PHPackages freezysko/composer-wp-plugin-activator - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Utility & Helpers](/categories/utility) 4. / 5. freezysko/composer-wp-plugin-activator ActiveComposer-plugin[Utility & Helpers](/categories/utility) freezysko/composer-wp-plugin-activator ====================================== Auto-activate Composer-installed WordPress plugins via post-install/post-update hooks. Zero-config; works with Bedrock, WP Packages, WPackagist. v1.0.0(2w ago)01↓100%[1 PRs](https://github.com/freezysko/composer-wp-plugin-activator/pulls)MITPHPPHP ^8.1CI passing Since May 20Pushed 2w agoCompare [ Source](https://github.com/freezysko/composer-wp-plugin-activator)[ Packagist](https://packagist.org/packages/freezysko/composer-wp-plugin-activator)[ Docs](https://github.com/freezysko/composer-wp-plugin-activator)[ RSS](/packages/freezysko-composer-wp-plugin-activator/feed)WikiDiscussions main Synced 1w ago READMEChangelog (2)Dependencies (14)Versions (4)Used By (0) Composer WordPress Plugin Activator =================================== [](#composer-wordpress-plugin-activator) [![CI](https://github.com/freezysko/composer-wp-plugin-activator/actions/workflows/ci.yml/badge.svg)](https://github.com/freezysko/composer-wp-plugin-activator/actions/workflows/ci.yml)[![CodeQL](https://github.com/freezysko/composer-wp-plugin-activator/actions/workflows/codeql.yml/badge.svg)](https://github.com/freezysko/composer-wp-plugin-activator/actions/workflows/codeql.yml)[![PHPStan](https://camo.githubusercontent.com/b6d441ad4fe8332cb16c72aa27f22cc685181dfd74ae34964afc92c6c1146b3c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d6c6576656c2532306d61782d627269676874677265656e2e737667)](phpstan.neon)[![Latest Version](https://camo.githubusercontent.com/f84d6ad1a1d4f6d6206b65d210f4a8f9b849ac7dee8d36304d89af96f372b087/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f667265657a79736b6f2f636f6d706f7365722d77702d706c7567696e2d616374697661746f722e737667)](https://packagist.org/packages/freezysko/composer-wp-plugin-activator)[![Total Downloads](https://camo.githubusercontent.com/4b65a43494d631ae44d821da2d6378e6f28f18d65ea01078c772c68408872943/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f667265657a79736b6f2f636f6d706f7365722d77702d706c7567696e2d616374697661746f722e737667)](https://packagist.org/packages/freezysko/composer-wp-plugin-activator)[![License](https://camo.githubusercontent.com/f4b285f0cd5a729f464f47b3b12015bc7fa34b867deffba388c9ba165cebceef/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f667265657a79736b6f2f636f6d706f7365722d77702d706c7567696e2d616374697661746f722e737667)](LICENSE)[![Conventional Commits](https://camo.githubusercontent.com/90d8aeee02dec6f5ceeb0423b9ba1aea93519cadbfcb13d62770ac6550780d6e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f436f6e76656e74696f6e616c253230436f6d6d6974732d312e302e302d79656c6c6f772e737667)](https://www.conventionalcommits.org) A Composer plugin that auto-activates Composer-installed WordPress plugins via WP-CLI on `composer install` / `composer update` — no `scripts` wiring, no per-request overhead, no MU-plugin tricks. Quick start ----------- [](#quick-start) Require the package: ``` composer require freezysko/composer-wp-plugin-activator ``` Then allow the plugin to run. Composer 2.2+ blocks plugin code unless it is explicitly allowed — **without this entry the package installs but does nothing:** ``` { "config": { "allow-plugins": { "freezysko/composer-wp-plugin-activator": true } } } ``` That's it. The next `composer install` / `composer update` will activate your plugins via WP-CLI. The package self-registers — no `scripts` wiring needed. For ready-to-copy `composer.json` setups see [`examples/`](examples/): [Bedrock](examples/bedrock.md), [vanilla WordPress](examples/vanilla-wp.md), and [custom activation order](examples/custom-priority.md). Requirements ------------ [](#requirements) - PHP 8.1+ - Composer 2.x - WP-CLI available on the machine running Composer Configuration ------------- [](#configuration) All keys are optional. Add an `extra.composer-wp-plugin-activator` section to your `composer.json`: ``` { "extra": { "composer-wp-plugin-activator": { "wp-cli": "wp", "wp-path": null, "plugins": "composer", "priority": [], "skip-when-wp-not-installed": true, "verbose": false, "fail-on-error": false, "allow-root": "auto" } } } ``` KeyTypeDefaultDescription`wp-cli`string`"wp"`Path to the WP-CLI binary.`wp-path`string | null`null`Value for WP-CLI's `--path=`. `null` lets WP-CLI auto-detect via `wp-cli.yml`.`plugins`string | array`"composer"``"composer"`, `"all"`, or an explicit ordered list of slugs. See below.