ref-sp-web-wordpresslisted

# WordPress ## Purpose Build and audit WordPress the way WordPress documents it: extend through hooks rather than editing core, and treat every request as hostile until it has passed the three security gates. Most WordPress vulnerabilities are not exotic — they are a missing capability check or an unescaped output in a plugin, and they are entirely preventable with documented APIs. ## When to use this skill - Writing or reviewing a WordPress **plugin or theme**. - Handling form, query-string, or request data in PHP. - Adding an admin action, an AJAX handler, or a REST endpoint. - Querying the database directly. - Deciding how to change behaviour without editing core or a parent theme. - Auditing a WordPress site's security or update posture. - Building a **headless** WordPress backend. **Route elsewhere when:** the question is **SEO** — sitemaps, canonicals, archives, or headless WordPress + Next.js metadata. That is owned by `.agents/skills/ref-sp-web-seo/SKILL.md` and its `references/frameworks.md`, which carries the headless canonical trap. Do not duplicate it here. ## The security model — three gates, all three required WordPress states the principles plainly: > "Don't trust any data. Don't trust user input, third-party APIs, or data in your database without > verification." > "Escape as late as possible." — "Sanitation is okay, but validation/rejection is better." — "Rely on > the WordPress API." Every request that changes state must pass **all three** gates. M