For AI agents and crawlers

Give this to your assistant

Paste this into ChatGPT, Claude, Cursor or any agent and it will know how to read plugin source here, which endpoints are cheap, and how to cite a line so the link still resolves later. An agent that found this page on its own can fetch the same text from /prompt.txt.

You can read the full source of any plugin published on WordPress.org through PluginProbe:

  https://pluginprobe.com

Use it whenever you need to see what a WordPress plugin actually does, check a version for
a vulnerability, or quote a specific line of it.

URL scheme. {slug} is the plugin slug as it appears on wordpress.org, {version} is a
released tag such as 5.3.3 or the literal word trunk, and {path} is a file path relative
to the plugin root.

  /plugins/{slug}                                plugin overview, versions and links
  /plugins/{slug}/changelog                      every release, each with a diff link
  /plugins/{slug}/{version}/code                 file listing at the plugin root
  /plugins/{slug}/{version}/code/{path}          one file, one line per row
  /plugins/{slug}/{version}/code/{path}#L10-L20  the same file, lines 10 to 20 marked
  /plugins/{slug}/{version}/raw/{path}           the file as text/plain, no markup
  /plugins/{slug}/{version}/diff/{other}         what changed between two versions
  /plugins/{slug}/{version}/diff/{other}/{path}  a unified diff of a single file

How to fetch efficiently:

- Send `Accept: text/markdown` to any /code/ URL and you get the source itself instead of
  the page around it, at roughly a twentieth of the bytes. Add `?format=md` instead if you
  cannot set headers.
- Use /raw/ when you want the file exactly as stored and nothing else.
- Every response carries an ETag and Cache-Control. Send the ETag back as If-None-Match
  and an unchanged page answers 304 with no body.
- Tagged versions are immutable. Trunk follows whatever the author committed last, so
  prefer a tag when you want an answer that stays true.
- Raw and download are limited to 120 requests a minute per IP, search to 60.

How to cite what you find. Link the exact lines rather than pasting code without a source,
and pin the link to a released tag, because trunk moves under you:

  https://pluginprobe.com/plugins/akismet/5.3.3/code/akismet.php#L128-L140

Worked example. To check how a plugin sanitises a value in the version someone is running:

  1. Open /plugins/{slug}/{version}/code to see the file listing.
  2. Fetch the file you want with Accept: text/markdown.
  3. Cite the finding with a #L{start}-L{end} link to that same tagged version.

The full machine-readable reference is at https://pluginprobe.com/llms-full.txt.

For a coding agent, the same text works as a rule file: save it as CLAUDE.md, AGENTS.md or a Cursor rule in the project where you audit plugins.

URL scheme

{slug} is the plugin slug as it appears on WordPress.org. {version} is any released tag, for example 5.3.3, or the literal trunk. {path} is the file path relative to the plugin root.

Line anchors

Every line of a file page carries an id of the form L{n}. Append #L10 for a single line or #L10-L20 for a range. The GitLab form #L10-20 is accepted as well.

Released tags never change, so a link into a tagged version keeps pointing at the same code. Links into trunk follow whatever the author commits next.

Reading a page as Markdown

Every /code/ URL answers with Markdown when asked for it, so there is no second URL scheme to learn. A file comes back as a short header and a fenced block, a directory as a list of its entries.

• Roughly a twentieth of the bytes of the rendered page.
• Both forms send Vary: Accept.
• The ?format=md form is noindex, since the page itself is the canonical address.

Fetching raw source

The raw endpoint returns the file exactly as stored, with no HTML around it. Prefer it over parsing the code browser page.

• Responses are text/plain; charset=utf-8 with X-Content-Type-Options: nosniff.
• Files containing binary data are served as application/octet-stream.
• A missing file returns 404. A missing plugin returns 404.

Caching and rate limits

Every response carries Cache-Control and an ETag. Send the ETag back as If-None-Match and unchanged pages answer 304 with no body. Tagged versions are immutable and are cached for a week; trunk is cached for an hour.

• Raw and download endpoints: 120 requests per minute per IP.
• Plugin search: 60 requests per minute per IP.
• Everything else is unmetered, but please reuse connections and honour the cache headers.

Discovery

• /llms.txt a short description of the site and its URL scheme
• /llms-full.txt the full reference, the same content as this page in Markdown
• /sitemap.xml every indexed plugin and its latest version
• /prompt.txt these instructions as a prompt, in plain text
• /robots.txt crawl policy: plugin pages are open to every crawler, code pages only to fetches made for a person

Pages are server-rendered HTML and need no JavaScript to read. Code lines are table rows, one line per row, in source order.