Home › WordPress › WordPress plugin CLAUDE.md

WordPress plugin CLAUDE.md

CLAUDE.md for WordPress plugin development: prefixes, hooks, nonces and capabilities, sanitizing, escaping, and wp-env.

Claude Code (CLAUDE.md)WordPress

Copy CLAUDE.md

How to use

Save this as CLAUDE.md in your repository root, commit it, and your agent will pick it up automatically. Edit the commands to match your project.

Note: Review and test before use. Provided as is, without warranty. See Terms.

# CLAUDE.md: WordPress plugin

## Commands
- Local site: `npx wp-env start` · WP-CLI: `npx wp-env run cli wp plugin list`
- Lint: `vendor/bin/phpcs --standard=WordPress` · Tests: `vendor/bin/phpunit` (WP test suite) · JS: `npm run build` (`@wordpress/scripts`)

## Structure
- Main file `my-plugin.php` with the plugin header; logic in namespaced classes under `includes/` (Composer autoload). Guard every PHP file with `defined( 'ABSPATH' ) || exit;`.
- Prefix everything global (functions, options, hooks, CPT slugs, script handles) with the plugin slug, or use a PHP namespace.
- Hook into WordPress instead of running code at include time (`add_action( 'init', ... )`).

## Security rules (non-negotiable)
- Capability check on every privileged action: `current_user_can( 'manage_options' )`.
- Nonces on every form and AJAX/REST mutation: `wp_nonce_field` + `check_admin_referer`, or `wp_verify_nonce`.
- Sanitize input (`sanitize_text_field`, `absint`, `sanitize_email`, `wp_kses_post`) and escape output late (`esc_html`, `esc_attr`, `esc_url`, `wp_kses`).
- SQL only via `$wpdb->prepare()`; prefer WP APIs (`WP_Query`, `get_posts`, options, meta) over raw SQL.
- REST routes via `register_rest_route` with a real `permission_callback` (never `__return_true` for writes) and `args` validation.

## Other
- Enqueue assets with `wp_enqueue_script/style` and the generated `*.asset.php` dependencies; never hard-code `<script>` tags.
- Make strings translatable: `__( 'Text', 'my-plugin' )`, `esc_html__`.
- Clean up on uninstall in `uninstall.php`, not on deactivation.