- Article
- Intermediate
- 2 minutes read
- Reviewed August 4, 2026
- Advanced WordPress and integrations
WordPress Coding Standards define conventions for code contributed to the WordPress project and provide a useful baseline for themes, plugins and custom applications.
Standards improve readability, review and collaboration. They do not replace architecture, tests or security analysis.
Standards Areas
WordPress documents standards for:
- PHP.
- JavaScript.
- CSS.
- HTML.
- accessibility.
- inline documentation.
- Markdown.
- GitHub Actions workflows.
Third-party libraries can follow their own established standards.
PHP Standards
PHP standards cover naming, spacing, control structures, database queries, input handling and documentation.
Automated checking commonly uses PHP_CodeSniffer with the WordPress Coding Standards ruleset.
JavaScript and CSS
JavaScript projects can use the WordPress ESLint configuration and Prettier.
CSS standards support predictable formatting and maintainable selectors.
Build tools should report violations in local development and continuous integration.
Project Rules
A project can add stricter rules for:
- Namespaces.
- type declarations.
- static analysis.
- supported PHP versions.
- dependency boundaries.
- deprecations.
- test coverage.
- architecture.
Document where project conventions intentionally differ from core style.
Standards and Compatibility
WordPress coding style sometimes preserves compatibility across a wide ecosystem.
Do not copy an internal core pattern without understanding whether a public theme or plugin has the same constraints.
Automated Enforcement
Include lint commands in the project and CI pipeline.
Formatting tools can fix style automatically, while static analysis and tests address different categories of defects.
Frequently Asked Questions
Must commercial plugins follow WordPress Coding Standards?
They are not universally enforced outside official directories, but they provide a valuable common baseline.
Do coding standards guarantee secure code?
No. They support review but do not replace threat modelling, authorization and secure data handling.
Continue Learning
Previous: Internationalization and Localization