WordPress security analysis with houtini-lm

Quick Start

Jump straight in with these WordPress security prompts that catch the issues that matter:

Please check this WordPress plugin for security issues: C:/wp-content/plugins/my-plugin/admin/class-admin.php

Analyse this WordPress theme functions file for security vulnerabilities: C:/themes/my-theme/functions.php

Review this WordPress AJAX handler for nonce and capability issues: C:/plugins/contact-form/ajax-handler.php

WordPress Security Focus

WordPress security isn't just about general web security - it has its own unique patterns, vulnerabilities, and best practices. analyze_wordpress_security is your specialist WordPress security consultant that knows exactly what to look for.

This isn't a generic security scanner - it understands WordPress architecture and checks for the specific vulnerabilities that plague WordPress sites:

• Nonce Verification - Missing or incorrect nonce checks in forms and AJAX handlers
• Capability Management - Proper user role and permission verification
• SQL Injection Prevention - WordPress-specific database query security
• Data Sanitisation & Escaping - WordPress functions for safe data handling
• Hook Security - Secure implementation of WordPress hooks and filters
• OWASP Top 10 - Industry-standard vulnerability categories adapted for WordPress

The analysis is conservative and WordPress-focused - it won't overwhelm you with generic warnings, but will flag the specific security patterns that WordPress sites need to get right.

Parameters

Configure your WordPress security analysis to focus on exactly what you need:

*One of filePath, code, or projectPath is required - choose based on your analysis scope

Real-World WordPress Security Examples

Here's how to catch the security issues that actually matter in WordPress development:

Plugin Admin Panel Security

houtini-lm:analyze_wordpress_security with:
- projectPath: "C:/wp-content/plugins/contact-manager"
- analysisType: "comprehensive"
- analysisDepth: "comprehensive"
- wpVersion: "6.4"
- auditDatabaseQueries: true
- checkCapabilities: true

AJAX Handler Security Review

houtini-lm:analyze_wordpress_security with:
- filePath: "C:/wp-content/plugins/my-plugin/includes/ajax-handlers.php"
- analysisType: "wordpress"
- analysisDepth: "detailed"
- auditDatabaseQueries: true

Theme Functions Security Check

houtini-lm:analyze_wordpress_security with:
- filePath: "C:/wp-content/themes/my-theme/functions.php"
- analysisType: "comprehensive"
- checkCapabilities: true
- includeOwaspTop10: true

Code Snippet Security Review

houtini-lm:analyze_wordpress_security with:
- code: "function handle_form_submission() { if (!wp_verify_nonce($_POST['nonce'], 'my_action')) { wp_die('Security check failed'); } }"
- analysisType: "wordpress"
- analysisDepth: "detailed"

Security Analysis Results

Get actionable security insights tailored specifically for WordPress development:

🛡️ WordPress-Specific Vulnerability Detection

• Nonce Issues - Missing wp_verify_nonce() calls, incorrect nonce generation
• Capability Problems - Missing current_user_can() checks, role escalation risks
• Data Sanitisation Gaps - Missing sanitize_text_field(), wp_kses() usage
• Output Escaping Issues - Missing esc_html(), esc_attr(), esc_url() calls
• Hook Security - Insecure add_action(), add_filter() implementations

🗃️ SQL Injection Analysis

• $wpdb Security - Proper use of $wpdb->prepare() for custom queries
• Meta Queries - Safe handling of get_post_meta(), update_post_meta()
• Custom Database Tables - Security patterns for plugin-specific tables
• Query Building - Safe construction of WHERE clauses and joins

🔒 OWASP Top 10 Compliance

• Injection Vulnerabilities - SQL, NoSQL, OS command injection risks
• Broken Authentication - Session management, password policies
• Sensitive Data Exposure - Data protection, encryption requirements
• XML External Entities (XXE) - XML processing vulnerabilities
• Security Misconfiguration - WordPress-specific configuration issues

