How Riff is built

Your music should outlast the software that plays it. Riff is built on what WordPress already has, is tested on every change, and comes with written commitments about how it will be maintained.

Built on WordPress

Riff plays the Audio, Video and Playlist blocks that ship with WordPress, and reads track details from the Media Library. It adds no post types, no settings screen and no database tables. The only things it stores are a few fields on media items, such as a track's artwork and its video version. If you turn it off, your posts still play in the browser's own player.

It calls no outside services. There is no account, no tracking and no CDN, and the fonts ship inside the plugin. Your music and your listeners' visits stay on your server.

Tested on every change

Every pull request that changes code runs the full suite, and it can't merge until the suite passes. A scheduled run every Monday repeats it against the current WordPress release, so a change in core is caught even when Riff hasn't changed.

• PHP and WordPressThe WordPress test suite on PHP 8.1 with WordPress 7.0 (the oldest supported), PHP 8.4 with the current release, a multisite network on PHP 8.3, and WordPress trunk.
• In a browserPlaywright plays real tracks in Chromium at desktop width and at an iPhone's size, and runs a smoke pass in WebKit, the engine under Safari. Lock-screen and background playback are checked by hand on a real iPhone.
• Accessibilityaxe checks Now Playing for accessibility problems, and the tests play, pause and seek from the keyboard.
• StandardsWordPress Coding Standards, ESLint, stylelint, a spell check, and Plugin Check, the tool the WordPress.org plugin team uses to review plugins.
• Try any changeEach pull request gets its own WordPress Playground link, so anyone can try the change before it merges.

Documentation that matches the code

The developer reference is generated from the plugin's source. That covers every hook with the line it fires on, the JavaScript API, the REST routes, the CSS custom properties, and the browser features the player uses. A commit that changes the code without updating the reference is rejected, both before the commit and again in CI, so the reference always matches the release you download.

What we commit to

• WordPressThe current release and the one before it. Today that is 7.1 and 7.0.
• PHP8.1 or newer, tested up to the newest release.
• Raising the minimumOnly in a new minor or major version, named in the release notes, and only once the test suite runs on the new minimum.
• Public APIEvery public hook, REST field and route, the track schema and the public CSS custom properties keep their names and shapes within a major version. Anything that has to go is deprecated with a notice for at least one release first, and removed only in the next major version.
• SecurityReports are acknowledged within 72 hours and fixed in a release within 14 days, sooner if the issue is being exploited. See the security policy.
• DependenciesDevelopment dependencies are updated monthly, and security updates are applied as soon as an advisory is published. The plugin itself has no runtime dependencies.
• LicenseGPL, version 2 or later, like WordPress. The code stays free to use, change and pass on.

Every release

Releases are cut from the pull request titles, so every change appears in the changelog in the words it was merged with. Each version is a tagged release on GitHub with its zip attached.

Get help

Ask a question or report a bug in GitHub issues. Report a security problem privately, through the security advisory form.