Writing secure WordPress plugins and themes
The handful of habits that prevent most WordPress plugin vulnerabilities.
From the archive: in 2013 I shared “Developing for WordPress? Keep your code secure” by Mike Jolley (2013) on my old blog. This page is a short summary in my own words; the original belongs to its author.
Mike Jolley, a core developer of WooCommerce, argued in 2013 that most plugin vulnerabilities come from skipping a few easy habits. Studies at the time found a large share of popular plugins vulnerable to common attacks. The habits, in short:
- Develop with
WP_DEBUGon, so warnings and notices show up while you build, not in your users’ logs. - Sanitise input:
sanitize_text_field(),absint(),sanitize_email()and friends on everything from$_GET,$_POSTand cookies. - Escape output:
esc_html(),esc_attr(),esc_url()at the moment you print. - Use nonces on every form and action that changes something (
wp_nonce_field()andcheck_admin_referer()). - Check capabilities with
current_user_can(), not just “is logged in”. - Prepare SQL:
$wpdb->prepare()for every query with a variable. - Block direct access to PHP files:
defined( 'ABSPATH' ) || exit;at the top.
None of this is hard. It just has to be a habit, every time.
Read the original: Developing for WordPress? Keep your code secure, by Mike Jolley (2013).