wp-plugin-skilllisted

# WordPress Plugin Development ## Overview This skill covers building WordPress plugins that are correct, secure, maintainable, and directory-ready. It follows the structure of the official [Plugin Handbook](https://developer.wordpress.org/plugins/), with each chapter's practical content in `references/`. Two rules govern everything else: **1. Every entry point needs three gates.** Nearly every plugin CVE is a missing gate, not an exotic exploit. ``` Gate 1 AUTHENTICATION Is this a logged-in user? is_user_logged_in() Gate 2 AUTHORIZATION May THIS user do THIS thing? current_user_can( 'cap' ) Gate 3 INTENT Did they mean to, right now? check_admin_referer() Then INPUT Sanitize + validate every request value Then OUTPUT Escape at the point of printing, per context ``` A nonce without a capability check is not security — it only proves the request came from your form, not that the user is allowed. A capability check without a nonce leaves you open to CSRF. You need both. **2. Prefix everything and never touch what isn't yours.** Every function, class, constant, option, meta key, table, and handle in the public namespace carries a unique plugin prefix. A plugin shares one global PHP namespace with core and every other active plugin. ## Workflow ### Building a new plugin 0. **Clarify what cannot be inferred** — see "Ask before you build" below. Capability model, public vs. authenticated endpoints, and data storage shape com