WordPress Plugin Development for Beginners: How a Plugin Actually Works

You want to build a WordPress plugin. You have no idea where to start. This guide walks you from an empty folder to a working plugin. It explains every step a developer takes. It explains every term you will meet. When you finish, you can follow our advanced article, where a seasoned developer builds a real plugin.

You do not need to know everything about WordPress. You need a text editor, a WordPress site to test on, and about twenty minutes. This article is the onboarding you wish you had.

What Is a Plugin?

A plugin adds features to WordPress. It is a folder of files in a specific place. WordPress loads those files on every page.

A theme changes how the site looks. A plugin changes what the site does. This is the division of labour. Keep it in mind: look and behaviour stay separate.

WordPress itself is written in PHP. Plugins are written in PHP too. Some plugins also use JavaScript for the browser side. That mix is what you will learn here.

Where Plugins Live

Every plugin lives in this folder:

wp-content/plugins/

One plugin, one folder. The folder name should match the plugin. Inside the folder, the main file should have the same name as the folder:

wp-content/plugins/my-first-plugin/my-first-plugin.php

You can upload the folder through the WordPress admin, or copy it with FTP. For development, a local test site is fastest. You will activate the plugin from the Plugins screen when it is ready.

How WordPress Runs a Plugin

WordPress reads the main file of every active plugin when a page loads. The file starts with a comment block. That comment tells WordPress the plugin name, version, and author. Without the comment, WordPress does not know the plugin exists.

Your PHP code does not run by itself. It runs when an event fires. WordPress calls events hooks. This is the single most important idea in WordPress development.

There are two kinds of hooks:

• An action runs your code at a moment in time. Example: print something at the end of the page.
• A filter changes a value. Example: add text to the end of a post.

You register your code with a hook using add_action() or add_filter(). You pass two things: the name of the moment, and the name of your function.

Build Your First Plugin

Step 1: Create the folder and file

Create this folder and file on your test site:

wp-content/plugins/my-first-plugin/my-first-plugin.php

Step 2: Write the header comment

Open the file and write this. The Plugin Name line is the one WordPress requires:

<?php
/**
 * Plugin Name: My First Plugin
 * Description: A simple plugin to learn WordPress development.
 * Version: 1.0.0
 * Author: Your Name
 */

Now go to the Plugins screen. You will see My First Plugin listed. Activate it. Nothing happens yet, because the file has no behaviour. That is normal.

Step 3: Add the safety guard

Anyone can load a PHP file directly if they know the path. WordPress defines a constant called ABSPATH. The guard stops direct access:

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

Every professional plugin starts with this guard. The WordPress plugin review requires it. Use it always.

Step 4: Your first action

Add a credit line to the page footer. The action wp_footer fires at the end of every page:

function tek_first_footer_credit() {
    echo '<p class="tek-credit">Built with My First Plugin.</p>';
}
add_action( 'wp_footer', 'tek_first_footer_credit' );

Save the file. Reload any page on the site. You will see the credit line at the bottom. You just made WordPress do something.

Step 5: Your first filter

Filters change values. The filter the_content hands you the post content before it displays. Return a changed value:

function tek_first_add_note( $content ) {
    if ( ! is_single() ) {
        return $content;
    }
    return $content . '<p class="tek-note">Thanks for reading!</p>';
}
add_filter( 'the_content', 'tek_first_add_note' );

The function receives the content, changes it, and returns it. Filters always return a value. Actions never need to.

Step 6: Your first shortcode

A shortcode is a tag you type into a post. WordPress replaces it with your output. This one shows the site name:

function tek_site_info_shortcode() {
    return '<p>Site: ' . esc_html( get_bloginfo( 'name' ) ) . '</p>';
}
add_shortcode( 'tek_site_info', 'tek_site_info_shortcode' );

Type [tek_site_info] in any post. WordPress replaces it with the site name. Note the esc_html() call. Escaping stops dangerous characters from becoming code. WordPress reviewers check for it.

