wp-phpstan-static-analysis

PHPStan static analysis for WordPress

PHPStan catches type errors, dead code, and bad calls without running anything. It doesn't load WordPress, so it needs stubs for core's functions/classes — szepeviktor/phpstan-wordpress provides those plus WP-aware rules. This skill wires it up and tames the WP-specific noise. PHPCS (wp-phpcs-coding-standards) covers style; PHPStan covers types/logic — run both.

When to use this skill

• Adding static analysis to a plugin/theme.
• Writing or reviewing phpstan.neon / phpstan.neon.dist.
• Raising the analysis level on existing code (and baselining the backlog).
• Killing WP-specific false positives (apply_filters arg counts, is_wp_error(), $wpdb, conditional constants).

Install

composer require --dev szepeviktor/phpstan-wordpress
composer require --dev phpstan/extension-installer   # recommended: auto-registers the extension

szepeviktor/phpstan-wordpress (2.0.3) pulls in phpstan/phpstan ^2.0 and php-stubs/wordpress-stubs ^6.6.2 transitively — you don't normally add those yourself. It requires PHPStan 2.0+.

At the WordPress 7.1 audit date, the newest tagged wordpress-stubs release is 7.0.1. Composer can therefore analyze ordinary plugin code, but new 7.1-only symbols may still be reported as unknown. Do not silence those errors broadly. Feature-detect the API for older WordPress support and add a small reviewed project stub for the missing 7.1 declaration, then remove it when an official 7.1 stubs package is available.

phpstan/extension-installer is a Composer plugin that auto-includes any installed phpstan-extension package's config, so you don't hand-wire the include. Composer 2.2+ needs it in allow-plugins:

{
  "config": {
    "allow-plugins": {
      "phpstan/extension-installer": true
    }
  }
}

Configure (phpstan.neon.dist)

With extension-installer, the config is minimal — the extension auto-registers:

parameters:
    level: 5
    paths:
        - my-plugin.php
        - includes/