Classic Theme Security Standards

Use this when writing or reviewing PHP in a classic theme. Themes output most of the HTML on a site, so their main security failure mode is unsafe dynamic output.

This skill complements wp-security-audit; it is theme-specific and focused on templates, functions.php, template parts, and theme forms.

When to Use This Skill

• Reviewing header.php, footer.php, index.php, page.php, single.php, archive.php, 404.php, comments.php, or template-parts/*.php.
• Reviewing functions.php or inc/*.php in a theme.
• Theme code reads $_GET, $_POST, $_REQUEST, $_COOKIE, or custom query vars.
• Theme code prints custom fields, options, term/user meta, search values, image URLs, classes, or inline JS.
• Theme code has a custom form, AJAX handler, template_include override, or direct SQL.

Escape on Output

Escape at the last possible moment, based on context.