Open to remote full-stack, WordPress and backend roles
Milan Chaudhary
Full-Stack Engineer · WordPress, React, Python · Remote
150,000+ active installs · AI integration and infrastructure
I build WordPress plugins and Gutenberg blocks, and the Python services behind them. Four years of it now: PHP and React inside the plugins, Python, Postgres and Redis on the servers I run. Last year I built the service behind Everest Forms' AI form builder and put it into production.
- Active installs
150,000+
Active installs
Across the plugins I work on, per WordPress.org
- Products released
8
Products released
Form builders, memberships, blocks, email
- Average rating
97/100
Average rating
1,228 reviews, weighted per plugin
- Years working
4+ yrs
Years working
PHP, Python, TypeScript, since July 2022
About
Scale & reach
150,000+ sites run a feature I shipped. Everest Forms 90,000, User Registration 50,000.
AI backend
Built and deployed the Python service behind Everest Forms' AI form builder.
Payment systems
Four gateways in two products: PayPal, Stripe, Mollie and Authorize.Net.
Security hardening
40 fixes across nine plugins, from unauthenticated privilege escalation to stored XSS.
DevOps & infrastructure
Linux and Docker in production, with Postgres, Redis and Nginx underneath.
Blocks & the editor
Gutenberg blocks in React, Elementor widgets and two WooCommerce extensions.
I'm a full-stack engineer based in Nepal. I build WordPress plugins at ThemeGrill, the kind of thing people install once and then forget about, so most of what I write has to keep working for years on sites I will never see.
I joined in January 2023 as a plugin intern and stayed. Since then I have shipped features in Everest Forms and User Registration, built SmartSMTP out through its first releases, and worked on blocks in BlockArt and Magazine Blocks.
Most of my time goes on the money path and the security side. Money and accounts are the two things people cannot forgive you for getting wrong.
Last year I moved further down the stack: Python, Postgres, Redis and Docker in production rather than just read about. That has become the part of the job I like most, and it is the work I am looking for next.
- Experience
- 4+ years, since July 2022
- Currently
- Software Engineer at ThemeGrill Pvt Ltd
- Focus
- WordPress products · block editor · backend platform
- Core stack
- PHP · Python · TypeScript · React · Docker
- Based in
- Nepal · remote-friendly, UTC+5:45
- Open to
- Full-stack, WordPress engineering, backend and Python roles
Projects
User Registration & Membership
50,000+ installs, rated 96/100 by 828 people
Registration, login and paid memberships for WordPress: a builder for sign-up fields and roles, content restriction, membership plans, and payments through Stripe, PayPal, Mollie, Authorize.Net or bank transfer.
Most of my work here is on the money path. Every gateway has its own webhooks, retries and quirks, and when one fails quietly somebody has paid and not been given what they paid for, or has been charged twice. That is the part I look after.
My part
Moved PayPal onto its REST API with webhooks and stricter IPN checks, fixed Stripe charging the wrong currency when a plan had no local price, stopped Mollie retries charging twice, and added signature checks and a retry flow to Authorize.Net. I also built the content drip module and the membership upgrade flow. On the security side I patched unauthenticated privilege escalation and user deletion, arbitrary shortcode execution through user-controlled smart tags, a PayPal flaw that let an attacker mark a pending payment as completed without paying, a forged gateway on free memberships, and an open redirect after login. 268 commits across core and pro
- WordPress
- PHP
- React
- Payments
- Show more about Everest FormsShow less about Everest Forms
Everest Forms
90,000 installs · 98/100 rating
A drag-and-drop form builder with payments, quizzes and add-ons.
A whole pro tier of add-ons hangs off it, and forms people built years ago still have to open and submit correctly, so a lot of the work is in not breaking them.
Its newest feature builds a whole form from a sentence describing what you need. That part runs through a service I designed and built: the plugin sends the request to us, we check the site's licence and its limits, ask the model, and make sure the answer is a valid form before the plugin touches it. No API key is ever shipped inside the plugin.
My part
The AI form builder end to end: the gateway in Python and FastAPI with Postgres and Redis on Docker, the prompt setup, and the WordPress side that calls it. Before that, the divider field and multiple-select support, styling for the lookup field, range slider and single-item options in calculations, and 17 security fixes: blocking an unsafe unserialize call on old PHP, nonce verification across forms on one page, sanitisation and escaping, entry permissions and file-upload capability checks. 492 commits across the free and pro plugins
- WordPress
- PHP
- React
- Python
AI gateway is my employer's
- Show more about SmartSMTPShow less about SmartSMTP
SmartSMTP
2,000 installs · 303 of 331 commits
Email sending for WordPress that tells you when it fails.
