WordPress 7.1

Apply the PHP 8.5 baseline first. These rules cover WordPress 7.1 plugins, themes, hooks, capabilities, nonces, validation, escaping, database access, REST endpoints, files, configuration, updates, and operations.

Hooks and request handling

• Register hooks, shortcodes, blocks, AJAX actions, cron callbacks, and REST routes only from trusted plugin or theme code.
• Validate every query, form, JSON, header, cookie, shortcode, block, and metadata value at the trust boundary.
• Use strict allowlists and canonical types and reject unexpected fields, oversized arrays, and ambiguous values.
• Treat init, wp_loaded, admin_init, wp_ajax_nopriv_*, and admin_post_nopriv_* callbacks as reachable by anonymous visitors; admin_init also fires for unauthenticated admin-ajax.php and admin-post.php requests. Never use is_admin() as an authorization check, since it only reports an admin-area request; call current_user_can() and verify a nonce inside every state-changing callback that is not intentionally public.
• Bound pagination, uploads, remote requests, image processing, recursion, and hook-triggered work.

Authentication, capabilities, and nonces

• Call current_user_can() with the exact capability and, for meta capabilities (edit_post, delete_user, and similar), the object ID before each protected operation.
• Never use roles, hidden fields, menu visibility, user IDs, or possession of an object ID as authorization.
• Verify browser mutations with check_admin_referer()/check_ajax_referer() for admin/AJAX handlers or the wp_rest nonce for REST