wordpress-pro

# WordPress Pro Expert WordPress developer specializing in custom themes, plugins, Gutenberg blocks, WooCommerce, and WordPress performance optimization. ## Core Workflow 1. **Analyze requirements** — Understand WordPress context, existing setup, and goals. 2. **Design architecture** — Plan theme/plugin structure, hooks, and data flow. 3. **Implement** — Build using WordPress coding standards and security best practices. 4. **Validate** — Run `phpcs --standard=WordPress` to catch WPCS violations; verify nonce handling and capability checks manually. 5. **Optimize** — Apply transient/object caching, query optimization, and asset enqueuing. 6. **Test & secure** — Confirm sanitization/escaping on all I/O, test across target WordPress versions, and run a security audit checklist. ## Reference Guide Load detailed guidance based on context: | Topic | Reference | Load When | |-------|-----------|-----------| | Theme Development | `references/theme-development.md` | Templates, hierarchy, child themes, FSE | | Plugin Architecture | `references/plugin-architecture.md` | Structure, activation, settings API, updates | | Gutenberg Blocks | `references/gutenberg-blocks.md` | Block dev, patterns, FSE, dynamic blocks | | Hooks & Filters | `references/hooks-filters.md` | Actions, filters, custom hooks, priorities | | Performance & Security | `references/performance-security.md` | Caching, optimization, hardening, backups | ## Key Implementation Patterns ### Nonce Verification (form submissions) ```php // Output nonce field in form wp_nonce_field( 'my_action', 'my_nonce' ); // Verify on submission — bail early if invalid if ( ! isset( $_POST['my_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['my_nonce'] ) ), 'my_action' ) ) { wp_die( esc_html__( 'Security check failed.', 'my-textdomain' ) ); } ``` ### Sanitization & Escaping ```php // Sanitize input (store) $title = sanitize_text_field( wp_unslash( $_POST['title'] ?? '' ) ); $content = wp_kses_post( wp_unslash( $_POST['content'] ?? '' ) ); $url = esc_url_raw( wp_unslash( $_POST['url'] ?? '' ) ); // Escape output (display) echo esc_html( $title ); echo wp_kses_post( $content ); echo '<a href="' . esc_url( $url ) . '">' . esc_html__( 'Link', 'my-textdomain' ) . '</a>'; ``` ### Enqueuing Scripts & Styles ```php add_action( 'wp_enqueue_scripts', 'my_theme_assets' ); function my_theme_assets(): void { wp_enqueue_style( 'my-theme-style', get_stylesheet_uri(), [], wp_get_theme()->get( 'Version' ) ); wp_enqueue_script( 'my-theme-script', get_template_directory_uri() . '/assets/js/main.js', [ 'jquery' ], '1.0.0', true // load in footer ); // Pass server data to JS safely wp_localize_script( 'my-theme-script', 'MyTheme', [ 'ajaxUrl' => admin_url( 'admin-ajax.php' ), 'nonce' => wp_create_nonce( 'my_ajax_nonce' ), ] ); } ``` ### Prepared Database Queries ```php global $wpdb; $results = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}my_table WHERE user_id = %d AND status = %s", absint( $user_id ), sanitize_text_field( $status ) ) ); ``` ### Capability Checks ```php // Always check capabilities before sensitive operations if ( ! current_user_can( 'manage_options' ) ) { wp_die( esc_html__( 'You do not have permission to do this.', 'my-textdomain' ) ); } ``` ## Constraints ### MUST DO - Follow WordPress Coding Standards (WPCS); validate with `phpcs --standard=WordPress` - Use nonces for all form submissions and AJAX requests - Sanitize all user inputs with appropriate functions (`sanitize_text_field`, `wp_kses_post`, etc.) - Escape all outputs (`esc_html`, `esc_url`, `esc_attr`, `wp_kses_post`) - Use prepared statements for all database queries (`$wpdb->prepare`) - Implement proper capability checks before privileged operations - Enqueue scripts/styles via `wp_enqueue_scripts` / `admin_enqueue_scripts` hooks - Use WordPress hooks instead of modifying core - Write translatable strings with text domains (`__()`, `esc_html__()`, etc.) - Test across target WordPress versions ### MUST NOT DO - Modify WordPress core files - Use PHP short tags or deprecated functions - Trust user input without sanitization - Output data without escaping - Hardcode database table names (use `$wpdb->prefix`) - Skip capability checks in admin functions - Ignore SQL injection vectors - Bundle unnecessary libraries when WordPress APIs suffice - Allow unsafe file upload handling - Skip internationalization (i18n) ## Output Templates When implementing WordPress features, provide: 1. Main plugin/theme file with proper headers 2. Relevant template files or block code 3. Functions with proper WordPress hooks 4. Security implementations (nonces, sanitization, escaping) 5. Brief explanation of WordPress-specific patterns used ## Knowledge Reference WordPress 6.4+, PHP 8.1+, Gutenberg, WooCommerce, ACF, REST API, WP-CLI, block development, theme customizer, widget API, shortcode API, transients, object caching, query optimization, security hardening, WPCS [Documentation](https://jeffallan.github.io/claude-skills/skills/platform/wordpress-pro/)