KeenWP

Curated resource guide

Secure WordPress Development Resources

Write WordPress code that treats authorization, untrusted input, and external systems as explicit security boundaries. This guide covers validation, sanitization, escaping, nonces, capabilities, prepared queries, REST and AJAX permissions, uploads, HTTP requests, dependency risk, security testing, review, and responsible remediation.

Scope

What this guide covers

  • Threat-aware plugin/theme development
  • validation
  • sanitization
  • escaping
  • prepared SQL
  • nonces
  • CSRF protection
  • authentication
  • authorization and capabilities
  • IDOR prevention
  • XSS
  • SQL injection
  • SSRF
  • file upload security
  • path traversal
  • command injection
  • unsafe deserialization
  • REST/AJAX permission callbacks
  • redirects
  • HTTP requests
  • secrets
  • cryptography choices
  • password handling
  • dependency security
  • supply chain
  • secure coding standards
  • security testing
  • code review
  • and responsible vulnerability remediation

Selected references

Curated resources

Links open the original publisher so you can use the complete, current material in context.

  1. 01
    5
    Recommended starting point

    Security for WordPress Developers

    WordPress security guidance built around validating input, sanitizing data, escaping output, and checking capabilities. It gives plugin code a sound defensive baseline.

    developer.wordpress.org
  2. 02
    5

    Sanitizing Data

    Choose the narrowest WordPress sanitization function for untrusted values before storing or processing them.

    developer.wordpress.org
  3. 03
    5

    Validating Data

    Reject values that do not meet explicit application rules instead of trying to repair every malformed input.

    developer.wordpress.org
  4. 04
    5

    Escaping Data

    Escape late for the exact HTML, attribute, URL, JavaScript, or translation context where output is rendered.

    developer.wordpress.org
  5. 05
    5

    WordPress Nonces

    Use nonces for intent and CSRF checks while keeping authentication and capability authorization separate.

    developer.wordpress.org
  6. 06
    5

    Roles and Capabilities

    Design authorization around capabilities and current-user checks rather than role names or hidden interface controls.

    developer.wordpress.org
  7. 07
    5

    Common WordPress Vulnerabilities

    Review concrete WordPress examples of injection, request forgery, access-control, and unsafe output failures.

    developer.wordpress.org