WP Manifestindependent plugin directory

Install

Download carbon-txt.zip From the 0.5 release on GitHub, Oct 1, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/thegreenwebfoundation/wp-carbon-txt-plugin/releases/download/0.5/carbon-txt.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

A user-friendly WordPress plugin to publish a carbon.txt file with your organisation's sustainability disclosures.

carbon.txt is a single, recognisable location on any web domain (https://your-site.com/carbon.txt) for public, machine-readable sustainability data relating to that organisation.

Features

  • Declare one or more organisational disclosures, each with a document type and a URL.

  • Point a disclosure at a URL in three ways:

    • Paste any URL directly.
    • Pick an existing published page with a searchable autocomplete.
    • Choose a file from the media library — the picker shows every file, so use its built-in search to find the one you want.

    Whichever you pick, revisiting a disclosure later reopens it the same way — it remembers the selected page or file, not just the resulting URL.

  • Optional title, valid-until date, and domain (for organisations publishing disclosures that apply to more than one domain) per disclosure.

  • Live preview of the exact carbon.txt that will be served.

  • Detects a carbon.txt file already on your server, at either the domain root or the well-known location (e.g. created with the carbontxt.org builder and uploaded manually), warns that your web server may still serve that file directly regardless of these settings, and offers to:

    • Import any disclosures it can parse out of that file.
    • Permanently delete it once its disclosures have been imported and your settings here have been saved, so this plugin's own output is what gets served.
  • Keep a copy of your disclosures — copy to clipboard or download as a file — since removing the plugin also removes its saved settings. Offered proactively when you deactivate it from the Plugins screen, and always available from a collapsed section on the settings screen.

  • Add your Green Web Foundation API key in Settings — the first step toward validating your carbon.txt against their hosted validator, coming in an upcoming release.

  • Detects a DNS-based delegation record (a carbon-txt-location TXT record, per carbontxt.org/faq) on your domain, and warns that it takes priority over any file this plugin generates.

  • The file is generated on request from your saved settings and cached, so there is no physical file to manage and it survives deploys.

  • Served at the site root even with plain permalinks.

Built with modern, native WordPress tooling: the settings screen is a React app using @wordpress/components, the setting is stored through the core REST settings endpoint (no custom REST controller for that part), and the file picker uses the classic wp.media() frame rather than pulling in @wordpress/block-editor as a dependency.

The output follows the carbon.txt v0.5 syntax.

Installation

From a release: download the plugin zip, then upload it via Plugins → Add New → Upload Plugin in wp-admin.

From source: clone the repository into wp-content/plugins/, then build the admin app (the compiled build/ directory is not committed):

npm install
npm run build

Activate WP Carbon.txt, then go to Settings → Carbon.txt to add your disclosures.

Development

Requirements: Node.js and PHP with Composer.

npm install            # JS dependencies
composer install       # PHP dev tooling (PHPCS / WPCS)

npm run start          # rebuild the admin app on change
npm run build          # production build

npm run lint:js        # lint JavaScript
composer run lint      # lint PHP against WordPress standards
composer run lint:fix  # auto-fix PHP where possible

Translations

Source strings live in PHP and src/index.js. To regenerate the catalog and compile a locale (Spanish shown):

wp i18n make-pot . languages/wp-carbon-txt-plugin.pot --exclude=build,node_modules,vendor
wp i18n make-mo languages/wp-carbon-txt-plugin-es_ES.po languages/
wp i18n make-json languages/wp-carbon-txt-plugin-es_ES.po --no-purge

The JavaScript catalog is named after the script handle (wp-carbon-txt-plugin-es_ES-wp-carbon-txt-admin.json) so WordPress loads it without depending on a source-path hash.

Contributing

This plugin is developed in the open and contributions are welcome. Please open an issue or pull request on GitHub. Run the linters above before submitting.

License

GPL-2.0-or-later.

Releases

5 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
0.5 latest
Oct 1, 2026 24d ago
carbon-txt.zip
1
Sep 16, 2026 1mo ago
wp-carbon-txt-plugin.zip
3
0.3
Aug 6, 2026 2mo ago
wp-carbon-txt-plugin.zip
3
Jul 28, 2026 2mo ago
wp-carbon-txt-plugin-0.2.0.zip
1
Jul 15, 2026 3mo ago
wp-carbon-txt-plugin-0.1.0.zip
4
B grade

Security

WP Carbon.txt 0.5 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.5
Findings
1
Worst severity
medium
Content hash
d114a7b5eda6389459dcfb97…

Findings

  • medium Hardcoded Green Web Foundation API key in source

    hardcoded_credentials

    Api_Client defines a shared X-Api-Key constant in cleartext. Anyone with the plugin package can reuse the key against the GWF carbon.txt validation API. Authors document this as an intentional tradeoff, but it remains a hardcoded credential that can be harvested for API abuse or revocation pressure.

    includes/class-api-client.php:30-31

    Recommendation

    Proxy validation through a server you control, or provision per-site keys that are not shipped in the public repository. Rotate the exposed key.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.