All authors
Claude Skills by wpultimatesecurity
github.com/wpultimatesecurity27 skills0 installs6 views
- Ai Llm Integration SecurityUse when building or reviewing WordPress plugin or theme features that call an LLM or AI provider: chatbots, content generation, summarization, AI search/RAG over site content, agents that call tools, Abilities API abilities, or MCP exposure. Treats model output and all context as untrusted, binds every tool action to the human user's capabilities, confirms destructive actions server-side, keeps provider keys server-side, limits retrieval to what the user can read, and caps operator-paid spend.Votes: 0GitHub stars: 43
- Ajax SecurityUse when registering or handling WordPress AJAX over admin-ajax.php - wp_ajax_{action} / wp_ajax_nopriv_{action} hooks, JavaScript that posts to admin_url('admin-ajax.php'), or wp.apiFetch / fetch calls to custom actions. Verifies the nonce with check_ajax_referer, gates the action with current_user_can, unslashes and sanitizes every field, and replies with wp_send_json_success / wp_send_json_error. Prevents CSRF, broken access control, and injection on the AJAX surface.Votes: 0GitHub stars: 43
- Authentication Session SecurityUse when code logs users in or out, sets or clears auth cookies, manages session tokens, throttles failed logins, or builds a custom login form in WordPress. Enforces wp_signon() and core session primitives over hand-rolled credential checks, adds brute-force throttling via the wp_authenticate_user filter keyed on username + IP, destroys sessions after password or role changes, makes login error messages uniform to stop user enumeration, and validates redirect_to with wp_safe_redirect() to cl...Votes: 0GitHub stars: 43
- Capability Permission ChecksUse when adding admin pages, menu items, AJAX/REST handlers, action links, or any code that performs a privileged operation in WordPress. Gates actions with current_user_can() using the correct capability (not roles), including per-object checks like edit_post, and pairs the check with a nonce. Prevents privilege escalation and broken access control. Apply proactively to every privileged code path.Votes: 0GitHub stars: 43
- Cron Background Job SecurityUse when scheduling WordPress cron events with wp_schedule_event / wp_schedule_single_event or writing the callback that runs on a cron hook. Treats cron callbacks as running without a logged-in user, re-checks authorization against stored context rather than current_user_can, keeps secrets out of cron URLs, and validates any stored input the job consumes. Prevents unauthenticated privileged actions via the cron surface.Votes: 0GitHub stars: 43
- Dependency Supply Chain SecurityUse when a plugin or theme bundles a third-party PHP or JavaScript library, enqueues an asset from a CDN, fetches or executes code at runtime, manages dependencies with Composer, or prepares the distributable zip. Covers core-handle-first enqueuing, dependency vetting with composer audit, lockfile pinning, export-ignore artifact hygiene, Subresource Integrity for CDN assets via script_loader_tag, and refusal of eval() and remote include patterns. Prevents supply-chain compromise through stale...Votes: 0GitHub stars: 43
- File Upload SecurityUse when a WordPress plugin or theme accepts file uploads, processes $_FILES, saves user-provided files, or generates file paths from input. Uses wp_handle_upload and wp_check_filetype_and_ext with a MIME/extension allowlist, blocks executable types, and prevents path traversal. Prevents arbitrary file upload and RCE. Apply proactively to any upload or file-writing code path.Votes: 0GitHub stars: 43
- Filesystem SecurityUse when reading, writing, including, or deleting files from paths that include user input - include / require, readfile, unlink, file_get_contents, or the WP_Filesystem API. Validates paths with validate_file, normalizes with wp_normalize_path, confines operations to an allowed base directory, and uses wp_delete_file / WP_Filesystem. Prevents path traversal, local file inclusion, and arbitrary file deletion.Votes: 0GitHub stars: 43
