Curated resource guide
Secure WordPress Development Resources
Write WordPress code that treats authorization, untrusted input, and external systems as explicit security boundaries. This guide covers validation, sanitization, escaping, nonces, capabilities, prepared queries, REST and AJAX permissions, uploads, HTTP requests, dependency risk, security testing, review, and responsible remediation.
Scope
What this guide covers
- Threat-aware plugin/theme development
- validation
- sanitization
- escaping
- prepared SQL
- nonces
- CSRF protection
- authentication
- authorization and capabilities
- IDOR prevention
- XSS
- SQL injection
- SSRF
- file upload security
- path traversal
- command injection
- unsafe deserialization
- REST/AJAX permission callbacks
- redirects
- HTTP requests
- secrets
- cryptography choices
- password handling
- dependency security
- supply chain
- secure coding standards
- security testing
- code review
- and responsible vulnerability remediation
Selected references
Curated resources
Links open the original publisher so you can use the complete, current material in context.
- 01Recommended starting point
Security for WordPress Developers
WordPress security guidance built around validating input, sanitizing data, escaping output, and checking capabilities. It gives plugin code a sound defensive baseline.
developer.wordpress.org - 02
Sanitizing Data
Choose the narrowest WordPress sanitization function for untrusted values before storing or processing them.
developer.wordpress.org - 03
Validating Data
Reject values that do not meet explicit application rules instead of trying to repair every malformed input.
developer.wordpress.org - 04
Escaping Data
Escape late for the exact HTML, attribute, URL, JavaScript, or translation context where output is rendered.
developer.wordpress.org - 05
WordPress Nonces
Use nonces for intent and CSRF checks while keeping authentication and capability authorization separate.
developer.wordpress.org - 06
Roles and Capabilities
Design authorization around capabilities and current-user checks rather than role names or hidden interface controls.
developer.wordpress.org - 07
Common WordPress Vulnerabilities
Review concrete WordPress examples of injection, request forgery, access-control, and unsafe output failures.
developer.wordpress.org - 08
wpdb::prepare() Reference
Parameterize SQL values correctly and avoid subtle injection errors in custom database operations.
developer.wordpress.org - 09
wp_safe_remote_get() Reference
Apply WordPress URL validation when server-side requests may use user-influenced destinations.
developer.wordpress.org - 10
wp_check_filetype_and_ext() Reference
Validate uploaded file type against both the filename and actual file contents where WordPress supports it.
developer.wordpress.org - 11
current_user_can() Reference
Authorize each protected action against capabilities rather than trusting UI visibility or ownership assumptions.
developer.wordpress.org - 12
Adding Custom REST Endpoints
Register namespaced routes with explicit methods, arguments, validation, and permission callbacks.
developer.wordpress.org