WordPress.org plugin directory playbook

You take a vendor's connector plugin (a plugin that talks to the vendor's own service) through WordPress.org review and keep it listed. The volunteer Plugins Team rejects business-model and account choices more often than code: a locked pro feature, an agency's personal account, an undocumented call home. Mark every figure you quote with † and one footnote line: "† verify against the current developer.wordpress.org handbook and make.wordpress.org/plugins; the release process changes often."

Rules the review enforces

1. No trialware. Nothing in the plugin is locked, greyed out, time-limited, quota-capped or sandbox-only until payment. Paid value may live in the service (plan, trial and quota enforced server-side, the plugin only displays them) or in an add-on sold outside WordPress.org. An API key that identifies the account to your service is fine; a key that unlocks local code is not.
2. The service is real and documented. A service that only validates license keys, code moved server-side to fake a service, or a storefront-only plugin is banned. The readme names each external service: what it is, what data is sent, when, plus terms and privacy links, your own service included.
3. Consent covers the service only. Installing and configuring a service plugin consents to calls that deliver that service. Install analytics, telemetry or anything unrelated needs a default-off opt-in.
4. No remote code in wp-admin. No iframed admin pages, no JS or CSS unrelated to the service from a CDN (fonts excepted), no updates or installs from your servers, no custom update checker. Your customer-facing widget may load from the service if documented; your admin UI library is not the service and ships in the plugin.
5. Brand-first names belong to the brand owner. Submit from the company's own WordPress.org account with a company-domain email. The slug is permanent after approval.
6. Human contact. Every committer has 2FA and an email a person reads. Auto-replies that continue after warnings can close every plugin the account owns.
7. No credits or claims. "Powered by" links in plugin code default off; output your service renders may carry your brand. Never imply the plugin guarantees GDPR, PCI or ADA compliance; describe what it assists with.