WordPress/WordPress-Coding-Standards

View on GitHub

PHP_CodeSniffer rules (sniffs) to enforce WordPress coding conventions

Stars: 2.8k
Forks: 521
Open beginner issues: 0
Indexed issues: 224
Avg merge: 5d 20h
Merged PRs (30d): 1

Dominant language: PHP
License: MIT
Last GitHub push: Sep 11, 2026
Latest indexed: Sep 20, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

224 open issues indexed

`WPDBTrait::is_wpdb_method_call()`: false positive for a method call on a non-wpdb object Open

Component: Helpers Priority: Low Type: Bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

WordPress/WordPress-Coding-Standards#2759 · Opened Jul 10, 2026
Evaluate switching from branch protection rules to branch rulesets Open

Type: Chores/Cleanup

Difficulty 4/5 3-5 days Newbie friendliness 52/100

WordPress/WordPress-Coding-Standards#2751 · 1 comment · Opened Jul 6, 2026
InputNotSanitized / MissingUnslash: `(int) ( $_GET['x'] ?? 0 )` not recognised as cast-sanitised Open

Component: Extra Type: Bug

Difficulty 3/5 1-2 days Newbie friendliness 30/100

WordPress/WordPress-Coding-Standards#2723 · 1 comment · Opened Apr 20, 2026
DB/PreparedSQLPlaceholders: false negatives for namespaced and method calls to sprintf() Open

Component: Core Focus: DB Type: Bug

Difficulty 2/5 Half a day Newbie friendliness 68/100

WordPress/WordPress-Coding-Standards#2720 · 1 comment · Opened Apr 6, 2026
4.0 | Arrays/ArrayDeclarationSpacing: remove the deprecated `allow_single_item_single_line_associative_arrays` property Open

Component: Core Type: Chores/Cleanup

Difficulty 2/5 1-3 hours Newbie friendliness 55/100

WordPress/WordPress-Coding-Standards#2705 · 1 reaction · Opened Feb 25, 2026
Last 3.x minor | Arrays/ArrayDeclarationSpacing: hard-deprecate the `allow_single_item_single_line_associative_arrays` property Open

Component: Core Type: Chores/Cleanup

Difficulty 5/5 Over a week Newbie friendliness 35/100

WordPress/WordPress-Coding-Standards#2704 · 2 comments · Opened Feb 25, 2026
4.0 | Arrays/ArrayDeclarationSpacing: rename the AssociativeArrayFound error code Open

Component: Core

Difficulty 2/5 1-3 hours Newbie friendliness 55/100

WordPress/WordPress-Coding-Standards#2692 · 1 reaction · Opened Feb 3, 2026
Security/EscapeOutput: incorrect handling of namespaced functions named like array walking functions Open

Component: Extra Priority: Low Type: Bug

Difficulty 3/5 1-2 days Newbie friendliness 48/100

WordPress/WordPress-Coding-Standards#2674 · Opened Dec 16, 2025
Review/Improve case-insensitive handling of custom function lists Open

Component: Helpers Type: Bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

WordPress/WordPress-Coding-Standards#2670 · 2 comments · Opened Dec 9, 2025
`ContextHelper::is_in_function_call()`: bug when namespaced function matches name of a valid function Open

Component: Helpers Type: Bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

WordPress/WordPress-Coding-Standards#2665 · Opened Dec 4, 2025
DB/PreparedSQL: incorrect error identification for namespaced function calls Open

Focus: DB Type: Bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

WordPress/WordPress-Coding-Standards#2648 · Opened Nov 17, 2025
WP/CronInterval: incorrect handling of namespaced first-class callables Open

Component: Extra Focus: Modern PHP Type: Bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

WordPress/WordPress-Coding-Standards#2644 · 1 comment · Opened Nov 11, 2025
`NamingConventions/ValidVariableName`: how should promoted properties be handled? Open

Component: Core Focus: Modern PHP

Difficulty 5/5 Over a week Newbie friendliness 25/100

WordPress/WordPress-Coding-Standards#2639 · 2 comments · Opened Nov 3, 2025
Should WordPress.PHP.DevelopmentFunctions.error_log_print_r be relaxed a little? Open