`priority`array`[]`Slugs to activate before the main `plugins` pass (foundational plugins like WooCommerce). See "Plugin activation order".`skip-when-wp-not-installed`bool`true`If `wp core is-installed` is false, exit cleanly. Recommended for fresh installs.`verbose`bool`false`Stream full WP-CLI output even on success.`fail-on-error`bool`false`If true, a WP-CLI failure aborts Composer with a non-zero exit code.`allow-root`bool | string`"auto"``--allow-root` handling. `"auto"` adds it when running as root; `true`/`false` force it on/off.### `plugins` modes [](#plugins-modes) - **`"composer"`** (default) — activates only plugins installed by Composer (packages of type `wordpress-plugin`). Slugs are derived from each package's install directory. Safe and package-scoped: it does not touch manually-dropped or third-party plugins. - **`"all"`** — runs `wp plugin activate --all`, activating every plugin in the plugins directory, Composer-managed or not. Opt-in; remember that activation can run migrations, schedule cron, or call external services. - **array** — explicit, ordered list, e.g. `["woocommerce", "polylang"]`. Activated in order, so foundation plugins can precede dependents. Invalid entries (leading `-`, whitespace, disallowed characters) are skipped with a warning. Entries containing `/` (e.g. `wpackagist-plugin/woocommerce`) are treated as Composer package names and normalized to the part after the last `/` — write the WP slug directly to avoid the warning. **Invalid `plugins` values fail closed.** A typo such as `"plugins": "everthing"`is treated as "activate nothing" with a warning, preventing an unintentional `wp plugin activate --all` from a configuration mistake. ### Plugin activation order [](#plugin-activation-order) WordPress 6.5+ supports `Requires Plugins:` headers and WP-CLI enforces them, but it activates plugins **alphabetically** — so a dependent plugin can fail on its first pass when its dependency hasn't run yet. The package handles this in two layers: 1. **`priority` list (recommended for known blockers).** Slugs listed in `priority` are activated first, in order, before the main `plugins` pass — use it for foundational plugins like WooCommerce that many others extend. See [`examples/custom-priority.md`](examples/custom-priority.md). Invalid or Composer-style (`/`-containing) entries are normalized or skipped with a warning. 2. **Bounded retry loop (safety net).** After the main pass, any pass that activates at least one plugin triggers another, up to five total passes. A pass that activates nothing new stops the loop — remaining failures are real (missing plugin, real error). `priority` is **ignored when `plugins` is an explicit array**, since the array already controls order; a warning is emitted so operators notice. A priority-pass failure does not stop the main pass, but it is surfaced as an error and preserved in the exit code, so `fail-on-error: true` still aborts Composer when a priority slug fails. Bedrock integration ------------------- [](#bedrock-integration) Works zero-config in [Bedrock](https://roots.io/bedrock/) projects — WP-CLI auto-detects the WordPress path, so `wp-path` can stay `null`. See [`examples/bedrock.md`](examples/bedrock.md). Versioning ---------- [](#versioning) This package follows [Semantic Versioning](https://semver.org/). **Public contract.** The public API is the `extra.composer-wp-plugin-activator` configuration schema documented in [Configuration](#configuration) — the keys `wp-cli`, `wp-path`, `plugins`, `priority`, `skip-when-wp-not-installed`, `verbose`, `fail-on-error`, `allow-root` — and the documented activation behavior. The PHP classes are **not** part of the public API: consumers configure the plugin, they do not call its code. - **MAJOR** — a change that can break an existing consumer's `extra`configuration or the documented behavior: a removed or renamed config key, a changed default, or a changed activation outcome. - **MINOR** — new, backward-compatible configuration or behavior. - **PATCH** — bug fixes that do not change the documented contract. A deprecated config key or behavior is kept for at least one MINOR release, emitting a runtime warning, before removal in the next MAJOR. Deprecations and breaking changes are recorded in [`CHANGELOG.md`](CHANGELOG.md). Limitations ----------- [](#limitations) - **Multisite** — network activation is out of scope for v1; plugins are activated site-locally only. - **No plugin installation** — this package only *activates*. Installing plugins is Composer's job (via `composer/installers` + wpackagist). - **No