wordpress-skills

WordPress site and codebase onboarding review. Use when inheriting a WordPress repo, auditing an unfamiliar site or project, scoping technical risk before deeper review, identifying whether a codebase is plugin/theme/headless/WooCommerce/multisite/Bedrock/builder-heavy, or when user asks for "site audit", "onboarding review", "what am I looking at", "inherit this WordPress project", "stack discovery", or "where should I start". Produces a prioritized review path and routes follow-up work to the right WordPress skill.

WordPress site and codebase onboarding review for Codex. Use when inheriting a repo, classifying an unfamiliar WordPress stack, mapping architectural hotspots, or deciding which WordPress review skill should run next.

WordPress CI/CD and release engineering review guidance. Use when reviewing GitHub Actions, deployment pipelines, Composer/npm build steps, plugin/theme packaging, release automation, secrets handling, SVN deploy flows for WordPress.org, staged rollouts, rollback plans, or when user mentions CI, CD, release pipeline, GitHub Actions, deployment workflow, build artifact, plugin zip, or release engineering. Helps review build reproducibility, packaging correctness, secret boundaries, deployment safety, rollback readiness, and WordPress-specific release pitfalls.

Headless WordPress and WPGraphQL review guidance. Use when reviewing decoupled WordPress architectures, WPGraphQL schema design, `register_graphql_field`, `register_graphql_connection`, `graphql_register_types`, Next.js/Gatsby/Remix frontends, preview mode, auth flows, persisted queries, or build/revalidation pipelines. Helps review schema boundaries, resolver performance, preview/auth correctness, cache invalidation, and content modeling decisions for headless WordPress stacks.

WordPress CI/CD and release engineering review for Codex. Use when reviewing GitHub Actions, deployment scripts, artifact packaging, WordPress.org release flows, or rollback and environment promotion safety.

Headless WordPress and WPGraphQL review for Codex. Use when reviewing decoupled WordPress frontends, schema extensions, preview/auth flows, and cache or build invalidation around WPGraphQL.

WordPress ACF and content modeling review. Use when reviewing Advanced Custom Fields usage, field group architecture, CPT and taxonomy design, options pages, repeaters, flexible content, block-bound field groups, meta storage patterns, or when user mentions "ACF", "field groups", "flexible content", "repeater", "custom post type design", "taxonomy design", "content model", "relationship fields", "ACF JSON", "options page", or "meta query performance". Detects schema drift, weak content modeling, brittle field naming, and performance issues in meta-heavy WordPress builds.

WordPress ACF and content modeling review for Codex. Use when reviewing ACF field groups, CPT and taxonomy design, options pages, repeaters, flexible content, relationship fields, ACF JSON sync, and meta-heavy content architecture.

WordPress PHPStan review and setup guidance. Use when reviewing `phpstan.neon`, WordPress static-analysis setup, baselines, PHPStan levels, CI jobs, WordPress stubs, `szepeviktor/phpstan-wordpress`, or when user mentions "PHPStan", "static analysis", "phpstan.neon", "baseline", "WordPress stubs", or "CI type checks". Helps review WordPress-specific PHPStan configuration, baseline strategy, extension wiring, and practical rollout patterns for plugins, themes, and larger WordPress codebases.

WordPress Playground review and development guidance. Use when reviewing Blueprints, Playground JSON setup flows, `@wp-playground/cli` usage, embedded Playground demos, reproducible bug repros, docs examples, or when user mentions "WordPress Playground", "Blueprint", "playground.json", "run-blueprint", "build-snapshot", "embed Playground", or "zero-setup repro". Helps review Blueprint design, local Playground workflows, demo reliability, and reproducible WordPress environments.

WordPress WP-CLI and operations review guidance. Use when reviewing WP-CLI commands, search-replace plans, multisite operations, cron or cache maintenance, deployment scripts, operational runbooks, CLI automation, or when user mentions "WP-CLI", "search-replace", "multisite ops", "wp cron", "wp db", "deployment script", "maintenance task", "CLI command", or "ops review". Helps review command safety, environment targeting, multisite scope, automation reliability, and operational blast radius in WordPress codebases and runbooks.

WordPress PHPStan review for Codex. Use when reviewing phpstan config, baseline strategy, CI analysis setup, WordPress stubs, or `szepeviktor/phpstan-wordpress` integration in WordPress projects.

