WP Security Audit

Instructions

When reviewing or creating plugin code for security:

1. •Check input sanitization - All user input must be cleaned
2. •Check output escaping - All output must be escaped
3. •Verify nonce usage - Forms need CSRF protection
4. •Check capabilities - Admin actions need permission checks
5. •Verify ABSPATH check - All PHP files must have it
6. •Check database queries - Use prepared statements

Security Checklist

• • All $_GET, $_POST, $_COOKIE sanitized
• • All output uses esc_* functions
• • Forms use nonces (wp_nonce_field)
• • Nonces verified before processing
• • Capability checks on admin actions (current_user_can)
• • ABSPATH check in all PHP files
• • No direct SQL without $wpdb->prepare()
• • No eval() or dynamic code execution
• • No sensitive data in URLs or logs

Common Security Functions

Sanitization

sanitize_text_field()      // General text
sanitize_email()           // Email addresses
absint()                   // Positive integers
esc_url_raw()              // URLs

Escaping

esc_html()    // HTML content
esc_attr()    // HTML attributes
esc_url()     // URLs
esc_textarea() // Textarea content

Nonces

wp_nonce_field('action', 'nonce')           // Generate
wp_verify_nonce($_POST['nonce'], 'action')  // Verify

Example Audit Flow

// BAD: No sanitization
$name = $_POST['name'];

// GOOD: Sanitized
$name = sanitize_text_field($_POST['name']);

// BAD: No escaping
echo $user_input;

// GOOD: Escaped
echo esc_html($user_input);