WordPress for Developers
Custom REST Endpoints Without Leaving a Hole Open
permission_callback is required, and __return_true is a decision not a placeholder. Namespaces, argument validation, and what a public endpoint really means.
Browse the archive
Tag: Application Security
WordPress for Developers
$wpdb->prepare and the Queries That Get Sites Hacked
prepare is not a formatting helper. What it does, what it cannot do, why a table name can never be a placeholder, and how…
WordPress for Developers
Nonces Are Not Authentication: What They Actually Protect
WordPress nonces protect against CSRF, not authentication or authorization. See how capability checks, sanitization, Ajax, and REST security fit together.
WordPress for Developers
Sanitize, Escape, Validate: Which One, Where, and Why Order Matters
Validate input, sanitize before storage, and escape at output. Understand where each step belongs in WordPress and PHP and why the order matters for…