WordPress Plugin And Theme Orientation

WordPress applications commonly extend behaviour through plugins and presentation through themes. Safe work respects hooks, capability checks, nonce verification, escaping, sanitisation, and the platform update path.

Extend Supported Boundaries

Use plugins for behaviour and themes for presentation rather than editing WordPress core. Actions run code at named points in the lifecycle. Filters receive a value, allow code to change it, and return the updated value.

<?php

declare(strict_types=1);

add_filter('the_title', static function (string $title): string {
    return trim($title);
});

Protect Admin Actions

For a state-changing admin action, verify both intent and permission. A nonce helps protect against CSRF; it does not replace authorization.

<?php

declare(strict_types=1);

if (! current_user_can('manage_options')) {
    wp_die('You are not allowed to perform this action.');
}

check_admin_referer('rebuild_product_index');

$productId = filter_input(INPUT_POST, 'product_id', FILTER_VALIDATE_INT);

if ($productId === false || $productId === null) {
    wp_die('Invalid product ID.');
}

Escape output for its context when rendering, such as with esc_html() for ordinary text and esc_url() for URLs. Keep WordPress core, plugins, themes, and the PHP runtime current, and test updates against the application's custom code.