What would happen if the admin installs a plugin when the plugin is included in the theme?

I’m going to develop a custom theme which will have a plugin included
in it.

Please, don’t include a plugin in your theme.

Instead, I’d suggest using TGM Plugin Activation or some other mechanism to require or recommend plugins for your theme (TGM also works for plugins).

Separating your theme and any required or suggested plugins will allow everything to be updated independently, which is crucial for staying on top of security issues.

There was a huge security situation not too long ago caused (in part) by themes bundling a slider plugin which had a vulnerability. Even though the plugin’s authors patched the vulnerability, the issue remained on many sites because the plugin was included in the theme and therefore was not updated. This creates a big headache for everybody — plugin developers, end users, site visitors, and you (the theme developer).

Also, if you want to hide the UI for these plugins, I would suggest only doing so for non-administrator roles. This kind of stuff could be handled via your theme or via your own custom plugin.

Leave a Comment