Articles / Developers
WordPress security for developers
WordPress security for developers starts in the code you write. These articles cover nonces, capabilities, escaping and other habits, with examples you can copy.
RSS FeedLatest WordPress security for developers articles
WordPress Nonce: What It Is and How to Use It Correctly
A WordPress nonce is a short-lived token that proves a request came from your own page. Here is how to create and verify one, what it does not protect, and why caching breaks it.
Read articleWordPress Content Security Policy: A Practical Guide
A Content Security Policy tells browsers which scripts, styles and frames your pages may use. Here is how to build one for WordPress, test it in report-only mode and roll it out safely.
Read articleWordPress REST API Security: What Is Exposed and How to Lock It Down
The WordPress REST API is on by default and parts of it are public. Here is what is exposed, how authentication works, and how to write and restrict endpoints without breaking the block editor.
Read articleGet new articles by email
One short email when a new article is out, plus the WordPress threats worth knowing about. No spam, unsubscribe any time.
Questions
WordPress security for developers: questions
What is the most common WordPress security mistake developers make?
Trusting input: missing nonce and capability checks on form and AJAX handlers, and output that is not escaped.
Does Stack Guard have hooks for developers?
Yes. Stack Guard documents its public actions, filters, wp-config.php constants and WP-CLI commands on the developer reference page.
Do these articles apply to any WordPress project?
Yes. The coding advice is general WordPress practice and works with or without Stack Guard.