Status: Awaiting feedback

Difficulty 3/5 1-2 days Newbie friendliness 48/100

WordPress/WordPress-Coding-Standards#2635 · 3 comments · Opened Oct 21, 2025
`WordPress.Utils.I18nTextDomainFixer` and PHPCS 4.0 Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

WordPress/WordPress-Coding-Standards#2634 · 5 comments · Opened Oct 17, 2025
Don't allow input type="password" to have a value Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

WordPress/WordPress-Coding-Standards#2632 · Opened Oct 16, 2025
Is WordPressCS compatible with PHPCS 4.0.0 ? Open

Type: Question

Difficulty 4/5 3-5 days Newbie friendliness 35/100

WordPress/WordPress-Coding-Standards#2622 · 4 comments · 3 reactions · Opened Sep 23, 2025
Advance notice: strategy for dropping support for PHPCS 3.x Open

Meta: Repo

Difficulty 5/5 Over a week Newbie friendliness 30/100

WordPress/WordPress-Coding-Standards#2607 · 6 reactions · Opened Sep 11, 2025
WP/AlternativeFunctions: fails to detect namespaced and class-based function/constant calls Open

Component: Extra Status: Requirement not met Type: Bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

WordPress/WordPress-Coding-Standards#2603 · 1 comment · 1 reaction · Opened Sep 9, 2025
WP/AlternativeFunctions: remove invalid STDIN/STDOUT/STDERR resource handling Open

Component: Extra Status: Needs investigation Type: Enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 55/100

WordPress/WordPress-Coding-Standards#2602 · 3 comments · Opened Sep 9, 2025
wp_send_json/wp_send_json_error/wp_send_json_success XSS/should require escaping Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

WordPress/WordPress-Coding-Standards#2582 · Opened Aug 23, 2025
Meta: Add sniffs for coding standards within this repo Open

Meta: Repo Status: Close candidate Type: Chores/Cleanup

Difficulty 4/5 3-5 days Newbie friendliness 38/100

WordPress/WordPress-Coding-Standards#2577 · 1 comment · Opened Aug 20, 2025
Flag any manual construction of inline `<script>` tags Open

Component: Core Focus: Security Type: Enhancement

Difficulty 4/5 3-5 days Newbie friendliness 42/100

WordPress/WordPress-Coding-Standards#2575 · 2 comments · 1 reaction · Opened Aug 16, 2025
DeprecatedParameterValues: false positives when handling string concatenation and constants Open

Component: Extra Type: Bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

WordPress/WordPress-Coding-Standards#2564 · Opened Jul 25, 2025
PrefixAllGlobals: false negatives when checking group constant declarations Open

Component: Extra Focus: WP interoperability Type: Bug

Difficulty 3/5 1-2 days Newbie friendliness 55/100

WordPress/WordPress-Coding-Standards#2560 · 1 reaction · Opened Jul 22, 2025
Support for PHP 8.3 typed class constants Open

Component: Helpers Focus: Modern PHP

Difficulty 4/5 3-5 days Newbie friendliness 38/100

WordPress/WordPress-Coding-Standards#2546 · 1 reaction · Opened Jul 18, 2025
WordPress.Security.ValidatedSanitizedInput.MissingUnslash and WordPress.Security.ValidatedSanitizedInput.InputNotSanitized on unused SuperGlobals Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

WordPress/WordPress-Coding-Standards#2526 · Opened Mar 28, 2025
Add `do_blocks` to the `$autoEscapedFunctions` list Open

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

WordPress/WordPress-Coding-Standards#2524 · Opened Mar 23, 2025
WP-Core produces inconsistent indentation Open

Status: Close candidate

Difficulty 3/5 1-2 days Newbie friendliness 42/100

WordPress/WordPress-Coding-Standards#2523 · 6 comments · Opened Mar 18, 2025
Check if sniffs using AbstractFunctionParameterSniff are handling variable unpacking correctly Open

Status: Help wanted Type: Bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

WordPress/WordPress-Coding-Standards#2521 · Opened Mar 6, 2025
False positive: sanitize_html_class() incorrectly flagged for missing unslash Open

Component: Extra Type: Bug

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

WordPress/WordPress-Coding-Standards#2516 · 3 comments · Opened Jan 8, 2025
WordPress.PHP.DevelopmentFunctions.error_log_trigger_error : recommend wp_trigger_error() as alternative Open

