How Plugins Work

If a theme is arrangement, a plugin is capability. When a site needs something new — a word counter, an SEO panel, a custom block — a plugin provides it.

The split that keeps you safe

Most themes are data — you can install one from a stranger without a second thought — and the rare theme that carries its own code is clearly marked before you install it (see How Themes Work for the tiers). Plugins are the trusted plane where capability always lives. Keeping those planes separate is the whole security model: you add a plugin the way you'd add a dependency — deliberately, with its permissions shown up front.

• Plugins declare exactly what they touch: content fields, a few typed hooks, and admin surfaces.

• A plugin can extend a post with its own data, but it never runs raw migrations against your database.

• Capabilities are permission-scoped, so the blast radius is always visible.

Themes and plugins together

A good-looking theme sometimes needs a capability its components don't cover. Rather than making you download a theme and then go hunt for the right plugin, a theme bundle can declare the plugins it needs and install them in one consented step. The theme stays code-free; the behavior lives in the plugin.

Plugins power it; themes arrange it.