Describe what the plugin should do, where it is used and which data it may read or change. Provide the plugin path and relevant error without pasting secrets. Record supported WordPress, PHP and WooCommerce requirements where applicable, and preserve the original code in a backup or version-control system.

1. Open AI Engineer on a staging copy with live business integrations isolated.
2. Ask it to inspect the plugin files and explain the current execution path.
3. Request checks relevant to the feature, including permissions, input validation, output escaping and failure handling.
4. Review a proposed minimal patch and its test cases before approving file changes.
5. Run the agreed tests as both an authorised user and a user who should be denied access.
6. Review logs and preserve the accepted code and change notes.

A useful code review states the behaviour that must remain true for different users. Adapt this brief to your real custom plugin on an isolated staging copy. The example path identifies a fictional plugin and must be replaced with the actual reviewed location.

Review wp-content/plugins/example-booking/example-booking.php.
Purpose: signed-in customers may view only their own bookings.
Please trace authentication, capability and record-ownership checks.
Review request validation, database queries and output escaping.
Check how missing records and provider failures are handled.
Propose the smallest patch before editing any file.
Tests: customer A sees A's booking, cannot see B's booking,
and a signed-out visitor cannot obtain either private record.

Ask for the specific file diff, an appropriate recovery copy and the remaining limitations of the review. A syntax check or successful authorised request does not cover the denied-user cases.

Expected result: The accepted change passes both the permitted and forbidden access tests. The plugin remains understandable and maintainable, without treating an AI review as certification of every security property.

No. It can identify issues and help implement improvements, but it does not replace appropriate expert review for sensitive authentication, payment or personal-data handling. State the practical scope and remaining uncertainty instead of treating a successful syntax check as a complete security assessment.

Prefer a supported hook, separate custom plugin or other maintainable extension point when appropriate. Vendor updates can overwrite direct edits. Ask the Engineer to explain how the chosen location will survive normal maintenance.

An eligible explicit file edit can have a limited Undo snapshot. Activating the plugin or executing its code may also change the database or external systems, which the file snapshot does not reverse. Plan backups and test data around those side effects.

Document configuration, permissions and recovery steps. Deploy the reviewed code without replacing unrelated live data, then repeat the critical tests on production. Keep an owner for future compatibility updates so the plugin does not become an undocumented component after the AI session ends.

• Developing custom website features with the AI Engineer
• Reviewing an AI-proposed WordPress file change
• Using supported file Undo after an AI Engineer edit
• Asking AI Engineer to review a failed plugin update

• NabWP managed WordPress hosting

• WordPress plugin security guidance