1. Plugin first, theme for presentation

Business logic belongs in a plugin (or mu-plugin), not functions.php. Themes switch; plugins are the durable layer. If the feature must survive a redesign, it is plugin territory.

2. Use cases that justify a custom plugin

  • CRM and ERP bridges: map forms, orders, or members to external systems with queues and retries—not fragile Zapier-only paths for core revenue.
  • WooCommerce extensions: custom fees, fulfillment rules, or B2B pricing that is too specific for a generic marketplace extension.
  • Internal workflows: custom post types, meta boxes, or admin lists that match how the team actually works.
  • Headless or hybrid front ends: REST or GraphQL endpoints with explicit permission_callback logic, not anonymous data leaks.

3. Skeleton that scales to a team

Use a prefix or PHP namespace, Composer autoloading if the plugin grows past a few files, and a single bootstrap that registers hooks. Split activation / deactivation (schema, roles, cron events) from runtime. Document options keys and cron schedules in a short README—future you is also a stakeholder.

4. Security and capabilities by default

Every admin form gets nonces and capability checks; every REST route validates current_user_can or application passwords / tokens as appropriate. Sanitize input, escape output, and avoid exposing raw SQL or file paths in errors. For business plugins, audit logs for sensitive actions are part of the feature, not an afterthought.

5. One plugin, one problem—until proven otherwise

The “kitchen sink” custom plugin becomes unmaintainable fast. Prefer small plugins or modules with clear boundaries, or one facade plugin that loads submodules only when dependencies (Woo, Members, etc.) are active. Heavy async work should use Action Scheduler or WP-Cron with idempotent jobs, not long admin requests.

6. Shipping and ownership

Version the plugin like product code: semver, changelogs, and staged deploys. If the client hosts on managed WordPress, confirm allowed outbound calls, PHP version, and object cache before you depend on them. Train someone internal on where settings live and how to disable the integration in an emergency.

Custom WordPress plugins for business are not about showing off hooks—they are about reliable seams between WordPress and how the company actually runs. Build narrow, secure, and documented; the site will outlast the theme.