Difficulty 2/5 1-3 hours Newbie friendliness 50/100

WordPress/WordPress-Coding-Standards#2515 · Opened Dec 26, 2024
WordPress.Security.EscapeOutput: Wiki misses hint about lower case entry for customEscapingFunctions Open

Difficulty 1/5 Under an hour Newbie friendliness 62/100

WordPress/WordPress-Coding-Standards#2508 · 3 comments · Opened Nov 10, 2024
I18n: Report the translatable strings with leading and trailing spaces Open

Component: Core Focus: I18n Status: Good first issue Type: Enhancement

Difficulty 3/5 1-2 days Newbie friendliness 45/100

WordPress/WordPress-Coding-Standards#2501 · 1 comment · Opened Oct 24, 2024
Add support for `INSERT INTO ... VALUES ...` syntax in SQL queries Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

WordPress/WordPress-Coding-Standards#2498 · 1 comment · Opened Oct 2, 2024
Sniff to check that test class names and test file names comply with PHPUnit naming conventions Open

Type: Enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

WordPress/WordPress-Coding-Standards#2484 · 7 comments · 1 reaction · Opened Sep 7, 2024
The function rest_is_ip_address should be not issue for sanitize Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

WordPress/WordPress-Coding-Standards#2483 · 1 comment · Opened Sep 6, 2024
PrefixAllGlobalsSniff: extend blocklist Open

Component: Extra Focus: WP interoperability Status: Good first issue

Difficulty 3/5 1-2 days Newbie friendliness 55/100

WordPress/WordPress-Coding-Standards#2481 · 6 comments · Opened Aug 31, 2024
PrefixAllGlobalsSniff: always flag blocked prefixes Open

Status: Awaiting feedback

Difficulty 3/5 1-2 days Newbie friendliness 35/100

WordPress/WordPress-Coding-Standards#2480 · 4 comments · 1 reaction · Opened Aug 31, 2024
Discourage the use of PHP Sessions Open

Component: Extra Status: Needs investigation Type: Enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

WordPress/WordPress-Coding-Standards#2475 · 1 comment · 1 reaction · Opened Aug 18, 2024
Incorrect array indentation with a single line comment inside the array Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

WordPress/WordPress-Coding-Standards#2474 · Opened Aug 17, 2024
Add sniff to warn about missing `$autoload` parameter when calling relevant WordPress option functions Open

Component: Extra Focus: Code analysis Type: Enhancement

WordPress/WordPress-Coding-Standards#2473 · 22 comments · 1 assignee · Opened Aug 12, 2024
Using a transient should be considered a way of caching a direct database call Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

WordPress/WordPress-Coding-Standards#2463 · 1 reaction · Opened Jun 22, 2024
Document how to write XML documentation files Open

Status: Good first issue Type: Chores/Cleanup Type: Documentation

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

WordPress/WordPress-Coding-Standards#2462 · 2 comments · Opened Jun 19, 2024
The "previous" exception object can not be escaped Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

WordPress/WordPress-Coding-Standards#2447 · 2 comments · 1 reaction · Opened May 27, 2024
Forbid the addition of new magic class methods Open

Status: Needs investigation Type: Enhancement

Difficulty 4/5 3-5 days Newbie friendliness 38/100

WordPress/WordPress-Coding-Standards#2445 · 6 comments · Opened May 17, 2024
Gravatar: Default image requests to the Gravatar service will result in a warning Open

Difficulty 2/5 1-3 hours Newbie friendliness 52/100

WordPress/WordPress-Coding-Standards#2426 · Opened Feb 28, 2024
The PHP `declare` construct Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

WordPress/WordPress-Coding-Standards#2422 · 2 comments · Opened Feb 15, 2024
Outdated sniff: WordPress.WP.EnqueuedResourceParameters.NotInFooter Open

Difficulty 3/5 1-2 days Newbie friendliness 38/100

WordPress/WordPress-Coding-Standards#2420 · 3 comments · Opened Feb 5, 2024
Allow DROP TABLE schema change in uninstall.php Open

Type: Question

Difficulty 3/5 1-2 days Newbie friendliness 42/100

WordPress/WordPress-Coding-Standards#2359 · 6 comments · Opened Aug 18, 2023

WordPress/WordPress-Coding-Standards

Get new issues in your inbox