<input
    type="text"
    id="<?php echo esc_attr( $args['label_for'] ); ?>"
    name="my_plugin_settings[api_key]"
    value="<?php echo esc_attr( $value ); ?>"
    class="regular-text"
/>
<p class="description">
    <?php esc_html_e( 'Enter your API key from the service provider.', 'my-plugin' ); ?>
</p>
<?php

if ( isset( $input['api_key'] ) ) {
    $sanitized['api_key'] = sanitize_text_field( $input['api_key'] );
}

if ( isset( $input['enable_feature'] ) ) {
    $sanitized['enable_feature'] = (bool) $input['enable_feature'];
}

return $sanitized;

    <?php settings_errors( 'my_plugin_settings' ); ?>

    <form action="options.php" method="post">
        <?php
        // Output security fields
        settings_fields( 'my_plugin_options' );

        // Output settings sections
        do_settings_sections( 'my_plugin_settings_page' );

        // Submit button
        submit_button( __( 'Save Settings', 'my-plugin' ) );
        ?>
    </form>
</div>
<?php

}

WordPress Coding Standards (WPCS) Installation and Configuration

.phpcs.xml.dist:

Custom ruleset for WordPress plugin

<!-- Check all PHP files -->
<file>./includes</file>
<file>./my-plugin.php</file>

<!-- Exclude vendor and node_modules -->
<exclude-pattern>*/vendor/*</exclude-pattern>
<exclude-pattern>*/node_modules/*</exclude-pattern>
<exclude-pattern>*/tests/*</exclude-pattern>

<!-- Use WordPress-Extra rules (includes WordPress-Core + WordPress-Docs) -->
<rule ref="WordPress-Extra">
    <!-- Allow short array syntax [] instead of array() -->
    <exclude name="Generic.Arrays.DisallowShortArraySyntax"/>

    <!-- Allow multiple assignments in one line for simple cases -->
    <exclude name="Squiz.PHP.DisallowMultipleAssignments"/>
</rule>

<!-- Check PHP cross-version compatibility -->
<config name="testVersion" value="8.1-"/>
<rule ref="PHPCompatibilityWP"/>

<!-- Text domain verification -->
<rule ref="WordPress.WP.I18n">
    <properties>
        <property name="text_domain" type="array">
            <element value="my-plugin"/>
        </property>
    </properties>
</rule>

<!-- Prefix all global functions/classes/variables -->
<rule ref="WordPress.NamingConventions.PrefixAllGlobals">
    <properties>
        <property name="prefixes" type="array">
            <element value="my_plugin"/>
            <element value="MyPlugin"/>
        </property>
    </properties>
</rule>

<!-- Show progress and use colors -->
<arg value="ps"/>
<arg name="colors"/>
<arg name="extensions" value="php"/>

Running PHPCS

Check coding standards

vendor/bin/phpcs

Auto-fix fixable issues

vendor/bin/phpcbf

Check specific file

vendor/bin/phpcs includes/Core.php

Show progress and sniff codes

vendor/bin/phpcs -ps

Generate report

vendor/bin/phpcs --report=summary

Key Coding Rules

Indentation: Tabs (not spaces)

// CORRECT function my_function() { if ( true ) { echo 'Hello'; } }

// WRONG (spaces) function my_function() { if ( true ) { echo 'Hello'; } }

Yoda Conditions: Constant on left side

// CORRECT (Yoda) if ( true === $value ) { // ... }

if ( 'active' === $status ) { // ... }

// WRONG if ( $value === true ) { // ... }

Naming Conventions:

// Functions and variables: snake_case function my_plugin_process_data() { } $user_name = 'John';

// Classes: PascalCase class MyPlugin_Database { }

// Constants: UPPERCASE with underscores define( 'MY_PLUGIN_VERSION', '1.0.0' );

Documentation: PHPDoc blocks required

/* * Process user registration * * @param string $username User's username * @param string $email User's email address * @return int|WP_Error User ID on success, WP_Error on failure / function my_plugin_register_user( $username, $email ) { // ... }

Best Practices Security Considerations

Cross-reference: See ../security-validation/SKILL.md for comprehensive security patterns.

Three-layer security model:

Sanitize on input - Remove dangerous characters Validate for logic - Check business rules Escape on output - Prevent XSS // 1. Sanitize input $title = sanitize_text_field( $_POST['title'] ); $email = sanitize_email( $_POST['email'] );

// 2. Validate if ( empty( $title ) || strlen( $title ) < 3 ) { wp_die( 'Invalid title' ); }

if ( ! is_email( $email ) ) { wp_die( 'Invalid email' ); }

// 3. Escape output echo '

' . esc_html( $title ) . '

'; echo '' . esc_html( $email ) . '';

Prefix Everything // Prefix functions function my_plugin_init() { }

// Prefix classes class MyPlugin_Settings { }

// Prefix constants define( 'MY_PLUGIN_VERSION', '1.0.0' );

// Prefix hooks do_action( 'my_plugin_loaded' ); apply_filters( 'my_plugin_content', $content );

