wp-guard

Review generated or changed WordPress code — plugins, themes, and blocks — before it ships. Best used reactively after an agent writes, edits, or reviews code touching WordPress APIs: add_action/add_filter, shortcodes, meta boxes, AJAX handlers, REST routes, WP_Query or $wpdb, widgets, or WP-CLI commands. Use on 'review this plugin', 'is this safe to ship', 'make this translatable', 'speed up this query', or after tasks like 'write a plugin' or 'add an endpoint/shortcode/meta box'. Enforces esca

1,174stars137forksUpdated 8/17/2026

Security Code Review #security #performance #php #wordpress #i18n #code-review

Security Assessment

Safe(95/100)

Security Score95/100

About wp-guard

WP Guard is a defensive code-review skill that vets generated or changed WordPress code — plugins, themes, and blocks — before it ships. It targets the systematic failures AI agents produce in WordPress code: raw `echo` of request data, AJAX handlers with neither nonce nor capability check, SQL built by string interpolation, English hardcoded into user-facing strings, unbounded queries like `posts_per_page => -1`, and hand-rolled reimplementations of APIs core already provides. Each of these looks fine in a demo and fails in production, so the skill acts as a focused guard pass rather than a pedantic style checker.

It runs in guard-pass mode (apply rules to a diff and fix violations before showing the user), live mode (apply rules while writing), or review mode (walk a checklist and produce a structured findings report, prioritizing security, then silent breakage, then i18n, then performance). Its rules cover escaping everything at output with the context-correct function, sanitizing and unslashing request data, requiring both capability checks and nonces on every state change, prepared database queries with `esc_like` for LIKE, core-API-first development, correct prefixes, ABSPATH guards, translation-ready strings with proper text domains and plural handling, and query/caching discipline including transient caching of remote calls. It first adapts to the project's conventions, prefix, and minimum WP/PHP versions, and hands off WooCommerce-specific concerns to woo-guard.

It targets WordPress plugin and theme developers and AI coding agents who want a security, correctness, i18n, and performance safety net before merging. This is defensive, security-hardening guidance, not offensive tooling.

FAQ

What does WP Guard review?

Generated or changed WordPress code touching hooks, shortcodes, meta boxes, AJAX handlers, REST routes, WP_Query or $wpdb, widgets, or WP-CLI commands — flagging security, silent-breakage, i18n, and performance issues.

How do I run it?

As a guard pass over a diff after writing code, in live mode while writing, or in review mode where it walks a checklist and produces a findings report with a merge / fix-first / do-not-merge verdict.

What are its non-negotiable security rules?

Escape late with the context-correct function, sanitize request data after unslashing, require both a capability check and a nonce on every state change, and use prepared statements for any query containing a variable.

Does it handle translations and performance?

Yes — it flags unwrapped user-facing strings, wrong text domains, and missing plural handling (blocking on multilingual projects), plus unbounded queries, uncached remote calls, and autoloaded large options.

When should I use a different skill?

For WooCommerce order/product/checkout logic use woo-guard, for generic code quality use clean-code-guard, for test code use test-guard, and it does not cover non-WordPress PHP or hosting configuration.