Title: Patchmark
Author: Clearance Clarence
Published: November 2, 2026
Last modified: November 2, 2026
---
Search plugins
# Patchmark
By [Clearance Clarence](https://profiles.wordpress.org/cccode/)
[Download](https://downloads.wordpress.org/plugin/patchmark.1.0.0.zip)
* [Details](https://wordpress.org/plugins/patchmark/#description)
* [Reviews](https://wordpress.org/plugins/patchmark/#reviews)
* [Installation](https://wordpress.org/plugins/patchmark/#installation)
* [Development](https://wordpress.org/plugins/patchmark/#developers)
[Support](https://wordpress.org/support/plugin/patchmark/)
## Description
When you upload a zip for a plugin that is already installed, WordPress shows a
small table (name, version, author, requirements) and a button to replace it. Patchmark
takes over that screen and turns it into a proper review, with Cancel and Replace
in its top bar. When there are serious findings, Replace takes a second click.
#### Review
Everything worth a second look, most serious first, each linked to the exact file
and line:
* **Header changes**: older version than installed, same version with different
files, a different plugin name or author, a new **Update URI** (future updates
would come from somewhere else), new requirements, missing required plugins,
a renamed main file (the plugin would be deactivated), a changed text domain.
* **Unusual files**: .htaccess and .user.ini, PHP files with odd extensions (.phtml,.
phar, image.jpg.php), PHP in image or font folders, executables and shell scripts,
bundled archives.
* **Risky code** that is new in the upload: eval and decode-and-run, shell commands,
includes and unserialize of request data, long encoded strings, code that creates
users or roles, new outgoing requests and new web addresses.
PHP is read with the tokenizer, so `$db->exec()` or “eval” in a comment is not mistaken
for the real thing, and only code that was not in the installed copy of the same
file is reported.
#### Files
* A folder tree of every added, removed, modified, moved and whitespace-only file,
with line counts.
* Split or unified diffs with syntax highlighting (PHP, JavaScript, TypeScript,
CSS, SCSS, JSON, HTML, YAML, SQL, Markdown and more), word highlights, folded
context you can expand, and an option to ignore whitespace.
* Before and after previews for images.
* Filter by name or status, search inside the changed files, and step through files
with j and k.
* **Download .patch**: a git-style patch of the text changes that `git apply` applies
to the installed copy.
#### Changelog
The entries from readme.txt (or CHANGELOG.md) between the installed and the uploaded
version, plus the Upgrade Notice for the new version. For a downgrade, the entries
you would give up.
#### API changes
Functions, classes, public methods, hooks, REST routes, shortcodes, post types and
blocks the upload adds or removes, plus Composer libraries that are added, removed
or updated. Removed names are what breaks themes, snippets and other plugins that
rely on them.
#### Light
Nothing runs except on the upload screen, and only when the plugin is already installed.
Only files that changed are read. Nothing is stored in the database and nothing
is sent anywhere; leaving the page discards the review.
A clean review is not a guarantee. Only install code from sources you trust.
### Development
The files in build/ are compiled from TypeScript and SCSS but not minified, so you
can read them as they are.
The source code and build setup are on GitHub: https://github.com/ClearanceClarence-
Software/Patchmark
To build it yourself you need Node 20 or newer:
```
npm ci
npm run build
npm run zip makes the same plugin zip that's published here.Credits
```
Patchmark bundles the Bricolage Grotesque font (Copyright 2022 The Bricolage Grotesque
Project Authors) and the Atkinson Hyperlegible Next and Atkinson Hyperlegible Mono
fonts (Copyright 2020-2024 The Atkinson Hyperlegible Next / Mono Project Authors),
all licensed under the SIL Open Font License 1.1. The license texts are in the licenses/
folder. The fonts are served from the plugin folder, not from Google.
Syntax highlighting uses Prism (https://prismjs.com), MIT license, bundled with
the plugin.
## Screenshots
[⌊The review: what changes, most serious first, linked to files and lines.⌉⌊The
review: what changes, most serious first, linked to files and lines.⌉[
The review: what changes, most serious first, linked to files and lines.
[⌊The file browser with a split diff and word highlights.⌉⌊The file browser with
a split diff and word highlights.⌉[
The file browser with a split diff and word highlights.
[⌊Changelog entries between the two versions, with the upgrade notice.⌉⌊Changelog
entries between the two versions, with the upgrade notice.⌉[
Changelog entries between the two versions, with the upgrade notice.
[⌊API changes: removed and added functions, hooks and routes, and bundled libraries.⌉⌊
API changes: removed and added functions, hooks and routes, and bundled libraries
.⌉[
API changes: removed and added functions, hooks and routes, and bundled libraries.
## Installation
1. Install and activate Patchmark.
2. Go to **Plugins › Add New › Upload Plugin** and upload a zip of a plugin you already
have installed.
3. Read the review, then choose **Replace current with uploaded** or **Cancel and
go back** in its top bar.
## FAQ
### Where are the settings?
There are none. The review appears on the upload screen when it has something to
compare.
### Does it work for themes?
Not yet. Plugins only.
### How large a plugin can it handle?
Plugins with up to 20,000 files. A plugin like Formidable Forms (about 1,800 files,
29 MB) is compared in well under a second. Files over 512 KB, and anything past
8 MB of changed text, are compared and checked but their contents are not shown,
to keep the page light.
### Is the code check a malware scanner?
No. It points at changes worth reading. It can’t prove a plugin is safe, and it
reports things that are normal in some plugins (a membership plugin creates users).
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Patchmark” is open source software. The following people have contributed to this
plugin.
Contributors
* [ Clearance Clarence ](https://profiles.wordpress.org/cccode/)
[Translate “Patchmark” into your language.](https://translate.wordpress.org/projects/wp-plugins/patchmark)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/patchmark/), check
out the [SVN repository](https://plugins.svn.wordpress.org/patchmark/), or subscribe
to the [development log](https://plugins.trac.wordpress.org/log/patchmark/) by [RSS](https://plugins.trac.wordpress.org/log/patchmark/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.0.0
* First release: takes over the “already installed” upload screen with a review,
a file browser with split and unified diffs, the changelog in between and API
changes.
## Meta
* Version **1.0.0**
* Last updated **7 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.6 or higher **
* Tested up to **7.1.4**
* PHP version ** 7.4 or higher **
* Tags
* [changelog](https://wordpress.org/plugins/tags/changelog/)[diff](https://wordpress.org/plugins/tags/diff/)
[plugin update](https://wordpress.org/plugins/tags/plugin-update/)[security](https://wordpress.org/plugins/tags/security/)
* [Advanced View](https://wordpress.org/plugins/patchmark/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/patchmark/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/patchmark/reviews/)
## Contributors
* [ Clearance Clarence ](https://profiles.wordpress.org/cccode/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/patchmark/)