WordPress Playground review for Codex. Use when reviewing Blueprints, Playground CLI usage, embedded Playground demos, reproducible WordPress setups, or zero-setup bug repro environments.

WordPress WP-CLI and operations review for Codex. Use when reviewing custom CLI commands, search-replace plans, multisite operations, maintenance scripts, cron or cache workflows, or deployment-time WordPress operations.

WordPress performance code review and optimization analysis. Use when reviewing WordPress PHP code for performance issues, auditing themes/plugins for scalability, optimizing WP_Query, analyzing caching strategies, checking code before launch, or detecting anti-patterns, or when user mentions "performance review", "optimization audit", "slow WordPress", "slow queries", "high-traffic", "scale WordPress", "code review", "timeout", "500 error", "out of memory", or "site won't load". Detects anti-patterns in database queries, hooks, object caching, AJAX, template loading, and editor-side performance.

WordPress accessibility review for themes, blocks, plugins, and admin interfaces. Use when reviewing keyboard navigation, focus behavior, semantic HTML, ARIA usage, form labeling, screen-reader support, contrast-related implementation issues, or when user mentions "accessibility review", "a11y", "keyboard navigation", "focus management", "screen reader", "ARIA", "semantic HTML", "accessible form", or "accessible block". Detects implementation-level accessibility issues in frontend output, block markup, admin screens, and interactive UI behavior.

WordPress admin UI review and development guidance. Use when reviewing admin pages, settings screens, menu pages, notices, list tables, metabox-like interfaces, screen options, capability checks, admin scripts or styles, or when user mentions "admin UI", "settings page", "wp-admin", "admin screen", "options page", "list table", "admin menu", "admin notice", "screen options", or "dashboard page". Detects capability issues, Settings API misuse, admin-only performance problems, and UX mistakes in WordPress admin interfaces.

WordPress migration and upgrade review. Use when reviewing database migrations, option versioning, upgrade routines, data backfills, dbDelta usage, release compatibility, rollback risk, or when user mentions "migration review", "upgrade routine", "dbDelta", "plugin upgrade", "data migration", "version bump", "backfill", "schema change", or "backwards compatibility". Detects unsafe migrations, missing version guards, destructive data changes, and upgrade-flow risks in WordPress code.

WordPress REST API review and development guidance. Use when reviewing custom REST routes, permission_callback logic, schema design, WP_REST_Request handling, response structure, versioning, controller classes, nonce or auth usage, or when user mentions "REST API review", "register_rest_route", "permission_callback", "WP_REST_Request", "REST endpoint", "custom API", "API schema", "REST controller", "headless WordPress", or "API auth". Detects route registration issues, authorization mistakes, schema drift, input validation gaps, and response design problems in WordPress REST API code.

WordPress testing strategy and review guidance. Use when planning or reviewing PHPUnit coverage, integration tests, block tests, e2e tests, Playwright flows, WooCommerce test coverage, fixture design, or when user mentions "test strategy", "WordPress tests", "PHPUnit", "integration tests", "Playwright", "e2e", "test coverage", "testing plan", or "regression tests". Helps decide what to test, how deeply to test, and where to focus coverage in WordPress plugins, themes, blocks, and WooCommerce extensions.

WordPress accessibility review for Codex. Use when reviewing semantic HTML, keyboard access, focus behavior, form labels, ARIA usage, and accessible interaction patterns in themes, blocks, plugins, and admin screens.

WordPress admin UI review for Codex. Use when reviewing settings pages, admin menus, notices, screen targeting, admin form flows, and capability-aware plugin interfaces.

WordPress migration and upgrade review for Codex. Use when reviewing schema updates, version guards, data backfills, dbDelta usage, release safety, and backwards-compatibility risks.

WordPress REST API review for Codex. Use when reviewing custom routes, permission callbacks, request validation, schema design, controller classes, response shape, or versioned API behavior.

WordPress test strategy guidance for Codex. Use when deciding what to test, how deeply to test it, and which mix of unit, integration, and E2E coverage fits a WordPress change.

WordPress block editor code review and Gutenberg block development patterns for WordPress 6.x+. Use when reviewing block code, auditing block.json schema, checking editor components, validating render callbacks, analyzing block attributes, verifying InnerBlocks usage, detecting block validation errors, reviewing Interactivity API directives, or when user mentions "block review", "Gutenberg", "block development", "block editor", "block.json", "useBlockProps", "InnerBlocks", "Interactivity API", "data-wp-bind", "render_callback", "dynamic block", "static block", "block deprecation", "block attributes", "block supports", "@wordpress/scripts", "wp-scripts", "block validation error", "save function", "RichText", "InspectorControls", "BlockControls". Detects issues in block.json schema, React/JSX editor patterns, server-side rendering, attribute handling, and frontend interactions.

