Tag: WordPress

Protect state-changing requests with WordPress nonces.

Restrict plugin features with current_user_can and custom capabilities.

Sanitize and validate all untrusted input before saving or using it.

Escape output for HTML, attributes, URLs, and JS contexts.

Learn core tables like posts, postmeta, users, options, and terms.

Let others modify your plugin values with apply_filters.

Follow WordPress PHP/JS/CSS coding standards for readable, review-ready plugins.

Load scripts and styles the WordPress way with wp_enqueue_*.

Pass data to JS with wp_localize_script or wp_add_inline_script.

Ship plugin styles cleanly and scope selectors to avoid theme conflicts.