Settings & options security

When to use this skill

Use this skill whenever a plugin or theme stores configuration in WordPress options:

• Building a settings page with the Settings API (register_setting, add_settings_section, add_settings_field).
• A form that posts to options.php.
• Calling update_option() or add_option() from a custom handler.
• Reading options with get_option() and rendering them anywhere (admin, front-end, emails).

The Settings API gives you nonce handling, capability gating, and a structured sanitization hook for free — but only if you actually wire it. Bypassing it for a "quick" custom form is a common source of stored XSS and unauthorized writes.

Related: see the input-sanitization-validation skill for per-request sanitization patterns and the nonces-csrf-protection skill for custom-form nonce handling.