- Gutenberg Block Editor SecurityUse when building dynamic blocks or block-editor features - a render_callback, server-side rendered blocks via ServerSideRender, REST-backed block data, or register_rest_field for the editor. Sanitizes block attributes per type, escapes server render output, sets a real permission_callback on editor REST surfaces, and handles RichText content with wp_kses. Prevents stored XSS and broken access control in the editor.Votes: 0GitHub stars: 43
- Http Api Ssrf PreventionUse when a plugin or theme makes outbound HTTP requests with the WordPress HTTP API - wp_remote_get, wp_remote_post, wp_remote_request - especially when any part of the URL comes from user input, options, or webhooks. Uses wp_safe_remote_* with wp_http_validate_url, allowlists hosts, blocks internal and metadata addresses, and checks is_wp_error plus the response code. Prevents server-side request forgery.Votes: 0GitHub stars: 43
- Input Sanitization ValidationUse when reading any external input in WordPress — $_GET, $_POST, $_REQUEST, $_COOKIE, REST params, shortcode/block attributes, option/meta values, or remote API responses. Unslashes then sanitizes to the correct type (sanitize_text_field, sanitize_email, absint, sanitize_key, wp_kses_post, esc_url_raw) and validates values against expected sets. Apply proactively before storing or using any untrusted value.Votes: 0GitHub stars: 43
- Multisite SecurityUse when writing code that runs on a WordPress multisite network - switch_to_blog, network admin pages, get_sites, or capabilities that differ between site and network scope. Uses manage_network / manage_network_options and is_super_admin correctly, restores context with restore_current_blog, isolates per-site data, and never trusts a blog id from input. Prevents cross-site data leakage and network privilege escalation.Votes: 0GitHub stars: 43
- Nonces Csrf ProtectionUse when handling any form submission, AJAX request, admin-post action, settings page, link that triggers an action, or any other user-initiated request in a WordPress plugin or theme. Generates nonces with wp_nonce_field / wp_create_nonce and verifies them with check_admin_referer, check_ajax_referer, or wp_verify_nonce, always paired with a capability check, to prevent CSRF. Apply proactively whenever code accepts or acts on a request.Votes: 0GitHub stars: 43
- Object Injection DeserializationUse when code calls unserialize, maybe_unserialize, or stores serialized PHP in options, meta, or transients from untrusted input. Avoids unserialize on attacker-controlled data, prefers json_encode / json_decode, and when unserialize is unavoidable passes ['allowed_classes' => false]. Prevents PHP object injection and POP-chain remote code execution.Votes: 0GitHub stars: 43
- Output EscapingUse when echoing or printing any dynamic value in WordPress PHP or templates — into HTML, attributes, URLs, inline JavaScript, or textareas. Escapes at the point of output with esc_html, esc_attr, esc_url, esc_js, esc_textarea, or wp_kses_post, including the i18n variants (esc_html__, esc_attr_e). Prevents stored and reflected XSS. Apply proactively to every echoed variable, even data from the database.Votes: 0GitHub stars: 43
- Rest Api SecurityUse when registering WordPress REST API routes with register_rest_route or building custom endpoints. Sets a real permission_callback (never __return_true for writes), defines args with sanitize_callback and validate_callback, enforces capabilities and per-object checks, and escapes any HTML in responses. Prevents broken access control and injection via the REST surface. Apply proactively to every registered route.Votes: 0GitHub stars: 43
- Secrets Credentials ManagementUse when handling passwords, API keys, tokens, or third-party credentials in a WordPress plugin or theme. Hashes passwords with wp_hash_password / wp_check_password, generates tokens with wp_generate_password, keeps secrets out of code and the database in plaintext, and uses Application Passwords for API auth. Prevents credential leakage and insecure storage.Votes: 0GitHub stars: 43
- Secure Plugin DevelopmentUse when starting a new WordPress plugin or theme, scaffolding a plugin file, wiring hooks, or adding any feature that handles requests, options, or output. Establishes the secure-by-default baseline — ABSPATH guard, the capability + nonce + sanitize + escape flow, prepared queries, and safe defaults — and routes to the focused security skills for each concern. Apply proactively at the start of any WordPress build.Votes: 0GitHub stars: 43
