WordPress Development Best Practices

Comprehensive development guidance for WordPress themes and plugins following 2025 standards.

What This Skill Provides

1. Coding Standards – PHP, JS, CSS conventions following WordPress standards
2. Custom Post Types – Complete CPT registration and management guide
3. Security – Sanitization, escaping, nonces, capability checks
4. Performance – Caching, query optimization, asset loading
5. Hooks & Filters – Actions and filters reference with examples
6. Template Hierarchy – Theme template structure and overrides

Quick Reference

Do’s

• Use WordPress APIs (don’t reinvent the wheel)
• Sanitize all input (sanitize_* functions)
• Escape all output (esc_* functions)
• Use prepared statements for SQL ($wpdb->prepare)
• Enqueue scripts/styles properly (wp_enqueue_*)
• Use transients for expensive operations
• Follow the template hierarchy
• Use hooks instead of modifying core
• Prefix all functions, classes, and global variables
• Use WP-CLI for automation tasks

Don’ts

• Modify WordPress core files (NEVER)
• Use query_posts() – use WP_Query instead
• Echo untrusted data without escaping
• Store sensitive data in plain text options
• Use extract() on untrusted data
• Suppress errors with @ operator
• Use deprecated functions
• Hard-code URLs or file paths
• Skip nonce verification on forms
• Use mysql_* functions – use $wpdb

Documentation

Detailed documentation available in /docs/:

Code Templates

Ready-to-use templates in /templates/:

Usage Examples

Create a Custom Post Type

Ask Claude:

• “Create a ‘Property’ custom post type for real estate”
• “Add a custom post type for team members with a photo field”
• “Register a ‘Portfolio’ CPT with custom taxonomies”

Security Review

Ask Claude:

• “Review this form handler for security issues”
• “Check if this plugin follows WordPress security best practices”
• “Add proper sanitization and escaping to this code”

Performance Optimization

Ask Claude:

• “Optimize this WP_Query for better performance”
• “Add caching to this expensive database operation”
• “Review asset loading for this theme”

Code Generation

Use the scaffold script to generate boilerplate:

# Generate a custom post type
python3 /root/.claude/skills/wordpress-dev/scripts/scaffold.py \
  --type cpt \
  --name "Property" \
  --slug "property" \
  --output /path/to/theme/inc/

# Generate a custom taxonomy
python3 /root/.claude/skills/wordpress-dev/scripts/scaffold.py \
  --type taxonomy \
  --name "Property Type" \
  --slug "property-type" \
  --post-type "property" \
  --output /path/to/theme/inc/

WordPress 6.x / Block Theme Notes

Full Site Editing (FSE)

For block themes (WordPress 6.0+):

theme/
├── theme.json          # Global styles and settings
├── templates/          # Block templates (HTML)
│   ├── index.html
│   ├── single.html
│   └── page.html
├── parts/              # Block template parts
│   ├── header.html
│   └── footer.html
└── patterns/           # Block patterns
    └── hero.php

theme.json Best Practices

{
  "$schema": "https://schemas.wp.org/trunk/theme.json",
  "version": 2,
  "settings": {
    "color": {
      "palette": [
        {"slug": "primary", "color": "#1a1a1a", "name": "Primary"}
      ]
    },
    "typography": {
      "fontFamilies": [
        {"fontFamily": "Inter, sans-serif", "slug": "body", "name": "Body"}
      ]
    },
    "spacing": {
      "units": ["px", "rem", "%"]
    }
  }
}

Common Patterns

Safe Database Query

global $wpdb;
$results = $wpdb->get_results(
    $wpdb->prepare(
        "SELECT * FROM {$wpdb->posts} WHERE post_type = %s AND post_status = %s",
        'property',
        'publish'
    )
);

AJAX Handler

// Register AJAX action
add_action('wp_ajax_my_action', 'my_ajax_handler');
add_action('wp_ajax_nopriv_my_action', 'my_ajax_handler');

function my_ajax_handler() {
    // Verify nonce
    check_ajax_referer('my_nonce', 'security');

    // Check capability
    if (!current_user_can('edit_posts')) {
        wp_send_json_error('Unauthorized', 403);
    }

    // Sanitize input
    $data = sanitize_text_field($_POST['data']);

    // Process and respond
    wp_send_json_success(['message' => 'Done']);
}

Enqueue Scripts Properly

function theme_enqueue_assets() {
    // CSS
    wp_enqueue_style(
        'theme-style',
        get_stylesheet_uri(),
        [],
        filemtime(get_stylesheet_directory() . '/style.css')
    );

    // JS with dependencies
    wp_enqueue_script(
        'theme-main',
        get_theme_file_uri('/assets/js/main.js'),
        ['jquery'],
        filemtime(get_theme_file_path('/assets/js/main.js')),
        true // In footer
    );

    // Localize for AJAX
    wp_localize_script('theme-main', 'themeData', [
        'ajaxUrl' => admin_url('admin-ajax.php'),
        'nonce'   => wp_create_nonce('theme_nonce'),
    ]);
}
add_action('wp_enqueue_scripts', 'theme_enqueue_assets');

Related Skills

• wordpress-admin: Page/post management, WP-CLI, REST API
• seo-optimizer: Yoast/Rank Math audit and optimization
• visual-qa: Screenshot testing with animation handling
• brand-guide: Brand documentation generation

Resources

• WordPress Coding Standards
• Theme Developer Handbook
• Plugin Developer Handbook
• Block Editor Handbook
• REST API Handbook