Proposal: Add Feature To Ignore Specific Checks Using Comments

[kofimokome]

The plugin check plugin is a great tool. It has helped developers like me make their code compliant with the WordPress guidelines. However, some errors and warnings detected by this tool fall under the false positive category.

Similar toos like PHP Mess Detector and PHPStan have a way of supressing errors, using comments like

$test = new Test();

// @phpstan-ignore-next-line
$test->magic_property = 'magic value';

for PHPStan
or

/**
* @SuppressWarnings(PHPMD.UnusedFormalParameter)
*/
function test( $a , $b, $c ) {
    ...
}

for PHP Mess Detector

Proposal

I would be great if there is a way to supress the errors and warnings the developer thinks are false positives from showing as these could sometimes overcrowd the results page, making it difficult to spot other errors. Supressing this errors will enable the developer to focus on solving the most pertinent issues as these errors will be hidden from the results page.

I am proposing adding a feature to hide some errors and warnings.
For example

public function check_nonce() {
    ...
}

/**
* @PluginCheckSuppress(WordPress.Security.NonceVerification.Recommended)
*/
function some_function_here() {
    // Already checked for the nonce in the check_nonce() function
    // codes here ...
}

Please let me know what you think.

[davidperezgar]

Thanks for taking the time to write such a detailed proposal, and for the kind words about Plugin Check — it’s great to hear it’s been useful 👍

False positives are a real and known challenge in any static analysis tool, and we agree that excessive noise can make it harder to focus on the most relevant issues. That said, allowing suppression of checks via inline comments (similar to PHPStan or PHPMD) is problematic in the context of Plugin Check.

The main concern is trust and safety. Plugin Check is used not only by developers locally, but also as part of automated and semi-automated review workflows. If checks could be disabled purely via comments in code, it would be trivial to bypass important security or guideline-related checks without any external visibility. In other words, the tool could no longer reliably analyze code just because a comment says “ignore this”, which is dangerous in a plugin review context.

There’s also an important difference in scope:
Tools like PHPStan or PHPMD are developer-controlled, local static analysis tools. Plugin Check, on the other hand, is designed to reflect WordPress.org expectations and reviewer concerns. From that perspective, a warning being “intentionally ignored” by the author doesn’t necessarily mean it should be hidden or suppressed from the results.

That said, the underlying problem you’re describing is valid, and we’re open to exploring safer alternatives, for example:

• Improving rule accuracy to reduce false positives.
• Enhancing rule messages to better explain why something is flagged and when it may be acceptable.
• Exploring suppression mechanisms that are explicit, reviewable, and not embedded in executable code (for example, config-based approaches or scoped tooling options), though this would require careful design.

If you’re encountering specific rules that consistently produce false positives, concrete examples are especially helpful — they allow us to improve the checks themselves rather than masking the result.

Thanks again for the thoughtful proposal and for contributing to the discussion.