## Project Overview

J.T. Gray publishes WordPress plugins under the handle [JTZL](https://profiles.wordpress.org/jtzl/#content-plugins) on WordPress.org. It isn't client work in the usual sense — it's a product line built on a simple premise: make useful software and let people have it for free. We built and launched five of them:

- **[In-Browser Cache](https://wordpress.org/plugins/in-browser-cache/)** — client-side caching via Service Workers, with CDN awareness.
- **[JTZL's Bot Maze](https://wordpress.org/plugins/jtzl-bot-maze/)** — AI crawler defense through invisible trap links.
- **[SwipeComic](https://wordpress.org/plugins/swipecomic/)** — a mobile-first comic reader for webcomic creators.
- **[JTZL's Dark Mode](https://wordpress.org/plugins/jtzls-dark-mode/)** — automatic dark mode from OS preference, zero configuration.
- **[Chat for WebIRC](https://wordpress.org/plugins/chat-webirc/)** — a lightweight embedded IRC client.

Each solves a genuinely different problem. What they share is a standard: safe defaults, modern PHP, no framework bloat, and a configuration surface small enough that most site owners never open a settings screen.

## Scope

- Took each plugin from architecture through public release, including the WordPress.org submission and review process.
- Wrote the readme, handled licensing and asset requirements, and resolved review feedback for each submission.
- Maintained the plugins after launch with version updates and compatibility testing against new WordPress releases.

## Challenge

- **Five domains, one standard**: Service Workers, bot detection, touch-based media viewing, theme-agnostic CSS, and WebSocket networking each demand real depth. None of them share much code, so consistency had to come from discipline rather than a shared framework.
- **Review is the gate**: WordPress.org review checks sanitization, escaping, licensing, and readme standards on every submission. Getting through it is a design constraint, not a formality at the end.
- **Unknown install base**: a public plugin runs on themes and hosts we will never see. It has to be safe and predictable by default.

## Constraints & Context

- Public distribution rules out "it works on our setup" as a standard. Every default has to be the safe one.
- Giving the software away raises the bar rather than lowering it. There's no onboarding call, no scoping document, and no support contract to catch what a bad default gets wrong — the plugin either works on a stranger's site or it doesn't.
- We chose modern PHP baselines (8.1 and 8.2) deliberately. Dropping legacy compatibility bought room for cleaner architecture, at the cost of some older installs.
- WordPress ships both block and classic themes, which behave differently enough that theming work needed two strategies rather than one.

## Solution

We treated the five plugins as five separate engineering problems held to one shared standard, rather than as variations on a template.

**In-Browser Cache** moves caching to where most WordPress plugins don't go: the browser. A Service Worker caches static assets client-side and applies different strategies per content type — cache-first for JS, CSS, images, and fonts; network-first for HTML; network-only for API routes. It recognizes major CDN providers by domain patterns, headers, and heuristics without configuration, monitors CDN health, and falls back when a CDN misbehaves. A dashboard reports cache performance separately for CDN and origin assets, so the impact is visible rather than assumed.

**JTZL's Bot Maze** answers AI scrapers with patience instead of blocklists. Invisible trap links are injected into real pages — hidden from humans and from search engines. A bot that follows every link enters a maze of realistic-looking fake pages, generated lazily so the maze expands only as far as something walks it. Each trap visit adds suspicion points, with bonuses for deeper traversal; past a configurable threshold the visitor is blocked outright, served decoys, or slowed with a deliberate tarpit delay. Known crawlers like Googlebot are verified by reverse DNS and exempted, and trap paths are declared in robots.txt so honest crawlers are told to stay out.

**SwipeComic** gives webcomic creators a publishing workflow rather than a gallery shortcode. Episodes are a custom post type organized by a series taxonomy, producing clean URLs like `/series-name/episode-name/`. Reading is built on PhotoSwipe 5 with swipe, pinch-to-zoom, drag-to-pan, and keyboard navigation, with automatic transitions at episode boundaries. On the admin side, drag-and-drop handles both gallery ordering and episode ordering within a series, and image handling preserves originals while generating only the thumbnails actually needed.

**JTZL's Dark Mode** does one thing with no settings page. It reads the visitor's OS preference through the `prefers-color-scheme` media query and applies dark styling — client-side, with no JavaScript and no server-side processing, so nothing about the visitor is collected. Block themes are handled through CSS variables and classic themes through filter inversion, and media is preserved so images and embeds don't get inverted along with the page. Developers can override colors or disable it per page through filter hooks.

**Chat for WebIRC** embeds a real IRC client through a shortcode, written in vanilla TypeScript with no framework. The security posture is the design: WSS connections only, a strict host:port allow-list, input sanitization, proper output escaping, and an optional CSP `connect-src` helper that stays off by default. It supports IRCv3 subprotocols and an optional WebIRC gateway, implements 30+ slash commands, persists nicknames for logged-in WordPress users, and adapts from an overlay sidebar on mobile to side-by-side on desktop.

## Results

Five plugins built, reviewed, and published on WordPress.org. The work continued past launch: In-Browser Cache has been maintained through its 2.x line and Bot Maze through 1.3.0, with each plugin retested as new WordPress versions ship — Bot Maze and Chat for WebIRC currently against WordPress 7.0. JTZL's Dark Mode ships an interactive WordPress Playground demo, so anyone can try it in a browser without installing anything.