classic-theme-security-standards

Classic Theme Security Standards

Use this when writing or reviewing PHP in a classic theme. Themes output most of the HTML on a site, so their main security failure mode is unsafe dynamic output.

This skill complements wp-security-audit; it is theme-specific and focused on templates, functions.php, template parts, and theme forms.

When to Use This Skill

• Reviewing header.php, footer.php, index.php, page.php, single.php, archive.php, 404.php, comments.php, or template-parts/*.php.
• Reviewing functions.php or inc/*.php in a theme.
• Theme code reads $_GET, $_POST, $_REQUEST, $_COOKIE, or custom query vars.
• Theme code prints custom fields, options, term/user meta, search values, image URLs, classes, or inline JS.
• Theme code has a custom form, AJAX handler, template_include override, or direct SQL.

Escape on Output

Escape at the last possible moment, based on context.

Output context	Use
Text node	esc_html( $value )
HTML attribute	esc_attr( $value )
URL	esc_url( $url )
Textarea	esc_textarea( $value )
CSS class fragment	sanitize_html_class( $class ), then esc_attr() if composing attributes
Limited trusted HTML	wp_kses_post( $html ) or wp_kses( $html, $allowed_html )
JavaScript data	wp_json_encode( $data ) inside wp_add_inline_script()
Translation in text	esc_html__( 'Text', 'mytheme' ) or esc_html_e()
Translation in attribute	esc_attr__( 'Text', 'mytheme' ) or esc_attr_e()

<a class="card-link" href="<?php echo esc_url( get_permalink() ); ?>">
    <?php echo esc_html( get_the_title() ); ?>
</a>

Do not escape full editor content with esc_html(). For normal post content, use the_content() and let WordPress content filters run. For custom HTML fields, use wp_kses_post() or a narrower allowlist.

Sanitize Input, Validate Meaning

Request data is slashed. Unslash first, then sanitize, then validate.

$raw_layout = isset( $_GET['layout'] )
    ? wp_unslash( $_GET['layout'] )
    : 'grid';

$layout = sanitize_key( $raw_layout );

if ( ! in_array( $layout, array( 'grid', 'list' ), true ) ) {
    $layout = 'grid';
}