Plugin Guidelines – CALS WordPress Hosting

Overview

CALS Web Services strives to provide a high-functioning WordPress environment and deliver a high-quality WordPress experience to all customers. The CALS WordPress Multisite environment offers many features and functionality via the CALS WordPress Theme and CALS-approved plugins. A customer may make a request for us to add a plugin to their website, however every plugin must meet certain criteria and undergo a rigorous evaluation process to ensure that it does not compromise the security, performance, stability, accessibility, usability, style and branding of the overall CALS WordPress environment and WordPress experience. We have implemented the following plugin guidelines for the CALS Web Service that closely mirror the overall WiscWeb Service plugin criteria.

Our team also conducts regular reviews of existing plugins based on the same criteria. If a plugin fails to meet any criteria during review, we may be forced to remove the plugin with short notice. We will do our best to communicate with site owners and help identify alternatives to maintain functionality. Even though a plugin may be specifically used only on a single site, installation of a plugin impacts the entire CALS WordPress multisite platform and sometimes we must move quickly to mitigate a security or stability risk.

Review Criteria

Security

Evaluation based on data gathered from vulnerability scan history, code audit, permissions review, update frequency, number of downloads, security patch history, response time to fix known security vulnerabilities, no display and handling of sensitive or restricted data, and follows cybersecurity best practices.

Performance

Evaluation is based site-level and overall multisite performance impact. This includes gathering performance metrics and core web vitals, as well as measuring resource usage using tools such as Lighthouse scores, PageSpeed Insights, CodeProfiler, QueryMonitor, GTmetrix and others.

Reliability/Stability

Evaluation based on review of plugin and vendor reliability and stability metrics. These include, code quality, multisite installation support, update frequency, update history, number of downloads, vendor response to user community issues and bugs, as well as vendor support and documentation.

Accessibility

When reviewing a WordPress plugin for accessibility, we evaluate how well it adheres to established Web Content Accessibility Guidelines (WCAG 2.2) and does not introduce accessibility barriers to editors or website visitors. A range of accessibility tools and checkers are employed as well as an underlying accessibility code review

Usability

Evaluation is based on how effectively and efficiently users (both technical and non-technical) can interact with and achieve their goals using the plugin. This would include ease of learning, efficiency of use, proper error handling and prevention, and a UI that is consistent with the WordPress user experience.

Style & Branding

Review that the plugin does not conflict or override CALS or UW-Madison style and branding guidelines. Evaluation includes visual confirmation that the plugin does not introduce non-branded color, style overrides, or settings that negative impact the display or functionality of the CALS or UW Theme.

Request Process

If you would like to request a plugin for your website that you think meets the criteria above, you can contact us via our web support form for us to consider completing an evaluation of the plugin. If it proves to fit broad needs for the CALS multisite platform, and meets the criteria noted above above, we will evaluate it for inclusion. We cannot promise that because a plugin is requested that it will be added to the service offering.

Important Notes:

CALS Web Services reserves the right to restrict or remove plugins at any time if they pose a security or stability risk to the service.
There are a number of plugins categories that we are unable to install on our platform (i.e., e-commerce plugins, page builders, plugins that violate UW data use and privacy, or other compliance policies, plugins that alter core data structures, or functionality of WordPress Core.
Plugins are required to be reviewed against the criteria outlined within this document and are required to go through CALS / WiscWeb version control and deployment process which currently uses GitLab.
Given the difficulty in managing updates for paid plugin licenses that we do not own, we are unable to approve a paid/licensed plugin that is not found within the wordpress.org plugin repository.

Need help with your website?

CALS Web Services is here to ensure you have all the tools you need and understand how to use them. If you ever get stuck, please don’t hesitate to reach out. We’re here to help!