One main SMTP connection with a backup behind it, setup for the common providers, a test email you can send before anything is configured, and a log of what actually went out.
My part
I built most of this one, from the early versions through its first public releases: the main and fallback connections, provider setup, test mail, attachment handling, the delivery log, the hand-off from User Registration, and a stored XSS fix in the mail log viewer
- WordPress
- PHP
- React
- Show more about Custom Code Snippets ManagerShow less about Custom Code Snippets Manager
Custom Code Snippets Manager
My own plugin · 171 of 171 commits
Runs PHP, JavaScript, CSS or HTML snippets without editing theme files.
It runs on any site without touching a theme file. There is a proper code editor, it checks the syntax on both the server and in the browser, lets you choose where each snippet runs, and imports and exports as JSON. If a PHP snippet throws a fatal error it is caught and switched off, so one bad snippet cannot take the site down.
My part
All of it: the idea, the structure, the admin screens, the safety model and the build setup
- WordPress
- PHP
- TypeScript
- CodeMirror
Not yet in the plugin directory
- Show more about Turbo SubdomainsShow less about Turbo Subdomains
Turbo Subdomains
Commercial WordPress plugin, 18 commits mine
A plugin for running content campaigns across a large set of subdomains.
I came in for a run of features in early 2026: live search through a self-hosted SearXNG instance, AI featured images that print the article title onto the image and embed IPTC metadata, bulk category editing and campaign exports moved into background jobs, CSV export for selected subdomains, iframe post scheduling, and a database refactor that added the indexes the campaign tables were missing.
My part
The search integration, the AI image pipeline, the background job and export work, and the database indexing refactor
- WordPress
- PHP
- AI
- SearXNG
Private repo, commercial plugin
- Show more about BlockArt BlocksShow less about BlockArt Blocks
BlockArt Blocks
10,000+ installs · 98/100 rating
A library of Gutenberg blocks with ready-made sections and templates.
Every setting has to keep rendering the same way on pages built long before the current version.
My part
Fixed a vulnerability in the counter block, and made the colour picker offer the theme's own palette
- WordPress
- React
- Gutenberg
- PHP
- Show more about Magazine BlocksShow less about Magazine Blocks
Magazine Blocks
6,000 installs · 98/100 rating
Blocks for news and magazine sites: post grids, sliders, tickers and an ad system.
All of them pull posts through WP_Query behind the editor, so the block settings and the query have to stay in step.
My part
Block features in both the free and pro plugins, fixes for unescaped output and an insecure nonce, capability checks on editor actions, and I cut the 1.8 release. 81 commits across the two
- WordPress
- React
- Gutenberg
- PHP
- Show more about Registration Form Fields for WooCommerceShow less about Registration Form Fields for WooCommerce
Registration Form Fields for WooCommerce
Paid extension on WooCommerce.com
A drag-and-drop builder for the WooCommerce registration form.
Custom fields, validation and admin management, running on stores I never get to see.
My part
Built the file upload field end to end, at checkout, in the dashboard user screen and for multiple files, plus the phone field, the first and last name smart tags, PHP 8 fixes and repairs to the email templates. 70 commits
- WooCommerce
- PHP
- React
- Paid
Live Registration Form Fields for WooCommerceClosed source - Show more about Customize My Account Page for WooCommerceShow less about Customize My Account Page for WooCommerce
Customize My Account Page for WooCommerce
Paid on WooCommerce.com, free on WP.org
Rebuilds the WooCommerce My Account area without touching a theme.
A store owner gets custom endpoints, tabs and groups, different navigation layouts, and a customiser that shows each change as you make it.
My part
The colour palette manager, the navigation layout and menu position controls, live previews for every control, support for the older style engine, a warning before you leave with unsaved changes, and the 2.0.1 release. 162 commits
- WooCommerce
- PHP
- React
- Paid
Live Customize My Account Page for WooCommerceClosed source - Show more about This siteShow less about This site
This site
Static Next.js · ~85 kB of JavaScript
One page of static HTML, with two themes from a single set of CSS variables.
No colour is written into a component, there is no animation library, and all the text lives in one typed file so nothing drifts out of sync.
My part
The design, the tokens, the accessibility pass and the words
- Next.js
- TypeScript
- Tailwind CSS
Skills
Proven by work
Every number comes from the commit history of the plugin it names.
