket or pull request, or as a .patch. It is built in your browser from what is already on the page.<\/p>\n\n
Dark theme<\/h4>\n\n
One click in the top bar. The choice is saved for your user and applies on every screen Patchmark shows.<\/p>\n\n
Light<\/h4>\n\n
Nothing runs on the front end. On the upload screen Patchmark only steps in when the plugin or theme is already installed, and only files that changed are read. Reviews are never stored: leaving the page discards them. The only thing saved is your light or dark choice, as user meta.<\/p>\n\n
A clean review is not a guarantee. Only install code from sources you trust.<\/p>\n\n
External services<\/h3>\n\n
Patchmark contacts WordPress.org only when you ask it to, and only downloads.wordpress.org:<\/p>\n\n
\n- Review the changes first<\/strong> downloads the update package WordPress has already found for that plugin (the same URL WordPress would install from).<\/li>\n
- Check<\/strong> and Check all plugins<\/strong> on Tools \u203a Patchmark download the checksum list for each plugin's installed version from
https:\/\/downloads.wordpress.org\/plugin-checksums\/<slug>\/<version>.json<\/code>.<\/li>\n- See what changed<\/strong> downloads WordPress.org's zip of the installed version from
https:\/\/downloads.wordpress.org\/plugin\/<slug>.<version>.zip<\/code>.<\/li>\n<\/ul>\n\nThe requests carry the plugin slug and version in the address, and the headers WordPress sends with every request it makes (including your site's address in the user agent). Nothing about your site's content or users is sent. WordPress.org's terms: https:\/\/wordpress.org\/about\/privacy\/<\/p>\n\n
Development<\/h3>\n\n
The files in build\/ are compiled from TypeScript and SCSS but not minified, so you can read them as they are.<\/p>\n\n
The source code and build setup are on GitHub: https:\/\/github.com\/ClearanceClarence-Software\/Patchmark<\/p>\n\n
To build it yourself you need Node 20 or newer:<\/p>\n\n
npm ci\nnpm run build\n\nnpm run zip makes the same plugin zip that's published here.<h3>Credits<\/h3>\n<\/code><\/pre>\n\nPatchmark bundles the Bricolage Grotesque font (Copyright 2022 The Bricolage Grotesque Project Authors) and the Atkinson Hyperlegible Next and Atkinson Hyperlegible Mono fonts (Copyright 2020-2024 The Atkinson Hyperlegible Next \/ Mono Project Authors), all licensed under the SIL Open Font License 1.1. The license texts are in the licenses\/ folder. The fonts are served from the plugin folder, not from Google.<\/p>\n\n
Syntax highlighting uses Prism (https:\/\/prismjs.com), MIT license, bundled with the plugin.<\/p>\n\n\n
\n- Install and activate Patchmark.<\/li>\n
- Upload a zip of a plugin or theme you already have installed (Plugins \u203a Add New \u203a Upload Plugin<\/strong>, or Appearance \u203a Themes \u203a Add New \u203a Upload Theme<\/strong>), or click Review the changes first<\/strong> next to a plugin update.<\/li>\n
- Read the review, then choose Replace<\/strong> or Update<\/strong>, or Cancel<\/strong>, in its top bar.<\/li>\n
- To check installed plugins against WordPress.org, go to Tools \u203a Patchmark<\/strong>.<\/li>\n<\/ol>\n\n\n
\nCan I try it without a zip?<\/h3><\/dt>\nYes. Tools \u203a Patchmark \u203a See a sample review<\/strong> builds a review of a made-up plugin's update in a temporary folder and removes it again. Nothing is installed. The Live Preview<\/strong> button on this page opens the same sample in WordPress Playground.<\/p><\/dd>\nWhere are the settings?<\/h3><\/dt>\nThere are none. The review appears on the upload screen when it has something to compare, and the integrity check is under Tools \u203a Patchmark.<\/p><\/dd>\n
Does it work for themes?<\/h3><\/dt>\nYes, for theme zips you upload. Update reviews and the integrity check are for plugins, since WordPress.org only publishes checksums for plugins.<\/p><\/dd>\n
Which plugins can the integrity check verify?<\/h3><\/dt>\nPlugins hosted on WordPress.org, at a version WordPress.org still has. Premium plugins and plugins from GitHub show as \"can't check\"; review their updates by uploading the zip.<\/p><\/dd>\n
How do I use it from the command line?<\/h3><\/dt>\nwp patchmark diff woocommerce ~\/woocommerce.9.4.0.zip\n wp patchmark diff .\/old-folder .\/new.zip --format=markdown > review.md\n wp patchmark update akismet --fail-on=warn\n wp patchmark check --all --diff<\/p>\n\n
Each side of diff<\/code> can be a folder, a zip, or the folder name of an installed plugin or theme. --format<\/code> is table, json or markdown. The commands exit with status 1 when there are serious findings (or, for check<\/code>, changed plugins).<\/p><\/dd>\nHow large a plugin can it handle?<\/h3><\/dt>\nPlugins with up to 20,000 files. A plugin like Formidable Forms (about 1,800 files, 29 MB) is compared in well under a second. Files over 512 KB, and anything past 8 MB of changed text, are compared and checked but their contents are not shown, to keep the page light.<\/p><\/dd>\n
Is the code check a malware scanner?<\/h3><\/dt>\nNo. It points at changes worth reading. It can't prove a plugin is safe, and it reports things that are normal in some plugins (a membership plugin creates users).<\/p><\/dd>\n\n<\/dl>\n\n\n
1.1.0<\/h4>\n\n\n- New: themes. Uploading a zip for an installed theme gets the same review, with checks for a missing or changed parent theme and the active theme.<\/li>\n
- New: review updates from WordPress.org before installing them, from a link in each update row on the Plugins screen.<\/li>\n
- New: Tools \u203a Patchmark checks installed plugins against WordPress.org's checksums, and compares a changed plugin with WordPress.org's original.<\/li>\n
- New: WP-CLI commands
wp patchmark diff<\/code>, update<\/code> and check<\/code>, with table, JSON and Markdown output and an exit status for CI.<\/li>\n- New: export a review as an HTML report or Markdown, next to the .patch download.<\/li>\n
- New: dark theme, saved per user.<\/li>\n
- New checks: names hidden in escapes or chr() chains, minified PHP, preg_replace \/e, strrev, add_cap(), navigator.sendBeacon(), and new scheduled events, database tables and admin screens.<\/li>\n
- API changes now also list scheduled events, admin screens, database tables, options and capabilities.<\/li>\n
- New: a sample review under Tools \u203a Patchmark, and a Live Preview in WordPress Playground.<\/li>\n
- A translation template is included, ready for translate.wordpress.org.<\/li>\n<\/ul>\n\n
1.0.0<\/h4>\n\n\n- First release: takes over the \"already installed\" upload screen with a review, a file browser with split and unified diffs, the changelog in between and API changes.<\/li>\n<\/ul>","raw_excerpt":"See what a plugin or theme zip, or an update, changes before it replaces the installed copy. Check plugins against WordPress.org.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/bre.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/397280","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bre.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/bre.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/bre.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=397280"}],"author":[{"embeddable":true,"href":"https:\/\/bre.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/cccode"}],"wp:attachment":[{"href":"https:\/\/bre.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=397280"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/bre.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=397280"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/bre.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=397280"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/bre.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=397280"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/bre.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=397280"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/bre.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=397280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}