A simple tool for generating structured security audit prompts for WordPress plugins, especially useful for people creating plugins with AI coding tools.
The generated prompt can be used with ChatGPT, Claude, Gemini, or another AI model together with your WordPress plugin source code.
The goal is simple: before installing or publishing AI-generated plugin code, give the AI a structured security checklist and ask it to review the code properly.
AI makes it much easier to create WordPress plugins, even without extensive PHP or WordPress development experience.
But code that works is not necessarily code that is secure.
A generated plugin may still contain issues such as:
- SQL Injection
- Cross-Site Scripting (XSS)
- CSRF / nonce problems
- Missing capability checks
- Privilege escalation
- Insecure file uploads
- Path traversal
- Remote Code Execution
- SSRF
- Insecure deserialization
- Hardcoded secrets or sensitive data exposure
- Open redirects
- XXE
This tool creates a detailed security-audit prompt that tells the AI what to look for, how to analyze the code, and how to report potential vulnerabilities.
The generated prompt can include checks based on the official WordPress Security documentation, including:
- Sanitization — correct use of
sanitize_*()functions - Validation — allowlists, strict comparisons and early validation
- Escaping —
esc_html(),esc_attr(),esc_url(),wp_kses()and related functions - Nonces —
wp_nonce_field(),check_admin_referer(),check_ajax_referer() - Capabilities — correct use of
current_user_can() - Database security — correct use of
$wpdb->prepare()for custom SQL queries
Official documentation:
https://developer.wordpress.org/apis/security/
-
Open the HTML tool in your browser.
-
Enter some basic information about your plugin:
- Plugin name
- Version or code source
- Target WordPress version
- A short description of what the plugin does
-
Select the vulnerability classes you want checked.
-
Select the WordPress security guidelines you want included.
-
Choose the minimum severity level:
- Low+
- Medium+
- High+
- Critical only
-
Optionally add extra instructions.
-
Click Copy prompt.
-
Paste the generated prompt into your AI model.
-
Provide the AI with the PHP/source files of your plugin and ask it to perform the audit.
The generated prompt instructs the AI to:
- Map the plugin's attack surface
- Inspect AJAX handlers
- Inspect REST API endpoints
- Inspect shortcodes and admin pages
- Review form and user-controlled input
- Trace input from entry point to potentially dangerous operations
- Check sanitization, validation and output escaping
- Review authorization and capability checks
- Review custom database queries
- Identify potentially exploitable vulnerabilities
- Provide proof-of-concept examples where appropriate
- Classify findings by severity
- Explain the impact
- Suggest WordPress-specific remediation
- Reference the relevant WordPress security documentation
- Produce a prioritized remediation roadmap
You create a WordPress plugin using an AI coding assistant.
Instead of simply asking:
Is this plugin secure?
use the generated security audit prompt together with your plugin source code.
The AI receives much more specific instructions about the WordPress security controls and vulnerability classes it should inspect.
This does not guarantee that every vulnerability will be found, but it gives the AI a significantly more structured security-review task than a generic request.
This tool does not perform the security audit itself.
It generates a structured prompt that you can give to an AI model.
AI-generated security findings can contain both false positives and false negatives. A plugin reported as secure by an AI model should not automatically be considered safe for production.
For important, public-facing or sensitive WordPress installations, AI-assisted review should be considered an additional security check, not a replacement for professional code review, penetration testing or a proper security audit.
This project is primarily aimed at:
- People experimenting with AI-generated WordPress plugins
- Beginners learning WordPress plugin development
- WordPress users using AI coding assistants
- Developers who want a reusable first-pass security review prompt
You do not need to be a security specialist to use the prompt builder.
The security guidance included by the tool is based on the official WordPress developer documentation:
-
Sanitizing Data https://developer.wordpress.org/apis/security/sanitizing/
-
Validating Data https://developer.wordpress.org/apis/security/data-validation/
-
Escaping Data https://developer.wordpress.org/apis/security/escaping/
-
Nonces https://developer.wordpress.org/apis/security/nonces/
-
User Roles & Capabilities https://developer.wordpress.org/apis/security/user-roles-and-capabilities/
-
Common Vulnerabilities https://developer.wordpress.org/apis/security/common-vulnerabilities/
Built by Lefteris using Claude Code.
WebHosting4U https://webhosting4u.gr
AI can help you write the plugin. Make sure you also ask it to review what it wrote.