CodeForge | Code Editor, Snapshots & Git Deploy for WordPress

CodeForge | A Code Editor for Themes & Plugins with Syntax Checks, Snapshots, Git Deploy and Snippets

CodeForge replaces the built-in theme and plugin editors with Monaco and makes editing a live site safe: PHP is syntax-checked before it is written, every change is snapshotted with a diff and a one-click rollback, and core files are out of reach. Deploy from git with signed webhooks, work on a staging copy and push it live, run isolated snippets, and use an allow-listed WP-CLI runner — all logged.

Key Features

• Monaco, the editor inside VS Code, bundled: tabs, PHP / JavaScript / CSS / HTML / JSON / Markdown highlighting, language services, find in files across themes and plugins, a lazy file tree with create / rename / delete / upload, image preview
• Every PHP save runs php -l first (or the PHP parser when there is no CLI): a file with a syntax error never lands, and the error line is marked in the editor
• A snapshot before every save, rename, delete, upload, rollback and push; one-click rollback; unified and side-by-side diffs; retention per file and by age
• A stale-write guard: when a file changed on disk since it was opened, the save is refused instead of overwriting
• Git: clone into a theme or plugin folder (public, HTTPS token or SSH deploy key), pull, list and switch branches, status and log; a webhook per repository verifying GitHub / Gitea signatures or the GitLab token; email on deploy
• Staging: copy a theme or plugin to …-staging, edit there, see the changes, push to live — PHP linted, every overwritten or removed live file snapshotted; preview any theme in your own browser without switching the site
• Only wp-content/themes, plugins and mu-plugins are reachable; wp-config.php, .htaccess and similar never; symlinks not followed; protected paths of your own that need an unlock per session; CodeForge cannot edit itself
• DISALLOW_FILE_EDIT / DISALLOW_FILE_MODS honoured: read-only until an administrator allows edits, and the override is logged
• Snippets: PHP (one isolated mu-plugin loader that switches off a snippet that throws or fatals), CSS and JS with scope and order, syntax-checked before enabling, a one-hour safe mode
• An opt-in WP-CLI runner (argv, no shell, an allow-list of read-mostly commands, time-limited, logged); an activity log; REST codeforge/v1 and wp codeforge for scripts; Site Health check

What Happens When You Press Save

1. The path is checked: only themes, plugins and mu-plugins, never wp-config.php or a symlink, unlocked if protected
2. The file on disk is compared with the version you opened; if it changed, nothing is overwritten
3. PHP is linted; a syntax error stops the save and marks the line
4. The current file is snapshotted, then the new content is written and the save is logged

Installation

1. Download the zip from your Library
2. In wp-admin go to Plugins › Add New › Upload Plugin, choose the zip and activate it
3. A new menu entry appears in the admin sidebar; open it
4. If your wp-config sets DISALLOW_FILE_EDIT, decide under Settings whether CodeForge may edit anyway; add a git token or deploy key and a webhook secret if you deploy from a repository

Requirements

• WordPress 6.0 or newer (tested up to 7.0)
• PHP 8.0 or newer
• proc_open for php -l, git and WP-CLI (the PHP parser checks syntax otherwise)
• Optional: git and WP-CLI on the server

What You Get

• CodeForge 1.0.0 for WordPress (codeforge-1.0.0.zip)
• Full, readable PHP and JavaScript source, no obfuscation
• Updates for the term of your licence
• Monaco Editor (MIT) bundled, so the editor never loads from a CDN

Works With

Part of the Alpha WordPress line, built with one admin kit; DBDoctor covers the database side: DBDoctor, ServerPulse, SecureShield, DiagramBlock, LicenseGuard, CodeSell.

The screenshots show the plugin on our demo site with sample data.