neuro-wp-plugin-debug

Audit every form and AJAX handler for nonce verification, sanitize all superglobal input with functions like sanitize_text_field, escape all output with esc_html or esc_attr, and use $wpdb->prepare for every database query. Also verify capability checks with current_user_can on all administrative actions.

Most rejections come from security issues: missing nonce checks, unescaped output, unprepared SQL queries, or generic unprefixed function and option names. Run Plugin Check (PCP) and a WPCS scan with the WordPress-Extra ruleset to catch these before resubmitting.

Install WPCS via Composer with wp-coding-standards/wpcs, then run vendor/bin/phpcs with the WordPress-Extra standard. Configure a phpcs.xml.dist file defining your text domain, required prefixes, and minimum WordPress version for automated enforcement.

remove_action requires the exact same object instance that was used in add_action, not a new instance or a string class name. You must obtain the original instance, typically through a singleton accessor, and pass the same priority.

Common causes include N+1 query patterns in loops, large options stored with autoload enabled, external HTTP requests without transient caching or timeouts, and missing database indexes. Enable SAVEQUERIES and Query Monitor to identify queries exceeding 50ms.