[vmasto]

Interesting.

I'd be interested in the maintenance strategies you have in place (if any).

I assume that for plugins who don't output styles or scripts you use other methods, maybe some HTML output etc, so you've probably hard coded a lot of stuff for some popular plugins.

How have you set your tests and how do you plan on knowing when a certain plugin stops emitting the signature you're checking for? Most probably an E2E test with a local theme containing everything, care to share tech specifics ok this part?

[codeaken]

We can only identify user fronting plugins that make themselves known through signatures or js/image/css imports. We do this in an automated fashion by exploiting the predictable folder structure of WordPress. So no maintenance needed here.

There are some very popular plugins (Yoast SEO, Jetpack, W3 Total Cache) that don't import additional files. For these we have hardcoded patterns (under a 100). We do not have anything in place for checking if these patterns break.

We could automate creating a WordPress installation, installing the plugin we want to check, trigger a wp detective scan and then checking the results. But I am note sure it is worth the engineering effort.