Is there any guarantee that the plugins I find on the wordpress site are legitimate and don't have any malicious code in them? Or is it up to me to check them?
If so, what would be the best way to do that, given that I have little knowledge of php
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It only takes a minute to sign up.Sign up to join this community
Plugins on wordpress.org has always been a debateble question for me. According to my opinion all plugins submitted to wordpress.org should be tested thoroughly and should be bug free.
However, I come across many highly used plugins that are not up to scratch. More that 50 percent of plugins I've tested have some kind of bug, some are so full of bugs like you can't believe. A while ago I tested a social plugin for a user that had problems using the plugin, and that sad to say, functions was used in that specific plugin that is depreciated since wordpress v2.0
So it seems that there aren't any proper control of what goes into the wordpress.org plugin directory and what not.
As for malicious code, I haven't came across that as of yet. But I'm still very warry of just using a plugin without properly testing it out in a test enviroment. And on that test enviroment I have permanently set debug to true in wp-config.php. Once a plugin has passed in my test site, only then will I install it in my live site
The plug in from wordpress.org are community driven. So while there is no guarantee, the larger community usually stuffs out ones that aren't any good. A good suggestion might be to check the number of downloads and the reviews. I may suggest that you consider spending a little bit of money for a plug in at codecanyon.net. I've never had problems there.