wpultimatese
6 skills with substantive source documentation and an official publisher or observed installation demand. Read each skill’s original documentation through its card.
wpultimatesecuritycapability-permission-checks
Use when adding admin pages, menu items, AJAX/REST handlers, action links, or any code that performs a privileged operation in WordPress. Gates actions with currentusercan() using the correct capability (not roles), including per-object checks like editpost, and pairs the check with a nonce. Prevents privilege escalation and broken access control. Apply proactively to every privileged code path.
- instalaciones
- 1
- GitHub Stars
- 50
- Actualizado
- 29 sept
wpultimatesecurityfilesystem-security
Use when reading, writing, including, or deleting files from paths that include user input - include / require, readfile, unlink, filegetcontents, or the WPFilesystem API. Validates paths with validatefile, normalizes with wpnormalizepath, confines operations to an allowed base directory, and uses wpdeletefile / WPFilesystem. Prevents path traversal, local file inclusion, and arbitrary file deletion.
- instalaciones
- 1
- GitHub Stars
- 50
- Actualizado
- 29 sept
wpultimatesecuritymultisite-security
Use when writing code that runs on a WordPress multisite network - switchtoblog, network admin pages, getsites, or capabilities that differ between site and network scope. Uses managenetwork / managenetworkoptions and issuperadmin correctly, restores context with restorecurrentblog, isolates per-site data, and never trusts a blog id from input. Prevents cross-site data leakage and network privilege escalation.
- instalaciones
- 1
- GitHub Stars
- 50
- Actualizado
- 29 sept
wpultimatesecuritynonces-csrf-protection
Use when handling any form submission, AJAX request, admin-post action, settings page, link that triggers an action, or any other user-initiated request in a WordPress plugin or theme. Generates nonces with wpnoncefield / wpcreatenonce and verifies them with checkadminreferer, checkajaxreferer, or wpverifynonce, always paired with a capability check, to prevent CSRF. Apply proactively whenever code accepts or acts on a request.
- instalaciones
- 1
- GitHub Stars
- 50
- Actualizado
- 29 sept
wpultimatesecuritysecrets-credentials-management
Use when handling passwords, API keys, tokens, or third-party credentials in a WordPress plugin or theme. Hashes passwords with wphashpassword / wpcheckpassword, generates tokens with wpgeneratepassword, keeps secrets out of code and the database in plaintext, and uses Application Passwords for API auth. Prevents credential leakage and insecure storage.
- instalaciones
- 1
- GitHub Stars
- 50
- Actualizado
- 29 sept
wpultimatesecurityshortcode-block-security
Use when registering a shortcode with addshortcode or a dynamic block with a rendercallback, or processing shortcode / block attributes. Normalizes attributes with shortcodeatts, validates against allowlists, and escapes all rendered output for its context with eschtml, escattr, escurl, or wpksespost. Prevents stored and reflected XSS in rendered content.
- instalaciones
- 1
- GitHub Stars
- 50
- Actualizado
- 29 sept