WordPress Security Best Practices

This skill covers WordPress security patterns including output escaping, input sanitization, nonce verification, capability checks, and secure database queries.

Output Escaping

Every piece of dynamic data rendered in HTML must be escaped. Choose the function matching the output context:

Translation + escaping combos:

• esc_html__() / esc_html_e() — translatable escaped strings
• esc_attr__() / esc_attr_e() — translatable escaped attributes
• wp_kses_post() on __() output for rich translated content

Input Sanitization

Sanitize all user input immediately upon receipt, before storage or processing:

Always wp_unslash() superglobals before sanitizing — WordPress adds slashes to $_GET, $_POST, $_REQUEST.

Nonce Verification

Every form submission and AJAX request must include a nonce for CSRF protection:

Forms

// In the form template:
wp_nonce_field( 'myplugin_save_action', 'myplugin_nonce' );

// In the handler:
if ( ! isset( $_POST['myplugin_nonce'] ) ||
     ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['myplugin_nonce'] ) ), 'myplugin_save_action' ) ) {
    wp_die( esc_html__( 'Security check failed.', 'myplugin' ) );
}

AJAX

// Enqueue with nonce:
wp_localize_script( 'myplugin-script', 'myPluginAjax', array(
    'nonce' => wp_create_nonce( 'myplugin_ajax_nonce' ),
    'url'   => admin_url( 'admin-ajax.php' ),
) );

// In the AJAX handler:
check_ajax_referer( 'myplugin_ajax_nonce', 'nonce' );

Admin pages

check_admin_referer( 'myplugin_settings_action', 'myplugin_settings_nonce' );

Capability Checks

Always verify the current user has permission before performing privileged operations:

// Before saving settings:
if ( ! current_user_can( 'manage_options' ) ) {
    wp_die( esc_html__( 'Unauthorized.', 'myplugin' ) );
}

// Before editing posts:
if ( ! current_user_can( 'edit_post', $post_id ) ) {
    wp_die( esc_html__( 'Unauthorized.', 'myplugin' ) );
}

Common capabilities: manage_options, edit_posts, publish_posts, edit_others_posts, delete_posts, upload_files, manage_categories, edit_users.

Database Security

Never pass unsanitized data into SQL. Always use $wpdb->prepare():

global $wpdb;

// Parameterized query:
$results = $wpdb->get_results(
    $wpdb->prepare(
        "SELECT * FROM {$wpdb->prefix}custom_table WHERE user_id = %d AND status = %s",
        $user_id,
        $status
    )
);

// Prefer CRUD methods for single-row operations:
$wpdb->insert( $wpdb->prefix . 'custom_table', array(
    'user_id' => $user_id,
    'status'  => $status,
), array( '%d', '%s' ) );

$wpdb->update( $wpdb->prefix . 'custom_table',
    array( 'status' => 'active' ),
    array( 'id' => $row_id ),
    array( '%s' ),
    array( '%d' )
);

$wpdb->delete( $wpdb->prefix . 'custom_table',
    array( 'id' => $row_id ),
    array( '%d' )
);

File Operations

Use the WP_Filesystem API instead of direct PHP file functions:

global $wp_filesystem;
WP_Filesystem();

$wp_filesystem->put_contents( $file_path, $content, FS_CHMOD_FILE );
$content = $wp_filesystem->get_contents( $file_path );

For uploads, use wp_handle_upload():

$uploaded = wp_handle_upload( $_FILES['myfile'], array( 'test_form' => false ) );
if ( isset( $uploaded['error'] ) ) {
    wp_die( esc_html( $uploaded['error'] ) );
}

AJAX & REST Security

AJAX handlers

add_action( 'wp_ajax_myplugin_action', 'myplugin_ajax_handler' );

function myplugin_ajax_handler(): void {
    check_ajax_referer( 'myplugin_nonce', 'nonce' );

    if ( ! current_user_can( 'edit_posts' ) ) {
        wp_send_json_error( 'Unauthorized', 403 );
    }

    $data = sanitize_text_field( wp_unslash( $_POST['data'] ) );
    // ... process ...

    wp_send_json_success( array( 'result' => $data ) );
}

REST endpoints

register_rest_route( 'myplugin/v1', '/items', array(
    'methods'             => 'GET',
    'callback'            => 'myplugin_get_items',
    'permission_callback' => function (): bool {
        return current_user_can( 'read' );
    },
) );

Never set permission_callback to __return_true unless the endpoint is intentionally public.

Redirects & JSON Responses

// Safe redirect (restricts to allowed hosts):
wp_safe_redirect( admin_url( 'admin.php?page=myplugin' ) );
exit;

// JSON responses:
wp_send_json_success( $data );
wp_send_json_error( $message, $status_code );

// Terminate execution properly:
wp_die( $message, $title, array( 'response' => 403 ) );

For the full function reference with signatures and examples, see references/security-functions.md.