Developer Security Best Practices

Custom integrations should follow normal WordPress security practices.

Server-side best practices

• Sanitize input before storage or output.
• Escape output in templates.
• Check capabilities before changing admin settings.
• Use nonces for custom admin actions.
• Do not log secrets, tokens, passwords, or full webhook payloads unless required.
• Validate file uploads and do not trust file extensions alone.

Front-end best practices

• Never trust JavaScript validation as the only validation layer.
• Do not expose private API keys in browser scripts.
• Use JavaScript events for UX customization, but enforce business rules on the server.