📋 WordPress Coding Standards Compliance

• Security Functions - Proper use of WordPress security APIs
• Data Validation - WordPress-approved validation patterns
• Error Handling - Safe error reporting that doesn't expose system details
• File Operations - Secure file upload and handling practices

WordPress-Specific Security Checks

Unlike generic security scanners, this analysis understands WordPress architecture and the unique security challenges it presents:

🔐 Nonce Verification

WordPress nonces are critical for preventing CSRF attacks, but they're often implemented incorrectly:

• Missing wp_verify_nonce() checks in form handlers
• Incorrect nonce action names or missing context
• AJAX requests without proper nonce verification
• Admin vs frontend nonce handling differences

⚡ Capability and Permission Checks

WordPress has a sophisticated role and capability system that needs proper implementation:

• Missing current_user_can() checks before sensitive operations
• Using overly broad capabilities (like 'manage_options' for everything)
• Plugin-specific capability implementation
• Multisite capability considerations

🗄️ Database Security Patterns

WordPress database interactions have specific security patterns that must be followed:

• Proper use of $wpdb->prepare() for all dynamic queries
• Safe handling of post meta, user meta, and options
• Custom table security patterns
• Avoiding direct SQL where WordPress functions exist

🧹 Data Sanitisation and Escaping

WordPress provides specific functions for safe data handling:

• Input Sanitisation: sanitize_text_field(), sanitize_email(), absint()
• Output Escaping: esc_html(), esc_attr(), esc_url()
• Content Filtering: wp_kses() for allowed HTML
• Context-Specific: Different escaping for HTML, attributes, JavaScript, CSS

Perfect Use Cases

Here's when WordPress security analysis becomes your essential tool:

🔒 Pre-Deployment Security Checks

Before pushing WordPress code to production, catch security issues that could compromise your site. Essential for client work where security breaches reflect on your reputation.

📦 Plugin Development & WordPress.org Submission

WordPress.org has strict security requirements for plugin submissions. This analysis helps ensure your plugin meets those standards before submission, saving review cycles.

🛠️ Client Code Reviews

When taking over a client's existing WordPress site, quickly assess the security posture of their custom code, themes, and plugins.

🏥 Security Incident Response

When a WordPress site has been compromised, analyse the codebase to identify vulnerabilities that may have been exploited and ensure they're properly fixed.

📚 Learning WordPress Security Best Practices

Understand WordPress security patterns by analysing both good and problematic code. Learn the specific WordPress functions and patterns that keep sites secure.

🔄 Legacy Code Modernisation

When updating old WordPress plugins or themes, identify deprecated security patterns and update them to modern WordPress standards.

Best Practices

Get the most comprehensive WordPress security analysis with these expert techniques:

🎯 Specify Your WordPress Context

Always include WordPress-specific context for the most accurate analysis:

• WordPress version you're targeting (affects available security functions)
• Plugin vs theme context (different security considerations)
• Whether it's for WordPress.org submission (stricter requirements)
• Multisite considerations if relevant

⚙️ Choose the Right Analysis Depth

• "basic" - Quick security overview, good for initial assessment
• "detailed" - Thorough analysis, perfect for most development work
• "comprehensive" - Deep security audit, use for production code and WordPress.org submissions

🔍 Focus Your Analysis Type

• "wordpress" - WordPress-specific security patterns and functions
• "owasp" - Industry-standard OWASP Top 10 compliance
• "comprehensive" - Both WordPress-specific and OWASP standards

🏗️ Analysis Workflow Integration

Make WordPress security analysis part of your development routine:

• Analyse AJAX handlers and form processors before testing
• Review admin pages and settings before deployment
• Check database interaction code during development
• Audit custom post types and meta handling
• Review user-facing functionality for capability checks

📝 Security Documentation

Use the analysis results to improve your security documentation:

• Document security assumptions and requirements
• Create security checklists for your team
• Note WordPress version dependencies for security features
• Record capability requirements for different functions

Troubleshooting

Resolve common issues with WordPress security analysis: