Patchmark

When you upload a zip for a plugin or theme that is already installed, WordPress shows a small table (name, version, author, requirements) and a button to replace it. Patchmark takes over that screen and turns it into a proper review, with Cancel and Replace in its top bar. When there are serious findings, Replace takes a second click.

The same review is available in three more places:

• Updates from WordPress.org. Every update row on the Plugins screen gets a Review the changes first link. Patchmark downloads the update, compares it with what you have, and puts Update in its top bar.
• Integrity check. Tools › Patchmark checks installed plugins against the checksums WordPress.org publishes for every version it hosts, and lists files that were modified, added or deleted since installation. See what changed opens a full review of your copy against WordPress.org’s original.
• WP-CLI. wp patchmark diff, wp patchmark update and wp patchmark check print the same findings as a table, JSON or Markdown, and exit with status 1 on serious findings, for deploy scripts and CI.

Review

Everything worth a second look, most serious first, each linked to the exact file and line:

• Header changes: older version than installed, same version with different files, a different plugin name or author, a new Update URI (future updates would come from somewhere else), new requirements, missing required plugins, a renamed main file (the plugin would be deactivated), a changed text domain.
• Unusual files: .htaccess and .user.ini, PHP files with odd extensions (.phtml, .phar, image.jpg.php), PHP in image or font folders, executables and shell scripts, bundled archives.
• Risky code that is new in the upload: eval and decode-and-run, shell commands, includes and unserialize of request data, long encoded strings, names hidden in \x escapes or chr() chains, minified PHP, code that creates users or roles or grants capabilities, browser beacons, new outgoing requests and new web addresses.
• What it adds to the site: new scheduled events, database tables and admin screens.
• Themes: a parent theme that isn’t installed, a changed parent theme, and whether the theme (or its parent) is the one visitors see.

PHP is read with the tokenizer, so $db->exec() or “eval” in a comment is not mistaken for the real thing, and only code that was not in the installed copy of the same file is reported.

Files

• A folder tree of every added, removed, modified, moved and whitespace-only file, with line counts.
• Split or unified diffs with syntax highlighting (PHP, JavaScript, TypeScript, CSS, SCSS, JSON, HTML, YAML, SQL, Markdown and more), word highlights, folded context you can expand, and an option to ignore whitespace.
• Before and after previews for images.
• Filter by name or status, search inside the changed files, and step through files with j and k.
• Download .patch: a git-style patch of the text changes that git apply applies to the installed copy.

Changelog

The entries from readme.txt (or CHANGELOG.md) between the installed and the uploaded version, plus the Upgrade Notice for the new version. For a downgrade, the entries you would give up.

API changes

Functions, classes, public methods, hooks, REST routes, shortcodes, post types, blocks, scheduled events, admin screens, database tables, options and capabilities the new version adds or removes, plus Composer libraries that are added, removed or updated. Removed names are what breaks themes, snippets and other plugins that rely on them.

Export

Save any review as an HTML report (opens in any browser, prints to PDF), as Markdown for a ticket or pull request, or as a .patch. It is built in your browser from what is already on the page.

Dark theme

One click in the top bar. The choice is saved for your user and applies on every screen Patchmark shows.

Light

Nothing runs on the front end. On the upload screen Patchmark only steps in when the plugin or theme is already installed, and only files that changed are read. Reviews are never stored: leaving the page discards them. The only thing saved is your light or dark choice, as user meta.

A clean review is not a guarantee. Only install code from sources you trust.

External services

Patchmark contacts WordPress.org only when you ask it to, and only downloads.wordpress.org:

• Review the changes first downloads the update package WordPress has already found for that plugin (the same URL WordPress would install from).
• Check and Check all plugins on Tools › Patchmark download the checksum list for each plugin’s installed version from https://downloads.wordpress.org/plugin-checksums/<slug>/<version>.json.
• See what changed downloads WordPress.org’s zip of the installed version from https://downloads.wordpress.org/plugin/<slug>.<version>.zip.

The requests carry the plugin slug and version in the address, and the headers WordPress sends with every request it makes (including your site’s address in the user agent). Nothing about your site’s content or users is sent. WordPress.org’s terms: https://wordpress.org/about/privacy/

Development

The files in build/ are compiled from TypeScript and SCSS but not minified, so you can read them as they are.

The source code and build setup are on GitHub: https://github.com/ClearanceClarence-Software/Patchmark

To build it yourself you need Node 20 or newer:

npm ci
npm run build

npm run zip makes the same plugin zip that's published here.<h3>Credits</h3>

Patchmark bundles the Bricolage Grotesque font (Copyright 2022 The Bricolage Grotesque Project Authors) and the Atkinson Hyperlegible Next and Atkinson Hyperlegible Mono fonts (Copyright 2020-2024 The Atkinson Hyperlegible Next / Mono Project Authors), all licensed under the SIL Open Font License 1.1. The license texts are in the licenses/ folder. The fonts are served from the plugin folder, not from Google.

Syntax highlighting uses Prism (https://prismjs.com), MIT license, bundled with the plugin.