492
commits in Everest Forms
Free and pro, including the AI form builder
303 of 331
commits in SmartSMTP
Built it from early versions to its first releases
268
commits in User Registration
Core and pro, most of it on payments
40
security and hardening fixes
Across nine plugins, from privilege escalation to stored XSS
4
payment gateways
PayPal, Stripe, Authorize.Net and Mollie
171 of 171
commits in my own plugin
Custom Code Snippets Manager, start to finish
What I work with
AI and agents
- AI gateway design
- LiteLLM
- OpenAI API
- Prompt design
- Checking model output
- Per-site tokens
- Rate and cost limits
- Claude Code
- MCP servers
- Agent skills
Backend
- PHP
- Python
- FastAPI
- REST APIs
- PostgreSQL
- MySQL
- Redis
- SQLAlchemy
- WebSockets
- JWT auth
- Laravel
- Slim
WordPress
- Plugin structure
- WooCommerce
- Gutenberg blocks
- WP REST API
- Hooks and filters
- Payment gateways
- Backwards compatibility
- Coding standards (PHPCS)
- Translations
- Free and paid releases
Frontend
- TypeScript
- JavaScript
- React
- Next.js
- Tailwind CSS
- jQuery
- HTML and CSS
- Accessibility
Servers and networking
- Docker
- Linux servers
- Nginx
- TLS and DNS
- Subdomains
- Proxy orchestration
- Prometheus and Grafana
- SSH automation
- Tailscale
- Proxy setup
- Modem and mobile IPs
- GitHub Actions
- Shell
How I work
- Debugging
- Code review
- Playwright tests
- Security fixes
- Performance
- Writing docs
Experience
I joined as a plugin intern, fixing issues on a plugin that was already live, and moved onto the product teams from there. I now work across seven WordPress products with about 150,000 sites between them.
Everest Forms
- Built the AI form builder end to end: the back end service in Python and FastAPI, the prompt setup, and the WordPress side that calls it, so no API key ships inside the plugin
- Added the divider field and multiple-select support, styled the lookup field, and added range slider and single-item options to calculations
- 17 security fixes here: an unsafe unserialize call on old PHP, nonce verification when several forms share a page, sanitisation and escaping, entry permissions and file-upload capability checks
- 492 commits across the free and pro plugins
User Registration & Membership
- Moved PayPal onto its REST API with webhook handling, and added checks on the IPN receiver address and amount
- Fixed Stripe charging the wrong currency when a plan had no local price, and stopped Mollie retries charging twice
- Added signature checks and a retry flow to Authorize.Net webhooks
- Patched unauthenticated privilege escalation and user deletion, arbitrary shortcode execution through user-controlled smart tags, a PayPal flaw that let a pending payment be marked completed without paying, a forged gateway on free memberships, and an open redirect after login
- Built the content drip module and the membership upgrade flow, and shipped smaller work across 26 add-ons
SmartSMTP
- Built most of the plugin, from its early versions through its first public releases
- The main and fallback connections, provider setup, test mail, attachment handling, the delivery log, and the hand-off from User Registration
- Fixed a stored XSS in the mail log viewer, with server-side sanitisation and a sandboxed iframe. 303 of its 331 commits are mine
BlockArt and Magazine Blocks
- Fixed a vulnerability in the counter block, unescaped output and an insecure nonce, and made the colour picker offer the theme's own palette
- Block features in both the free and pro plugins, capability checks on editor actions, and I cut the 1.8 release
WooCommerce extensions
- Customize My Account Page: the colour palette manager, navigation layout and menu position controls, live previews for every control, and the 2.0.1 release. 162 commits
- Registration Form Fields: the file upload field end to end, at checkout, in the dashboard and for multiple files, plus the phone field, smart tags and PHP 8 fixes
Across the suite
- 40 security and hardening fixes in total, across nine of the plugins, including triage of the findings from a Snyk report and from an external review of a release
- Cut releases for the paired free and pro plugins: changelogs, version bumps and keeping both shippable from one change
- Use Claude Code with Playwright over MCP to check a fix in a real WordPress install, with my own skills holding the coding standards and the debug routine
Backend work on Oxole, a site where students swapped textbooks.
- Built sign-up, book listings, search, exchange requests and profile pages
- Plain PHP in an MVC layout, with jQuery and Ajax, Twig templates and SQL I wrote by hand
Education
- Sambhram Institute of Technology
B.E. Computer Science and Engineering
Aug 2016 — Dec 2020Visvesvaraya Technological University, Bangalore. This is where I first wrote PHP and learned databases, which turned into the job I have now.
Contact
Open to remote full-stack, WordPress engineering and backend or Python work. Email is the fastest way to reach me, and I usually answer within a day.
Sarawal-6, Nawalparasi, Nepal · UTC+5:45 · remote-friendly · +977-9807445408