Draft of the Theme Directory Review Process based off the plugin ones. I’m not a theme expert so welcome any feedback from theme developers and others.
All themes submitted to the ClassicPress Theme Directory will be reviewed by the Theme Review Team. The basic process used for reviews is outlined below:
Verify the theme name and subject matter are acceptable.
Verify the presence of a GitHub release and download the release or source code zip (a release zip is recommended, but not required).
Check the readme and theme header for required information (e.g. licence/tags/etc.)
Make sure the readme is clear and contains no contradictory information.
Run theme through wpcs to check for major issues (tabbing, indenting and other minor issues will be ignored).
Upload theme to a test environment with define('WP_DEBUG', true); and activate; check for any errors on front and back ends.
WPCS finds everything what it can find, from missing esc_, missing sanitize_, fatal errors (yes they slip in during development and I know a number of developers who used to ship plugins with fatal errors in them because they did not use any sniff tools…)
Basically WPCS is a PHPCS with WP Docs and Coding standards on top. I find it amazing. A must on a developer’s tool stack - and a real good and quick way to check a new plugin for issues. If a new plugin passes WPCS without a single warning it is very likely to be safe, at least, in the basics. I don’t think WPCS can dedect things like more complex attack vectors (like @pluginvulns tool can), but it surely does find a lot.
Try tells more than describe it, IMO. I also like how it asks me to write nice Code Block Doc, this is good to later generate DOC with the parser, instead of writing it up manually.
Happens just today I downloaded a theme from WP Repo to create a new derivate thereof, and WPCS found 4 unescaped occasions, 3 of them valid, one invalid because the author of the theme wrongly echoed where it wouldn’t even have been needed.
Thus, I would say it is worth the work to install it
There’s a plugin that I would suggest to make mandatory to pass:
Perhaps will have to fork it for WP 4.9 standards which meanwhile changed, so it works with CP themes, but that plugin is allover a very good tool at least for usability check and missing-things check.
They have reduced the checks in Theme Check very recently.
There was a Theme Sniffer, which used the base like WPCS.
Also, Kevin wrote an extensive Theme Audit which catches quite a lot of stuff.
The official TRT plugin, yeah. I once upon a time was also part of the TRT, so I remember that fondly (no irony implied). This certainly helped me to improve my PHP programming skills to be able to develop better understandable, and easier DEBUGable source code.
If all, esp. “premium” theme and plugin developers would adhere to those standards, they would make it easier for everyone to work with their products, not just their clients (and attached developers), but also themselves, including future partners (eg. freelance developers tasked with jobs to enhance a specific part of their plugins etc.) and colleagues.
Over on WP Slack #themereview, a Yoast team member just posted
jonoalderson
Some new processes from Shopify which we might be able to take inspiration from: New Accessibility Requirements in the Shopify Theme Store.
Nice that they’re using Lighthouse across multiple templates, and using an average of the scores.