auto-deactivation** — removing a plugin from `composer.json` removes it from disk; WordPress handles activation-state cleanup on the next request. - **No dependency-header parsing** — the package re-runs activation until WordPress's own `Requires Plugins:` checks pass (capped at 5 passes); it does not parse headers or use Composer's dependency graph itself. - **English-locale summary** — the "already active" vs "activated N" summary is parsed from English WP-CLI output. Under a non-English locale the summary may be less precise; activation itself is unaffected. The full list of in-scope and out-of-scope attack classes for v1.0.x is in [`.github/SECURITY-THREAT-MODEL.md`](.github/SECURITY-THREAT-MODEL.md). To report a vulnerability see [`SECURITY.md`](SECURITY.md). Troubleshooting --------------- [](#troubleshooting) - **`wp-cli not found` warning, activation skipped** — the WP-CLI binary check (`wp --version`) failed. Set `wp-cli` to the binary's full path (e.g. `/usr/local/bin/wp`) if `wp` is not on the `PATH` of the process running Composer. - **`WordPress not installed yet` info line, activation skipped** — `wp core is-installed` returned false. This is expected on a fresh build before `wp core install` has run or before the database is provisioned. It is controlled by `skip-when-wp-not-installed` (default `true`); set it to `false` to treat this as an error instead. - **`wp-cli reported an error`, a plugin failed to activate** — set `verbose`to `true` to stream the full WP-CLI output and see the underlying failure (e.g. a genuinely missing `Requires Plugins:` dependency). By default the failure is reported but Composer still succeeds; set `fail-on-error` to `true` to make a WP-CLI failure abort Composer with a non-zero exit code. Contributing ------------ [](#contributing) Contributions are welcome. See [`CONTRIBUTING.md`](CONTRIBUTING.md) for development setup, local checks, the contribution workflow, and an architecture overview. By participating you agree to the [Code of Conduct](CODE_OF_CONDUCT.md). License ------- [](#license) MIT — see [LICENSE](LICENSE). ### Health Score 39 — LowBetter than 84% of packages Maintenance96 Actively maintained with recent releases Popularity2 Limited adoption so far Community8 Small or concentrated contributor base Maturity44 Maturing project, gaining track record Bus Factor1 Top contributor holds 93.4% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 2 Last Release 19d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/70426?v=4)[freezy](/maintainers/freezy)[@freezy](https://github.com/freezy) --- Top Contributors [![freezysko](https://avatars.githubusercontent.com/u/661637?v=4)](https://github.com/freezysko "freezysko (57 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (4 commits)") --- Tags bedrockcomposercomposer-pluginphpwordpresswordpress-pluginwp-cliwpackagistwordpresscomposer-pluginbedrockwp-cliactivationwpackagist ### Code Quality TestsPHPUnit Static AnalysisPHPStan Code StylePHP CS Fixer Type Coverage Yes ### Embed Badge ![Health badge](/badges/freezysko-composer-wp-plugin-activator/health.svg) ``` [![Health](https://phpackages.com/badges/freezysko-composer-wp-plugin-activator/health.svg)](https://phpackages.com/packages/freezysko-composer-wp-plugin-activator) ``` ### Alternatives [roots/bedrock WordPress boilerplate with Composer, easier configuration, and an improved folder structure 6.5k456.5k2](/packages/roots-bedrock)[mnsami/composer-custom-directory-installer A composer plugin, to help install packages of different types in custom paths. 1465.3M59](/packages/mnsami-composer-custom-directory-installer)[tgmpa/tgm-plugin-activation TGM Plugin Activation is a PHP library that allows you to easily require or recommend plugins for your WordPress themes (and plugins). 1.8k227.8k13](/packages/tgmpa-tgm-plugin-activation)[vaimo/composer-patches Applies a patch from a local or remote file to any package that is part of a given composer project. Patches can be defined both on project and on package level. Optional support for patch versioning, sequencing, custom patch applier configuration and patch command for testing/troubleshooting added patches. 3014.5M22](/packages/vaimo-composer-patches)[typisttech/imposter-plugin Composer plugin that wraps all composer vendor packages inside your own namespace. Intended for WordPress plugins. 158258.5k2](/packages/typisttech-imposter-plugin)[automattic/jetpack-autoloader Creates a custom autoloader for a plugin or theme. 545.9M110](/packages/automattic-jetpack-autoloader) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)