Theme Review & Audit Tooling

Before you submit a theme to WordPress.org — or ship a client theme that should meet the same bar — WP Rig includes an audit suite that simulates the official theme review process. It encodes the Theme Review guidelines into runnable checks, plus a WP-CLI test-data pipeline.

The audit commands

CommandWhat it checks
npm run audit:theme-reviewThe full simulated review — runs every check below in sequence.
npm run audit:metadatastyle.css header completeness and validity (name, author, version, Tested up to, license).
npm run audit:banned-filesFiles that must not ship in a theme (dev artifacts, build sources, hidden configs).
npm run audit:plugin-territoryFunctionality that belongs in a plugin, not a theme (post types, plugins-style features).
npm run audit:security-patternsEscaping, sanitization, and nonces — the security patterns reviewers check by hand.
npm run audit:remote-resourcesExternal HTTP references (CDN scripts, remote fonts) that violate the self-contained rule.
npm run audit:theme-checkThe Theme Check plugin rule set, runnable from the CLI.
npm run audit:i18nInternationalization: text domain consistency, escaping of translatable strings.
npm run audit:theme-jsontheme.json validity and schema conformance.
npm run audit:html-templatesBlock template/part markup validity.

Each command is also wired into CI — the PHP job runs PHPCS against the WPThemeReview standards, so the official ruleset gates every pull request, not just submission time.

Theme Unit Test data

Reviewers test themes against the official Theme Unit Test data — edge-case posts, nested comments, media, weird titles. WP Rig ships WP-CLI commands to set this up on your local site:

wp rig test-setup        # set up the Theme Unit Test environment
wp rig import-test-data  # import the official Theme Unit Test data

The spatial test suite even includes a theme-unit-test stress page audit (see Testing in WP Rig), so layout integrity on pathological content is verified automatically.

Review discipline as a habit

  • Run npm run audit:theme-review before every release candidate — not the night before submission.
  • Keep Tested up to aligned with the supported WordPress version (7.1 as of WP Rig 3.5).
  • Pair with composer run-phpcs (WPThemeReview ruleset) and the pre-flight npm run ai:check gate.
  • A theme that passes audit:theme-review locally rarely surprises a human reviewer.

Production Bundling & Exports (the wporg bundle), Testing in WP Rig, and Theme Paradigms (the review branches differ for classic vs block themes).