Curated resource guide
WordPress Supply-Chain Security
Reduce exposure to compromised plugins, maintainers, repositories, dependencies, and build systems across the WordPress delivery chain. These references cover provenance, integrity, update servers, Composer and npm risk, CI secrets, abandoned software, vendor review, advisory monitoring, dependency reduction, and emergency upstream response.
Scope
What this guide covers
- Plugin/theme/core update provenance
- compromised plugins and maintainer accounts
- dependency and Composer/npm risks
- GitHub/repository compromise
- CI/CD secrets
- stolen credentials
- update-server security
- package integrity
- checksums
- abandoned plugins
- ownership transfers
- malicious dependencies
- third-party code snippets
- nulled software
- build pipelines
- signing/integrity concepts
- vendor due diligence
- monitoring security advisories
- minimizing dependency surface
- and emergency response to a compromised upstream dependency
Selected references
Curated resources
Links open the original publisher so you can use the complete, current material in context.
- 01Recommended starting point
Detailed Plugin Guidelines
The rules used for plugins hosted in the WordPress.org directory. Even for privately distributed work, they provide a valuable review of licensing, security, behavior, and user trust.
developer.wordpress.org - 02
Composer Audit
Check installed PHP packages against security advisories and abandoned-package metadata.
getcomposer.org - 03
- 04
GitHub Dependabot
Automate dependency alerts and carefully reviewed update pull requests.
docs.github.com - 05
- 06
OpenSSF Scorecard
Assess observable repository security practices and investigate findings before adopting a dependency.
securityscorecards.dev - 07
Sigstore Documentation
Learn keyless signing and verification for software artifacts and build provenance.
docs.sigstore.dev