BeforeMerge: WordPress Review

Comprehensive code review knowledge base for WordPress plugin and theme development. Contains rules across 4 categories — security, performance, architecture, and quality — prioritized by impact.

When to Apply

Reference these rules when:

Reviewing pull requests for WordPress plugins or themes
Writing new plugins, themes, widgets, or custom post types
Auditing existing WordPress code for security vulnerabilities
Refactoring code for performance or maintainability
Running pre-merge quality checks on WordPress projects

Rule Categories by Priority

Priority	Category	Impact	Prefix	Focus
1	Security	CRITICAL	`sec-`	OWASP/CWE mapped anti-patterns
2	Performance	HIGH	`perf-`	Database queries, caching, asset loading
3	Architecture	MEDIUM	`arch-`	WordPress APIs, hooks, and code organization
4	Quality	LOW-MEDIUM	`qual-`	Sanitization, i18n, error handling

How to Use

Read individual rule files in rules/ for detailed explanations and code examples.

Each rule contains:

Brief explanation of why it matters
Incorrect PHP code example with explanation
Correct PHP code example with explanation
CWE/OWASP mapping where applicable
References to official WordPress documentation

For the complete compiled guide: AGENTS.md

beforemerge-wordpress-review

Security(9)

Always Use $wpdb->prepare() for Database Queries

Performance(6)

Enqueue Scripts and Styles Properly with Conditional Loading

Quality(3)

Sanitize All User Input with Type-Appropriate Functions

Architecture(3)

Use WordPress APIs Instead of Raw PHP Functions

Automate beforemerge-wordpress-review checks on every PR

Prevent Path Traversal in File Operations and Includes

Verify Nonces on All State-Changing Actions

Never Unserialize User-Controlled Data

Always Check Capabilities Before Privileged Operations

Secure AJAX Handlers with Nonce and Capability Checks

Escape All Output with the Correct Context Function

Guard Plugin and Theme PHP Files Against Direct Access

Use wp_handle_upload() with MIME Allowlists for File Uploads

Disable Autoload for Large or Infrequently Used Options

Avoid N+1 Queries in Post Loops

Cache Expensive Operations with Transients

Keep Database Queries Out of Templates — Use pre_get_posts

Use Object Cache for Repeated Expensive Queries

Make All User-Facing Strings Translatable

Use WP_Error for Error Handling — Not Exceptions or False

Use the Correct WordPress Hook for Each Operation

Use WordPress Path and URL Functions — Never Hardcode

BeforeMerge: WordPress Review

When to Apply

Rule Categories by Priority

How to Use