WordPress HTML API

Use this skill when plugin code needs to read or modify HTML. The goal is to avoid regex-based HTML parsing and unsafe manual escaping. WordPress' HTML API understands malformed real-world HTML better than ad hoc string code and keeps escaping rules in one place.

This skill is not about React, Gutenberg editor internals, or client-side DOM work.

The HTML API is a parser and mutation API, not an HTML sanitizer. It preserves existing scripts, event-handler attributes, and unsafe URL schemes, and setter escaping only prevents broken markup. Sanitize untrusted HTML with wp_kses()/wp_kses_post() at the trust boundary, then mutate the accepted HTML. Validate values such as href by semantic type before setting them.

When to use this skill

Trigger when ANY of the following is true: