Common submission rejection reasons in WordPress plugin review on CodeCanyon (and their fixes)

In this post I will detail a list of common code issues that can cause your newly submitted plugins to CodeCanyon to be rejected during the initial review. There are based on my experience, all were found in plugin reviews for the plugins I submitted. Please note that I have submitted only WordPress plugins so far, so, these will be rejection reasons for WordPress plugins only.

Here is the list of submission rejection reasons, that I got so far for my plugins:

• Is this supposed to be a prefix? https://envato.d.pr/OAd6mR

Bad code:

update_option('xxxxsettings_changedx', 1);

Good code:

update_option('coderevolution_settings_changed', 1);

• Remove all unused code: https://envato.d.pr/jpcLhW

Bad code:

if( $ignore_sticky_posts )
$args['ignore_sticky_posts'] = true;
/*if( !empty( $meta_key ) )
$args['meta_key'] = $meta_key;
if( !empty( $meta_value ) )
$args['meta_value'] = $meta_value;*/

Good code:

if( $ignore_sticky_posts )
$args['ignore_sticky_posts'] = true;

• Enqueue all CSS & JS correctly: https://envato.d.pr/PDWiBi

Bad code:

<script>
jQuery(document).ready(function(){update_option(1);...\\this code is included directly into a PHP file}
</script>

Good code:

 wp_enqueue_script('my-custom-footer-script', plugins_url('scripts/footer.js', __FILE__), array('jquery'), false, true); \\this script contains the above js code

• Use .on() rather than .click(), .bind(), .hover(), .submit() etc… https://envato.d.pr/Ayp0y8

Bad code:

jQuery('span.wpmovieomatic-delete').html('X').css({'color':'red','cursor':'pointer'}).click(function(){
var confirm_delete = confirm('Delete This Rule?');
if (confirm_delete) {
jQuery(this).parent().parent().remove();
jQuery('#myForm').submit();
}
});

Good code:

jQuery('span.wpmovieomatic-delete').on('click', function(){
var confirm_delete = confirm('Delete This Rule?');
if (confirm_delete) {
jQuery(this).parent().parent().remove();
jQuery('#myForm').submit();
}
});;

• Use proper semantic HTML: https://envato.d.pr/S9Qlea

Bad code:

<tr><td><div>Hello</div></td></tr>

Good code:

<tr>
<td>
<div>
Hello
</div>
</td>
</tr>

• Escape everything: https://envato.d.pr/EioK9l

Bad code:

echo '>' . $user->display_name . '</option>';

Good code:

echo '>' . esc_html($user->display_name) . '</option>';

• All theme text strings are to be translatable and properly escaped: https://envato.d.pr/TaYHTA

Bad code:

<b>Generated Post Title:</b>

Good code:

<b><?php echo esc_html__("Generated Post Title:", 'your-plugin-textdomain');?></b>

• Don’t suppress errors: https://envato.d.pr/hdcF1c

Bad code:

@ini_set('safe_mode', 'Off');

Good code:

ini_set('safe_mode', 'Off');

• Instead of using file_get_contents, fopen, fread, fwrite, fputs, chmod and such, could you please use the WordPress equivalents. You can access these through the WP Filesystem API.

Bad code:

$image_data = file_get_contents($image_url);

Good code:

global $wp_filesystem;
if ( ! is_a( $wp_filesystem, 'WP_Filesystem_Base') ){
include_once(ABSPATH . 'wp-admin/includes/file.php');
$creds = request_filesystem_credentials( site_url() );
wp_filesystem($creds);
}
$image_data = $wp_filesystem->get_contents($image_url);

• All JavaScript should be written with “use strict” mode on. For example, you can do this with jQuery as follows: (function($) { “use strict”; // Author code here })(jQuery); https://envato.d.pr/zGx3xH

Bad code (this is the content of a  single js file):

var ajaxurl = mycustomsettings.ajaxurl;

Good code (this is the content of a  single js file):

"use strict";
var ajaxurl = mycustomsettings.ajaxurl;update_option('coderevolution_settings_changed', 1);

• Use dashes instead of underscores for handles: https://envato.d.pr/dyDa2c

Bad code:

wp_enqueue_style('movieomatic_thumbnail_css', $src, __FILE__);

Good code:

wp_enqueue_style('movieomatic-thumbnail-css', $src, __FILE__);

• Use protocol relative URLs: https://envato.d.pr/a9GyME

Bad code:

$settings_link = '<a href="https://codecanyon.net/downloads" target="_blank" title="Rate">';

Good code:

$settings_link = '<a href="//codecanyon.net/downloads" target="_blank" title="Rate">';

• Use a proper textdomain: https://envato.d.pr/thU02j

Bad code:

esc_html__('Activate Plugin License', 'textdomain');

Good code:

esc_html__('Activate Plugin License', 'movieomatic-themoviedb-post-generator');

And that’s it!

Please keep in mind that these are only a list of issues that were found during review for my plugins from CodeCanyon, you might find also other rejections reasons for your specific code. Please check and follow this full list of WordPress plugin coding requirements from CodeCanyon.

I detailed these issues also in this YouTube video from my channel.

I hope this post helps in the approval process for your CodeCanyon new submissions. 🙂