wp-plugin-development

Use when developing WordPress plugins: architecture and hooks, activation/deactivation/uninstall, admin UI and Settings API, data storage, cron/tasks, security (nonces/capabilities/sanitization/escaping), and release packaging.

1,509stars211forksUpdated 5/20/2026

Security #security #php #admin-ui #wordpress #plugin-development #code-architecture

Security Assessment

Safe(100/100)

Security Score100/100

About wp-plugin-development

The wp-plugin-development skill provides a comprehensive framework for developing WordPress plugins in a structured, maintainable, and secure manner. It addresses common challenges developers face when creating or maintaining plugins, such as organizing plugin architecture, handling WordPress hooks, managing activation and deactivation routines, securing inputs and outputs, and correctly implementing admin interfaces. By guiding developers through best practices and procedural steps, this skill reduces the risk of runtime errors, security vulnerabilities, and poor plugin performance.

Key features of this skill include structured plugin architecture guidance, lifecycle management through activation, deactivation, and uninstall hooks, and administration interface development using the WordPress Settings API. It enforces a security baseline that emphasizes input validation, output escaping, nonce verification, capability checks, and safe SQL usage with $wpdb->prepare(). Additional capabilities cover data storage strategies, cron task management, and schema migration handling. The skill also provides verification steps and debugging advice to ensure plugins function correctly, with references to documentation for detailed guidance on architecture, lifecycle, settings, security, and data management.

This skill is particularly suited for WordPress plugin developers working on single-site or multisite environments targeting WordPress 6.9+ and PHP 7.2.24+. It is valuable for developers needing to create new plugins, refactor existing ones, implement secure admin interfaces, or package plugins for release. Typical users include professional PHP developers, agencies maintaining client plugins, and technical teams seeking to ensure high-quality, secure, and maintainable WordPress plugin codebases.

FAQ

Which WordPress and PHP versions does this skill support?

This skill targets WordPress 6.9 and above and requires PHP 7.2.24 or later, which affects available APIs and placeholder support in $wpdb->prepare().

Can this skill be used for multisite WordPress setups?

Yes, the skill supports both single-site and multisite environments and includes considerations for network-activated plugins.

Does the skill provide guidance on security best practices?

Absolutely. It emphasizes input validation, output escaping, nonce checks, capability verification, and safe SQL usage to prevent common security vulnerabilities.

Is WP-CLI required to use this skill?

Some workflows within this skill may require WP-CLI, particularly for running cron tasks or manual execution of certain procedures, but many operations can be performed via standard filesystem and Node scripts.

What are the key limitations when applying this skill?

The skill assumes familiarity with WordPress plugin development and requires access to the plugin’s repository. It does not invent new APIs or functionality beyond what WordPress provides, and some procedures depend on existing scripts or references provided in the skill's documentation.