Step 7: Pass data to JavaScript

PHP runs on the server. JavaScript runs in the browser. The bridge between them is wp_localize_script(). First enqueue a JavaScript file, then pass data to it:

function tek_first_enqueue_scripts() {
    wp_enqueue_script(
        'tek-first',
        plugin_dir_url( __FILE__ ) . 'tek-first.js',
        array(),
        '1.0.0',
        true
    );
    wp_localize_script(
        'tek-first',
        'tekFirstData',
        array( 'siteName' => get_bloginfo( 'name' ) )
    );
}
add_action( 'wp_enqueue_scripts', 'tek_first_enqueue_scripts' );

// tek-first.js
document.addEventListener( 'DOMContentLoaded', function () {
    console.log( 'Site name from PHP:', tekFirstData.siteName );
} );

Open the browser console. You will see the site name. This exact mechanism is how our UploadFit plugin tells the browser the real upload limit before an upload starts. You are now one step from that code.

Every Term WordPress Developers Use

Here is the glossary. Read it once. Come back when you meet a term.

Term	Plain English
Plugin	A folder of files that adds features to WordPress.
Theme	The files that control how the site looks.
Hook	An event in WordPress that your code can listen to.
Action hook	A moment when WordPress runs your code. Use add_action().
Filter hook	A value WordPress lets you change. Use add_filter().
Shortcode	A tag like [tek_site_info] that becomes your output.
Enqueue	The correct way to load a script or style with wp_enqueue_script().
wp_localize_script	The bridge that passes PHP data to JavaScript.
Text domain	The code that identifies your plugin translations.
i18n / l10n	Internationalization / localization: making text translatable.
Slug	The URL-safe name of a plugin, post, or term.
Nonce	A one-time token that proves a form request is real.
Escaping	Making output safe with esc_html, esc_attr, esc_url.
Sanitizing	Cleaning input with sanitize_text_field and friends.
wp-admin	The admin dashboard of the site.
Post type	A content type. Posts and pages are the defaults.
Custom post type	Your own content type, like Product or Event.
Taxonomy	A grouping system. Categories and tags are taxonomies.
Gutenberg	The block editor, the default editor since WordPress 5.
Block	A content unit in Gutenberg, like a paragraph or image.
REST API	The JSON interface that lets apps talk to WordPress.
Endpoint	A single address in the REST API, like /wp/v2/posts.
wp-cli	A command-line tool for WordPress tasks.
Option	A saved setting in the database.
Transient	A temporary cached value.
Conditional tag	A check like is_admin() or is_single() that returns true or false.
mu-plugin	A must-use plugin that always runs and cannot be disabled.
Activation hook	Runs when the plugin is activated.
Deactivation hook	Runs when the plugin is deactivated.
uninstall.php	Runs when the plugin is deleted. Cleans up options.
Template hierarchy	The order of files WordPress uses to render a page.
Child theme	A theme that changes a parent theme safely.
Plugin Check (PCP)	The official tool that scans your plugin for review errors.
SVN	The system WordPress.org uses to host plugin releases.

Where to Go Next

You now have a working plugin and a glossary. Two resources will take you further:

• The official handbook. The WordPress Plugin Handbook at developer.wordpress.org covers every hook, function, and rule. Bookmark it.
• Our advanced article. Read how a seasoned developer builds a real plugin: A Client-Side Image Resizer for WordPress. It shows the WP 6.8 internals, the review process, and how to test like a professional.

That article ends with a plugin that is now live on WordPress.org. You can follow the same path. Build small. Test often. Read the errors. That is how everyone starts.

Summary

• A plugin is a folder in wp-content/plugins
• The header comment registers the plugin with WordPress
• Hooks are events; actions run code, filters change values
• Guard the file with the ABSPATH check
• Escape output and sanitize input, always
• wp_localize_script bridges PHP and JavaScript
• Use the glossary when you meet an unfamiliar term