How to Create a WordPress Plugin from Scratch (2026 Beginner Guide)

To build a WordPress plugin from scratch, create a folder in wp-content/plugins, add a PHP file with a plugin header comment, and use hooks to add your feature. Prefix everything, sanitise input, escape output, check permissions and nonces, and load scripts with wp_enqueue_script. Start small: one clear feature, tested on a staging site.

When should you build a plugin instead of editing the theme?

Imagine a gym that adds a class timetable shortcode to its theme’s functions.php. A year later they switch themes and the timetable vanishes from every page. If that code had lived in a small plugin, the new theme would have kept it.

The rule of thumb: design and layout belong in the theme, features and data belong in a plugin. Custom post types, shortcodes, integrations, admin tools and business logic should all be plugins.

What does a basic plugin look like?

Create the folder wp-content/plugins/twx-notice/ and a file twx-notice.php:

<?php
/**
 * Plugin Name: TWX Site Notice
 * Description: Shows a small notice bar at the top of the site.
 * Version: 1.0.0
 * Author: Your Name
 * Requires PHP: 7.4
 * License: GPL-2.0-or-later
 */

if ( ! defined( 'ABSPATH' ) ) exit;

add_action( 'wp_body_open', 'twx_notice_bar' );
function twx_notice_bar() {
    $text = get_option( 'twx_notice_text', 'Welcome to our site' );
    echo '<div class="twx-notice">' . esc_html( $text ) . '</div>';
}

Go to Plugins in the dashboard, activate it, and the bar appears. That is a complete, working plugin.

How do you build a plugin step by step?

1. Plan one feature. Write down what it does, who uses it and where it appears.
2. Set up a staging site or a local environment, never a live store.
3. Create the folder and main file with the header comment and the ABSPATH check.
4. Add your feature with hooks. Use actions and filters as explained in WordPress hooks and filters.
5. Add a settings page with the Settings API (register_setting, add_options_page) if users need options.
6. Enqueue assets with wp_enqueue_style and wp_enqueue_script, only on pages that need them.
7. Handle activation and uninstall with register_activation_hook and an uninstall.php file that removes your options and tables.
8. Test with debug on, then with popular plugins active, then on the oldest PHP version you support.

What security rules must every plugin follow?

How should you organise a bigger plugin?

• Keep the main file short and load other files from an includes/ folder.
• Use classes or namespaces to avoid name clashes.
• Split admin code from front-end code so the front end stays light.
• Make text translatable with __() and a text domain.
• Add your own hooks so the plugin can be extended later.
• Version your code with Git and write a changelog.

Frequently asked questions

Sources

• Plugin basics (WordPress Plugin Handbook)
• Hooks (WordPress Plugin Handbook)
• Security (WordPress developer APIs)