WordPress plugin architecture review and WordPress.org submission standards. Use when reviewing WordPress plugin code, auditing plugin architecture, preparing WordPress.org plugin submission, checking plugin best practices, analyzing custom post types, taxonomies, Settings API, hooks system, internationalization, or when user mentions "plugin review", "plugin development", "plugin best practices", "WordPress.org submission", "Plugin Check", "plugin headers", "activation hook", "deactivation hook", "uninstall", "custom post type", "taxonomy", "Settings API", "hooks", "actions", "filters", "i18n", "text domain", "prefixing", "namespacing". Detects issues in plugin architecture, lifecycle hooks, WordPress.org compliance, and API integration.

WordPress security code review and vulnerability detection. Use when reviewing WordPress PHP code for security issues, auditing themes/plugins for vulnerabilities, checking code before launch, analyzing AJAX/REST handlers for exploits, detecting XSS, SQL injection, CSRF, or authorization bypass, or when user mentions "security review", "vulnerability", "XSS", "SQL injection", "CSRF", "nonce", "sanitization", "escaping", "capability check", "privilege escalation", "file upload security", "insecure code", "auth bypass", or "security audit". Detects vulnerabilities in input handling, output escaping, authorization, nonces, database queries, file uploads, and dangerous functions.

WordPress theme code review and block theme development patterns for WordPress 6.6+. Use when reviewing theme code, auditing theme.json schema, checking template hierarchy, validating block templates, analyzing global styles, verifying style variations, reviewing template parts, detecting hardcoded styles, checking classic-to-block migration, or when user mentions "theme review", "theme development", "theme.json", "block theme", "FSE", "Full Site Editing", "template parts", "template hierarchy", "global styles", "style variations", "classic theme", "child theme", "theme patterns", "theme.json validation", "hardcoded styles", "useRootPaddingAwareAlignments", "classic-to-block", "hybrid theme", "WordPress.org theme". Detects issues in theme.json structure, block templates, template parts, style systems, and classic theme migration patterns.

WooCommerce extension code review for HPOS compatibility, payment gateway security, cart optimization, and template overrides. Use when reviewing WooCommerce extension code, payment gateway development, shipping methods, custom product types, cart operations, checkout customization, or when user mentions "WooCommerce review", "WooCommerce extension", "WooCommerce plugin", "payment gateway", "shipping method", "HPOS", "High-Performance Order Storage", "wc_get_orders", "WC_Payment_Gateway", "WC_Shipping_Method", "cart fragments", "WooCommerce hooks", "WooCommerce template", "shop_order", "WooCommerce performance", "Action Scheduler", "WooCommerce REST API", "WooCommerce Blocks", "checkout block", "woocommerce_checkout". Detects HPOS issues, CRUD violations, payment security anti-patterns, performance problems, and template override mistakes in WooCommerce 8.2+ through 10.x code.

WordPress block editor review for Codex. Use when reviewing block.json, editor components, save and render patterns, attributes, InnerBlocks, deprecations, build setup, or the Interactivity API in Gutenberg blocks.

WordPress performance code review for Codex. Use when reviewing themes, plugins, or custom WordPress code for query bloat, cache misses, slow hooks, cron issues, asset-loading waste, polling, or pre-launch scalability risks.

WordPress plugin architecture review for Codex. Use when reviewing plugin structure, lifecycle hooks, Settings API usage, CPT and taxonomy registration, hook design, i18n, and WordPress.org readiness.

WordPress security code review for Codex. Use when reviewing themes, plugins, or custom WordPress code for XSS, SQL injection, CSRF, auth gaps, unsafe uploads, dangerous functions, or insecure REST and AJAX handlers.

WordPress theme review for Codex. Use when reviewing block themes, classic themes, or hybrid themes for theme.json structure, templates, template parts, style variations, global styles, and FSE patterns.

WooCommerce extension review for Codex. Use when reviewing HPOS compatibility, CRUD usage, payment gateway safety patterns, cart fragments, template overrides, Action Scheduler usage, and WooCommerce block integrations.