Plugin is trusted code below plugins/{name}/. plugin.json declare identity, plugin requirements, dashboard pages, navigation, assets, static copy, and permissions; PHP files provide hooks or route implementations.
Installation and activation
The uploader validates the package, extracts to the plugin folder, copies declared assets, and can enforce fixed conventions install.sh with time/output limits. Install can put plugins in disabled state; Install & Activate also check dependencies and enable them. Do not install packages whose sources you do not trust.
Route dashboard
Each page declares relative routes and files that remain in the plugin folder. Core rejects traversal, internal duplication, Core dashboard shadow routes, and collisions between plugins. Routes can use Site Owner guards or plugin permissions; the two cannot be combined on the same route.
Hooks and dependencies
Use add_action/do_action for events and add_filter/apply_filters for value transformation. Namespace names of plugins' functions and hooks. requires.plugins use version constraints; Dependencies must be installed, active, compatible, and loadable. Core refuses deactivation of providers that still require active plugins.
Disable saves plugin files and state but stops active loading. Uninstall/delete can remove files and run plugin consequences; backup and read the documentation first.