WordPress Coding Practices
Application skill for WordPress official coding standards ingest (awesome-guidelines). Generic PHP: php-coding-practices. Accessibility: wcag-accessibility-practices. HTML/CSS baseline: frontend-markup-practices.
Core Principle
WordPress maintainability is ecosystem-safe PHP plus late escaping, snake_case and Yoda layout, context-matched esc_* at output, prepared SQL, translatable strings, and PHPCS-enforced handbooks across PHP/HTML/CSS/JS.
When to Use / NOT
- WordPress themes, plugins, mu-plugins, and core-style contributions.
- Reviewing hooks, templates,
$wpdb usage, admin screens, block editor assets.
- Setting up PHPCS with
WordPress-Core / WordPress-Extra rulesets.
NOT when:
- Non-WordPress PHP,
php-coding-practices.
- Vendored third-party libraries inside a plugin, exempt from WPCS per handbook.
- Full plugin architecture (CPT, REST, blocks), WordPress foundation docs.
Workflow
- PHP naming/layout, snake_case, Yoda, files, hooks (
wordpress-style-php-naming.md).
- Security/escape, late output escaping per context (
wordpress-style-security-escape.md).
- Database/i18n, prepare SQL, gettext strings (
wordpress-style-database-i18n.md).
- Assets/verify, HTML/CSS/JS + PHPCS + a11y (
wordpress-style-assets-verify.md).
Red Flags
- camelCase PHP functions or variables
- Shorthand PHP tags or missing
ABSPATH guard in plugin files
- Non-Yoda literal comparison (
$x === 'foo')
- Raw SQL with interpolated variables
- Quoted
%s/%d inside $wpdb->prepare()
echo $var without context-appropriate escapeextract() on request/query arrays@ error suppression instead of proper handling- Missing text domain in new
__() / _e() strings
- Unquoted HTML attributes
- camelCase CSS selectors or over-qualified
div.class
- snake_case JavaScript variable names
- PHPCS WordPress violations on changed PHP paths
Verification
phpcs --standard=WordPress (or project ruleset) on changed .php files- ESLint/JSHint on changed admin/block JS where configured
- Manual spot-check: escape at echo, prepare placeholders unquoted
- i18n grep: new user strings use text domain + translator comments
- WCAG AA checklist on changed UI (
wcag-accessibility-practices)
References
awesome-guidelines/references/wordpress-style-learning-note.mdawesome-guidelines/references/wordpress-style-php-naming.mdawesome-guidelines/references/wordpress-style-security-escape.mdawesome-guidelines/references/wordpress-style-database-i18n.mdawesome-guidelines/references/wordpress-style-assets-verify.md
Related skills
php-coding-practices, PSR baseline outside WordPresswcag-accessibility-practices, WCAG AA UI depthfrontend-markup-practices, generic HTML/CSS habitsjavascript-coding-practices, JS outside WP admin conventionswebappsec-coding-practices, broader secure coding patterns
1---2name: wordpress-coding-practices3description: Use when authoring or reviewing WordPress themes/plugins, WPCS PHP naming, Yoda conditions, late esc_* output, $wpdb->prepare, i18n text domains, HTML/CSS/JS handbooks, and PHPCS verification.4---56# WordPress Coding Practices78Application skill for WordPress official coding standards ingest (`awesome-guidelines`). Generic PHP: `php-coding-practices`. Accessibility: `wcag-accessibility-practices`. HTML/CSS baseline: `frontend-markup-practices`.910## Core Principle1112WordPress maintainability is **ecosystem-safe PHP plus late escaping**, snake_case and Yoda layout, context-matched `esc_*` at output, prepared SQL, translatable strings, and PHPCS-enforced handbooks across PHP/HTML/CSS/JS.1314## When to Use / NOT1516- WordPress themes, plugins, mu-plugins, and core-style contributions.17- Reviewing hooks, templates, `$wpdb` usage, admin screens, block editor assets.18- Setting up PHPCS with `WordPress-Core` / `WordPress-Extra` rulesets.1920**NOT when:**2122- Non-WordPress PHP, `php-coding-practices`.23- Vendored third-party libraries inside a plugin, exempt from WPCS per handbook.24- Full plugin architecture (CPT, REST, blocks), WordPress foundation docs.2526## Workflow27281. **PHP naming/layout**, snake_case, Yoda, files, hooks (`wordpress-style-php-naming.md`).292. **Security/escape**, late output escaping per context (`wordpress-style-security-escape.md`).303. **Database/i18n**, prepare SQL, gettext strings (`wordpress-style-database-i18n.md`).314. **Assets/verify**, HTML/CSS/JS + PHPCS + a11y (`wordpress-style-assets-verify.md`).3233## Red Flags3435- camelCase PHP functions or variables36- Shorthand PHP tags or missing `ABSPATH` guard in plugin files37- Non-Yoda literal comparison (`$x === 'foo'`)38- Raw SQL with interpolated variables39- Quoted `%s`/`%d` inside `$wpdb->prepare()`40- `echo $var` without context-appropriate escape41- `extract()` on request/query arrays42- `@` error suppression instead of proper handling43- Missing text domain in new `__()` / `_e()` strings44- Unquoted HTML attributes45- camelCase CSS selectors or over-qualified `div.class`46- snake_case JavaScript variable names47- PHPCS WordPress violations on changed PHP paths4849## Verification5051- `phpcs --standard=WordPress` (or project ruleset) on changed `.php` files52- ESLint/JSHint on changed admin/block JS where configured53- Manual spot-check: escape at echo, prepare placeholders unquoted54- i18n grep: new user strings use text domain + translator comments55- WCAG AA checklist on changed UI (`wcag-accessibility-practices`)565758## References5960- `awesome-guidelines/references/wordpress-style-learning-note.md`61- `awesome-guidelines/references/wordpress-style-php-naming.md`62- `awesome-guidelines/references/wordpress-style-security-escape.md`63- `awesome-guidelines/references/wordpress-style-database-i18n.md`64- `awesome-guidelines/references/wordpress-style-assets-verify.md`6566## Related skills6768- `php-coding-practices`, PSR baseline outside WordPress69- `wcag-accessibility-practices`, WCAG AA UI depth70- `frontend-markup-practices`, generic HTML/CSS habits71- `javascript-coding-practices`, JS outside WP admin conventions72- `webappsec-coding-practices`, broader secure coding patterns
ryan-brosas