Secure plugin & theme development (baseline)

When to use this skill

Use this skill at the start of any WordPress development work and whenever you add a feature that crosses a trust boundary:

• Creating a new plugin main file or theme functions.php addition.
• Registering hooks (add_action / add_filter) that handle input or render output.
• Adding admin pages, settings, shortcodes, blocks, widgets, or REST routes.
• Reviewing an existing plugin to bring it up to a secure baseline.

This is the router skill. Follow the security decision tree: choose the entry path (browser/API, renderer, cron, or CLI), then add the relevant data and policy branches. It explains when to combine focused skills and when browser nonce checks do not apply; do not load every skill for every task.

Core principles (and why they matter)