wp-security
Installation
SKILL.md
WordPress Security
Golden rule: sanitize and validate on input, escape on output.
Every piece of data that originates outside your code -- superglobals, database results, remote API responses, user meta -- is untrusted.
1. Output Escaping (XSS Prevention)
Every echo, print, <?=, and printing function MUST pass through an escaping function. Escape late -- at the point of output, not when storing data.