// Prefix database tables $wpdb->prefix . 'my_plugin_data';

// Prefix options update_option( 'my_plugin_settings', $data );

Translation-Ready (i18n) // Simple string __( 'Hello World', 'my-plugin' );

// Output translation esc_html__( 'Hello World', 'my-plugin' ); esc_attr__( 'Hello World', 'my-plugin' );

// Echo translation esc_html_e( 'Hello World', 'my-plugin' );

// Plural forms _n( 'One item', '%d items', $count, 'my-plugin' );

// Contextual translation (same word, different meanings) _x( 'Post', 'noun', 'my-plugin' ); _x( 'Post', 'verb', 'my-plugin' );

// With sprintf sprintf( __( 'Hello %s', 'my-plugin' ), $name );

// Load text domain load_plugin_textdomain( 'my-plugin', false, dirname( plugin_basename( FILE ) ) . '/languages' );

Use WordPress Functions Over PHP // ✅ WordPress functions (preferred) $url = esc_url( $link ); $current_time = current_time( 'mysql' ); $user_ip = $_SERVER['REMOTE_ADDR']; // Sanitized by WP

// ❌ Native PHP (avoid when WP alternative exists) $url = htmlspecialchars( $link ); // Use esc_url() instead $current_time = date( 'Y-m-d H:i:s' ); // Use current_time() instead

Performance Considerations

Object caching:

// Set cache wp_cache_set( 'my_key', $data, 'my_plugin', 3600 );

// Get cache $data = wp_cache_get( 'my_key', 'my_plugin' ); if ( false === $data ) { // Cache miss, fetch data $data = expensive_operation(); wp_cache_set( 'my_key', $data, 'my_plugin', 3600 ); }

Transients (database-backed cache):

// Set transient (12 hours) set_transient( 'my_plugin_data', $data, 12 * HOUR_IN_SECONDS );

// Get transient $data = get_transient( 'my_plugin_data' ); if ( false === $data ) { $data = expensive_api_call(); set_transient( 'my_plugin_data', $data, 12 * HOUR_IN_SECONDS ); }

// Delete transient delete_transient( 'my_plugin_data' );

Common Patterns Singleton Pattern class MyPlugin_Service { private static $instance = null;

public static function get_instance() {
    if ( null === self::$instance ) {
        self::$instance = new self();
    }
    return self::$instance;
}

private function __construct() {
    // Initialization
}

// Prevent cloning
private function __clone() { }

// Prevent unserialization
private function __wakeup() { }

}

Dependency Injection /* * Better testability than Singleton / class MyPlugin_Controller { private $database; private $settings;

public function __construct( MyPlugin_Database $database, MyPlugin_Settings $settings ) {
    $this->database = $database;
    $this->settings = $settings;
}

public function process() {
    $data = $this->database->get_data();
    $config = $this->settings->get_config();
    // Process...
}

}

// Usage $database = new MyPlugin_Database(); $settings = new MyPlugin_Settings(); $controller = new MyPlugin_Controller( $database, $settings );

Service Container Pattern class MyPlugin_Container { private $services = [];

public function register( $name, $callback ) {
    $this->services[ $name ] = $callback;
}

public function get( $name ) {
    if ( ! isset( $this->services[ $name ] ) ) {
        throw new Exception( "Service not found: $name" );
    }

    $callback = $this->services[ $name ];
    return $callback( $this );
}

}

// Usage $container = new MyPlugin_Container();

$container->register( 'database', function( $c ) { return new MyPlugin_Database(); });

$container->register( 'settings', function( $c ) { return new MyPlugin_Settings(); });

$container->register( 'controller', function( $c ) { return new MyPlugin_Controller( $c->get( 'database' ), $c->get( 'settings' ) ); });

$controller = $container->get( 'controller' );

Related Skills

When developing WordPress plugins, consider these complementary skills (available in the skill library):

security-validation: WordPress security, nonces, sanitization, validation, escaping - critical for securing plugin functionality block-editor: Block Editor development, FSE, theme.json, custom blocks - extend plugins with modern block-based interfaces phpunit: PHPUnit testing for WordPress plugins - comprehensive testing strategies for WordPress plugin development Resources

Official Documentation:

Plugin Handbook: https://developer.wordpress.org/plugins/ Code Reference: https://developer.wordpress.org/reference/ Coding Standards: https://developer.wordpress.org/coding-standards/

Tools:

WP-CLI: https://wp-cli.org/ WPCS: https://github.com/WordPress/WordPress-Coding-Standards PHPUnit: https://make.wordpress.org/core/handbook/testing/automated-testing/ Summary Modern architecture: OOP with PSR-4 autoloading, Composer dependencies Hooks system: Actions for execution, filters for modification Database: Use $wpdb with prepared statements, custom tables via dbDelta() Settings API: Structured admin pages with sanitization callbacks WPCS compliance: WordPress coding standards via PHPCS Security-first: Sanitize input, validate logic, escape output Translation-ready: Use i18n functions for all user-facing text Performance: Object caching, transients, query optimization