I write the tutorials on WP Tuts Hub, and I also build and maintain WordPress plugins. The same concerns run through both: who is allowed to do what, where API keys live, and how to handle output from an AI model that you cannot fully trust.
Two of the plugins are free on WordPress.org. Product pages, documentation and support are on wp.zubaer.com.
-
WordPress plugin · AI · Free
ZubFeat AI Featured Image
Generates a featured image from a post title, or title plus excerpt, with your own OpenAI or OpenRouter key. Falls back to a branded template when no AI key is set.
-
WordPress plugin · Security
ZubQuant
Post-quantum encryption and a zero-knowledge vault for WordPress forms, confidential customer submissions, user passwords and admin security logs.
-
WordPress plugin · Pro
Calorie Calculator Pro
Daily calories, macros and goals for health and fitness sites, with email and PDF results, lead capture, editable labels and a one-screen or multi-step layout.
-
WordPress plugin · Free
Calorie Calculator
The free edition: a lighter calorie calculator you can add to any WordPress page with a shortcode or block.
-
Companion Android app · Free
Calorie Calculator for Android
The same calorie, BMI and macro estimates on a phone, with a simple day meal plan. Works offline.
Work with me
-
Custom plugins and integrations
Plugins, WooCommerce extensions and integrations with outside services, built to be maintained after launch.
-
AI features for WordPress
Assistants, content pipelines and LLM integrations with server-side keys, rate limits and a human review step.
-
Code review and security
Reviews of plugin and theme code, including AI-written code, for permission checks, data handling and injection risks.
Related tutorials
If you are building something similar yourself, these tutorials cover the parts that are easiest to get wrong:
- Stop leaking OpenAI keys in WordPress with a REST proxy, for plugins that call an AI API, as ZubFeat does.
- Encrypt WordPress AI plugin API keys at rest with Sodium, for storing provider keys safely.
- Audit plugin REST routes for a missing permission_callback, a quick check worth running before any release.