- Security Auditing Code ReviewUse when auditing or code-reviewing an existing WordPress plugin or theme for security issues, triaging a vulnerability report, or hardening inherited code. Provides a systematic methodology — locate trust boundaries, inventory sensitive sinks, trace their controls and data flows, then triage confirmed issues and report with fixes. Apply proactively before shipping or when reviewing third-party code.Votes: 0GitHub stars: 43
- Security Headers CspUse when adding HTTP response headers to a WordPress site or plugin: Content-Security-Policy (or Report-Only), X-Content-Type-Options, frame protection (X-Frame-Options or frame-ancestors), Referrer-Policy, Permissions-Policy, HSTS, Secure/HttpOnly/SameSite cookie flags, or CORS on REST responses. Covers the wp_headers filter, the send_headers, login_init and admin_init surfaces, per-request CSP nonces via script_loader_tag, and REST origin restriction through core's allowlist. Headers are th...Votes: 0GitHub stars: 43
- Settings Options SecurityUse when building an options or settings page with the WordPress Settings API - register_setting, add_settings_field, settings_fields, an options.php form, or update_option / get_option on plugin data. Attaches a sanitize_callback to every setting, gates the page with manage_options, relies on Settings API nonce handling, and escapes options on output. Prevents stored XSS and unauthorized option writes.Votes: 0GitHub stars: 43
- Shortcode Block SecurityUse when registering a shortcode with add_shortcode or a dynamic block with a render_callback, or processing shortcode / block attributes. Normalizes attributes with shortcode_atts, validates against allowlists, and escapes all rendered output for its context with esc_html, esc_attr, esc_url, or wp_kses_post. Prevents stored and reflected XSS in rendered content.Votes: 0GitHub stars: 43
- Sql Injection PreventionUse when writing any custom database query in WordPress with $wpdb — get_results, get_var, get_row, query, or building WHERE/IN/LIKE/ORDER BY clauses. Uses $wpdb->prepare() with correct placeholders (%d, %s, %f, %i), $wpdb->esc_like() for LIKE, and allowlists for identifiers that cannot be parameterized. Prevents SQL injection. Apply proactively to every query containing a dynamic value.Votes: 0GitHub stars: 43
- User Data Protection PrivacyUse when a WordPress plugin or theme stores, processes, or exposes personal data — emails, names, IP addresses, user content, or analytics. Registers data exporters and erasers via wp_privacy_personal_data_exporters / _erasers, declares privacy policy content, anonymizes IPs, and minimizes/secures PII. Helps meet GDPR/CCPA obligations. Apply proactively whenever code touches personally identifiable information.Votes: 0GitHub stars: 43
- Woocommerce SecurityUse when a plugin extends WooCommerce - reading or writing orders, customer data, or hooking checkout, REST, or the Store API. Sanitizes input with wc_clean, gates shop actions with WooCommerce capabilities like edit_shop_orders, minimizes stored payment data, and escapes customer PII on output. Prevents broken access control and PII / order data exposure.Votes: 0GitHub stars: 43
- Wp Cli SecurityUse when registering a WP-CLI command with WP_CLI::add_command or writing command logic. Validates and sanitizes positional and associative arguments, does not assume a logged-in user or capability context, avoids printing secrets, and confirms destructive operations. Prevents injection and unsafe automation through the CLI surface.Votes: 0GitHub stars: 43
- Wp Hardening Best PracticesUse when configuring or hardening a WordPress site, editing wp-config.php, writing .htaccess or nginx rules, setting file permissions, or advising on deployment security. Covers security keys, DISALLOW_FILE_EDIT, FORCE_SSL_ADMIN, disabling debug output, blocking PHP execution in uploads, protecting sensitive files, and least-privilege file permissions. Apply proactively when setting up or reviewing a site's configuration.Votes: 0GitHub stars: 43