AI-written code, checked on your server before it runs
Every build passes a local security check before it is allowed to run. If an extension still fails, NiroCoder turns it off so the rest of your site keeps working, and shows you what broke.
Local security check
Eight rule classes run on your server before any code is promoted. Nothing is executed during the check.
Blocked builds never reach your site
A failed check shows the file, line and reason, and “Nothing on your site changed”. Fix and rebuild in one click.
Tested before it’s switched on
Activation loads the extension in a throwaway PHP process with a memory and time limit. A fatal, a runaway loop or an out-of-memory crash there never touches your live site.
Turns itself off
Four layers of crash detection mark a failing extension stopped, so one bad feature does not take the site with it.
See what broke
The error, the file and line, and five lines of source either side, with Fix with AI and Undo last update.
Pause all extensions
One switch stops every extension from loading. Your site keeps working without them; resume when ready.
wp-config kill switch
define( 'NIROCODER_DISABLE_EXTENSIONS', true ); stops every extension, even if wp-admin will not load.
Before it runs
Eight rule classes and a hard file budget
Generated files are statically analyzed on your server. Only code that passes is promoted to the live folder; the service’s own review runs too.
- Files: safe paths, allowed types only, ≤ 40 files and ≤ 512 KB each, an ABSPATH guard in every PHP file
- Syntax: php -l when available, PHP’s own parser otherwise, a parse error blocks
- Namespace: each extension in its own namespace, so two never collide
- Denylist: 73 functions (code execution, obfuscation, direct file writes, auth changes…), 10 classes and 11 secret constants
- Includes: only from the extension’s own folder, no URLs or stream wrappers
- Options: no writes to site URL, admin email, roles, active plugins or NiroCoder itself
- Network: no raw sockets or cURL, WordPress’s HTTP API only, with http:// flagged
- Shadowing: a function that shadows a WordPress one and calls itself, the classic AI infinite-recursion bug, is blocked
Before it’s on, and while it runs
A safe test, then four layers of crash detection
Pressing Activate first loads the extension in a throwaway PHP process. Once it is live, extensions load after every regular plugin, each in its own scope. If one fails, NiroCoder works out which one and stops it.
- Safe test: a separate PHP process with only that extension, 128 MB and 25 seconds, if it crashes, activation is refused and your site was never involved
- A try/catch around every extension catches exceptions and errors as it loads
- A shutdown handler catches fatals, including inside hooks, and traces them to the extension by file path
- A probation marker catches what no handler sees on the next request
- A per-request journal catches deaths nothing in PHP sees, like running out of memory or a killed process
- An extension that needs WooCommerce will not activate while WooCommerce is off
Be precise about it
A strong first line of defense, plus your approval
The check reviews code statically; it is not a sandbox. Extensions run with the same permissions as any plugin, so the plan you approve is part of the safety model.
- The check blocks dangerous code, not dangerous intent, read the plan’s “Will change”
- The Guard catches fatals and memory exhaustion, not slow queries or wrong behavior
- On Nginx, deny web access to wp-content/nirocoder/ in your server config (Apache and LiteSpeed are covered by .htaccess)
- Test larger changes on a staging copy first, as you would with any plugin
The details
- Rule classes
- Files, Syntax, Namespace, Denylist, Include, Options, Network, Shadow
- Activation safe test
- A throwaway PHP process, 128 MB, 25 s. A crash refuses activation and leaves the status unchanged
- Denied
- 73 functions in 7 groups · eval() and backticks · 10 classes · 11 secret constants
- File budget
- ≤ 40 files, ≤ 512 KB each; php, css, js, json, txt and md only
- Warnings (not blocking)
- Unprepared database queries, unsanitised request input, computed option names and file paths
- Crash detection
- try/catch · shutdown handler · probation marker · per-request journal
- Auto-stop
- On by default (Settings → Safety). Off still records the error
- Switches
- Pause all extensions · NIROCODER_DISABLE_EXTENSIONS in wp-config.php
- Concurrency
- A per-extension lock, so two admins cannot build, undo or remove the same extension at once
Questions
It can fail like any plugin can, the difference is what happens next. NiroCoder catches the fatal error, marks that extension stopped so the rest of the site keeps working, and shows the error with Fix with AI and Undo last update. If wp-admin itself will not load, NIROCODER_DISABLE_EXTENSIONS in wp-config.php stops every extension.
No. It is a static review of the code before it runs: it blocks known-dangerous functions, file and network access patterns and sensitive option changes. Extensions then run with normal plugin permissions, which is why every build starts from a plan you approve.
Nothing on your site changes. NiroCoder shows each blocked finding with its file, line and reason, and offers Fix and rebuild, which sends the plan back with those findings as instructions.
Not from NiroCoder itself. The alert shows on NiroCoder’s Extensions list and on the extension’s own page, with the error details and the fix and undo buttons. A developer can send an email or other alert from the nirocoder_extension_stopped action.
When you turn an extension on, NiroCoder first loads WordPress with only that extension in a separate PHP process, with a 128 MB memory limit and a 25-second time limit. If it crashes there, it is not turned on and your site is not affected. If your host cannot run the test, activation goes ahead and crash detection is the safety net.
Yes, in Settings → General → Safety. The error is still recorded and shown, but the extension keeps running. Leave it on unless you are debugging.
No extension loads until you resume. Each extension keeps its status, so resuming brings back exactly what was on. Pausing and resuming are recorded in the activity log.
Build with a safety net
Checked before it runs. Turns itself off if it fails. Undo in one click.