skills.rest
Lonsdale201
Lonsdale201COMMUNITY
Explore all skills by this author →
WebsiteGitHub

wp-security-audit

Audit WordPress PHP code for common security issues and report findings.

21|1|Updated Apr 29, 2026
Search Tags:#sanitization#wordpress#security-audit#rest-api#capability#escaping#nonce
One-click install
npx skills add https://github.com/Lonsdale201/wp-agent-skills --skill wp-security-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: wp-security-audit
Source: https://github.com/Lonsdale201/wp-agent-skills/tree/main/wordpress/wp-security-audit
Command: npx skills add https://github.com/Lonsdale201/wp-agent-skills --skill wp-security-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audits WordPress plugin or theme PHP code for the most common security mistakes — missing nonce checks, capability checks, input sanitization, output escaping, unslashing, SQL preparation, AJAX nopriv exposure, file/path traversal, and unsafe redirects. Use when reviewing pull requests, before releasing a plugin, when the user asks "is this secure", or when handling code that touches $_GET / $_POST / $_REQUEST / $_COOKIE / $_FILES / $_SERVER, admin-ajax / admin-post, REST endpoints, options, user meta, custom DB queries, or file uploads.

Core Features & Use Cases

  • Nonce and capability checks to prevent unauthorized writes.
  • Input handling, sanitization, and output escaping to defend against XSS and data corruption.
  • Safe file and redirect patterns, REST and AJAX best practices, and error handling.
  • Real-world use: security reviews during PRs, releases, or ad-hoc security questions.

Quick Start

Provide a security-focused code review for a given WP plugin file and return a prioritized findings report.

Frequently Asked Questions about wp-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit WordPress plugin code for security vulnerabilities during a pull request?▼

WordPress security audits check for missing nonce and capability validations, insufficient input sanitization, lack of output escaping, unsafe SQL preparation, and AJAX nopriv exposure. These vulnerabilities can lead to XSS, data corruption, and unauthorized access if left unresolved.

What's the best way to secure WordPress REST endpoints and prevent AJAX nopriv exposure?▼

Securing WordPress REST endpoints requires verifying nonce and capability checks to prevent unauthorized writes. It also involves validating input handling and ensuring AJAX endpoints are not exposed to unauthenticated users, mitigating risks of privilege escalation and malicious requests.

Do I need to check nonce and capability validations for every admin-post and admin-ajax request?▼

Yes, checking nonce and capability validations for every admin-post and admin-ajax request is required. Audits specifically target these endpoints alongside $_POST and $_GET handling to ensure unauthorized users cannot execute privileged actions or bypass access controls.

Does this security audit cover file path traversal and unsafe redirects in custom database queries?▼

Yes, the security audit covers file path traversal and unsafe redirects alongside custom database queries. It analyzes PHP code handling $_FILES and $_SERVER variables to detect unsafe file operations and validates redirects to ensure they do not allow malicious redirection.

Related Skills

Explore More Software Engineering Skills→
j7-devj7-dev
19

wordpress-reviewer

Review WordPress plugin and theme PHP code for security and performance.

Community
Advanced
this-is-tobithis-is-tobi
5

repository-audit

Audit code repositories and generate prioritized REVIEW.md reports.

Community
Intermediate
PMDevSolutionsPMDevSolutions
16

wordpress-security-hardening

Sanitize inputs, escape outputs, and verify nonces in WordPress themes and plugins.

Official
Advanced
statick88statick88
1

vulnerability-scanning

Automate vulnerability detection across code, dependencies, containers, and infrastructure.

Community
Advanced