Open to senior & lead WordPress roles
Lead WordPress Engineer · Plugin Security
I build and secure WordPress plugins used on 230,000+ websites.
Seven years of shipping Elementor add-ons and WordPress plugins at scale — with a focus on security, performance and getting through WordPress.org review.
Bogura, Bangladesh · Sigmative LLC
echo '<div class="' . $settings['class'] . '">';
printf( '<div class="%s">', esc_attr( $settings['class'] ) );
- Active installs across plugins I lead
- 230K+
- Years building WordPress products
- 7+
- Plugins in the portfolio I lead
- 10+
- Element Pack rating · 284 reviews
- 4.7★
About
At this scale, there is no such thing as a small bug.
Most WordPress plugins fail in one of three ways: they slow the site down, they ship a security hole, or they get pulled from WordPress.org. I've spent seven years preventing all three.
When a plugin runs on hundreds of thousands of sites, one unescaped attribute becomes an XSS on every one of them. One bloated script slows every visitor. One review failure can take a product out of the directory overnight.
As Security Specialist & Lead Engineer at Sigmative / BdThemes, I lead the team behind Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, Ultimate Store Kit, ZoloBlocks, Sigma Forms, Spin Wheel and more.
What I keep out of production
- Unescaped output and string-built HTML
- Assets loaded on pages that never use them
- Locked features that fail WordPress.org review
- Releases that break the free + Pro combination
Plugin security
Triage researcher reports, patch XSS and injection paths, harden bundled libraries, and ship coordinated fixes in free and Pro editions.
- XSS hardening
- Secure code review
- Vulnerability management
Performance
Load assets only where they're used, remove duplicate libraries, and prove every change with Lighthouse under heavy CPU throttling.
- Core Web Vitals
- Lighthouse
- Asset loading
WordPress.org compliance
Keep products passing plugin review: no locked features, sanitized input, escaped output, prefixed code and documented external services.
- WPCS
- Plugin Check
- Guidelines
Release management
Ship free + Pro editions in lockstep so no combination of versions breaks a customer's site.
- Hooks & filters
- Back-compat
- Versioning
Product engineering
Elementor widgets, Gutenberg blocks and React admin dashboards — built to stay identical in the editor and on the live site.
- Elementor
- Gutenberg
- React
Plugins I lead
Live on WordPress.org, running on real sites.
Element Pack
A large Elementor add-on library — widgets, extensions and templates for building any page.
100,000+
active installs
4.7★ · 284 reviews
Prime Slider
Hero sliders and showcase layouts for Elementor with a React admin dashboard.
100,000+
active installs
4.5★ · 82 reviews
Ultimate Post Kit
Blog and magazine post layouts, grids and carousels for Elementor.
30,000+
active installs
4.8★ · 58 reviews
Pixel Gallery
Image gallery and portfolio widgets with ready-made layout kits.
4,000+
active installs
4.8★
Ultimate Store Kit
WooCommerce product grids, carousels and store layouts for Elementor.
3,000+
active installs
4.5★
ZoloBlocks
A Gutenberg block collection for building full pages in the block editor.
1,000+
active installs
5.0★
Install counts and ratings from WordPress.org. Plus Sigma Forms, Spin Wheel, One Accessibility and more.
Case study · Element Pack 10
We deleted up to 39% of Element Pack's CSS. Nobody noticed.
Element Pack used to do what most plugins do: load its assets everywhere, just in case. In version 10 we flipped that — assets load only on pages that use a widget, duplicate library loads are gone, and every change was benchmarked with Lighthouse under heavy CPU throttling.
A plugin's real cost isn't on the pages that use it. It's on the hundreds that don't.
Before vs. after, on benchmarked pages
CSS shipped
−32% to −39%
Total Blocking Time
−60%
Measured with Lighthouse under heavy CPU throttling, multiple runs per page.
Experience
Seven years, one team, a lot of shipped code.
Credentials
WordPress Plugin Development
weDevs Academy · 2024
Diploma in Engineering, Electrical
Bogura Polytechnic Institute · 2013 — 2017
Aug 2026 — Present
Security Specialist & Lead Engineer
Sigmative LLC
- Hardened the plugin portfolio against stored XSS by replacing string-built markup with safe DOM construction and patching the bundled UIkit library.
- Triage security reports from external researchers and take each from reproduction to a coordinated fix in free and Pro editions.
- Audit products against WordPress.org guidelines to keep every plugin compliant and listed.
Sep 2025 — Present
WordPress Team Lead
Sigmative LLC
- Lead development of 10+ WordPress plugins with 230,000+ combined active installs.
- Cut CSS by up to 39% and Total Blocking Time by 60% in Element Pack 10.
- Built a React admin dashboard and per-page asset combining for Prime Slider.
- Own release management for paired free/Pro plugins.
Apr 2019 — Sep 2025
WordPress Plugin Developer
BdThemes Limited
- Built Elementor widgets and features for Element Pack and Prime Slider — each now active on 100,000+ sites.
- Developed features for Ultimate Post Kit and Pixel Gallery.
Insights
Notes on building plugins people can trust.
- SecurityRead on LinkedIn
One unescaped attribute = one XSS on every site that runs your plugin.
What I check first in every Elementor widget security review.
- SecurityRead on LinkedIn
innerHTML is not a template engine.
Why boring DOM APIs are the secure way to build plugin UI.
- ComplianceRead on LinkedIn
Want to stay in the WordPress plugin directory? Never lock free features.
What gets plugins rejected — and what the Plugins Team wants instead.
- PerformanceRead on LinkedIn
If your Lighthouse score is perfect on your MacBook, you're testing wrong.
How I benchmark plugin performance like the slowest user.
- ReleasesRead on LinkedIn
Releasing a free plugin and its Pro add-on is like changing an engine mid-flight.
Rules for keeping every version combination working.
- ElementorRead on LinkedIn
“It works in the Elementor editor” doesn't mean it works on the live site.
Editor preview vs. frontend: what I always test separately.
Tools I work with every day
- PHP
- JavaScript
- TypeScript
- React
- Elementor API
- Gutenberg
- WordPress REST API
- WooCommerce
- MySQL
- WP-CLI
- WPCS / Plugin Check
- Lighthouse
- Git
Contact
Building or securing a WordPress product? Let's talk.
I'm open to senior and lead WordPress roles — especially plugin security. The fastest way to reach me is a message on LinkedIn.