$npx -y skills add mralaminahamed/wp-dev-skills --skill wp-coding-standardsUse when setting up PHPCS with WordPress Coding Standards (WPCS), configuring phpcs.xml.dist, running phpcs/phpcbf, fixing sniff violations, adding PHPCS to CI (GitHub Actions), configuring IDE integration, or verifying a plugin meets WP.org code style requirements. Covers squizl
| 1 | # WordPress Coding Standards (PHPCS + WPCS) |
| 2 | |
| 3 | > **Model note:** Setup and config steps are mechanical (`haiku`). Fixing sniff violations across many files works fine on `haiku`. Only reach for `sonnet`/`opus` when violations involve subtle logic (e.g. escaping inside complex SQL builders). |
| 4 | |
| 5 | Configure and enforce the WordPress Coding Standards via PHP_CodeSniffer. WPCS is required for WP.org submission and is the canonical style guide for all WordPress PHP code. |
| 6 | |
| 7 | ## When to use |
| 8 | |
| 9 | - "Set up PHPCS for my plugin", "add WordPress coding standards", "configure phpcs.xml". |
| 10 | - "Fix sniff violations", "run phpcbf", "auto-fix coding standards". |
| 11 | - "Add PHPCS to GitHub Actions / CI". |
| 12 | - "Why is PHPCS flagging X?", "suppress a false-positive sniff". |
| 13 | - Pre-submission audit: "is my code style WP.org–compliant?" |
| 14 | |
| 15 | **Not for:** PHPStan static analysis or type checking — use `wp-phpstan-stubs`. Security auditing beyond style issues — use `wp-plugin-audit`. |
| 16 | |
| 17 | ## Method |
| 18 | |
| 19 | ### 1. Install |
| 20 | |
| 21 | ```bash |
| 22 | composer require --dev squizlabs/php_codesniffer wp-coding-standards/wpcs dealerdirect/phpcodesniffer-composer-installer |
| 23 | ``` |
| 24 | |
| 25 | Current **WPCS is 3.1** (July 2026) — requires PHP 7.4+ and PHP_CodeSniffer 3.9+. Leave the requirement unpinned (as above) or pin `wp-coding-standards/wpcs:"^3.1"`; the 3.x line recognizes pluggable functions and reserved post types through WP 6.4/6.5 and defaults `minimum_supported_wp_version` to 6.2. |
| 26 | |
| 27 | `dealerdirect/phpcodesniffer-composer-installer` auto-registers WPCS paths so no manual `--config-set` is needed. Verify: |
| 28 | |
| 29 | ```bash |
| 30 | vendor/bin/phpcs -i |
| 31 | # should list: WordPress, WordPress-Core, WordPress-Docs, WordPress-Extra |
| 32 | ``` |
| 33 | |
| 34 | ### 2. Configure `phpcs.xml.dist` |
| 35 | |
| 36 | Place at project root. This is the canonical config file (`.dist` allows local `phpcs.xml` override). |
| 37 | |
| 38 | ```xml |
| 39 | <?xml version="1.0"?> |
| 40 | <ruleset name="My Plugin"> |
| 41 | <description>WordPress Coding Standards for My Plugin</description> |
| 42 | |
| 43 | <!-- What to scan --> |
| 44 | <file>.</file> |
| 45 | <exclude-pattern>vendor/*</exclude-pattern> |
| 46 | <exclude-pattern>node_modules/*</exclude-pattern> |
| 47 | <exclude-pattern>build/*</exclude-pattern> |
| 48 | <exclude-pattern>*.min.js</exclude-pattern> |
| 49 | <exclude-pattern>*.min.css</exclude-pattern> |
| 50 | <exclude-pattern>tests/bootstrap.php</exclude-pattern> |
| 51 | |
| 52 | <!-- PHP version target --> |
| 53 | <config name="testVersion" value="7.4-"/> |
| 54 | |
| 55 | <!-- Ruleset --> |
| 56 | <rule ref="WordPress-Extra"> |
| 57 | <!-- Suppress if you use short array syntax (WP allows it since WP 5.5) --> |
| 58 | <!-- <exclude name="Generic.Arrays.DisallowShortArraySyntax"/> --> |
| 59 | </rule> |
| 60 | <rule ref="WordPress-Docs"/> |
| 61 | |
| 62 | <!-- Text domain for i18n sniffs --> |
| 63 | <rule ref="WordPress.WP.I18n"> |
| 64 | <properties> |
| 65 | <property name="text_domain" type="array" value="my-plugin"/> |
| 66 | </properties> |
| 67 | </rule> |
| 68 | |
| 69 | <!-- Minimum WP version for deprecated functions --> |
| 70 | <rule ref="WordPress.WP.DeprecatedFunctions"> |
| 71 | <properties> |
| 72 | <property name="minimum_supported_version" value="5.9"/> |
| 73 | </properties> |
| 74 | </rule> |
| 75 | |
| 76 | <!-- Prefix all globals --> |
| 77 | <rule ref="WordPress.NamingConventions.PrefixAllGlobals"> |
| 78 | <properties> |
| 79 | <property name="prefixes" type="array" value="my_plugin,MyPlugin"/> |
| 80 | </properties> |
| 81 | </rule> |
| 82 | |
| 83 | <!-- Show sniff codes in output (for targeted suppression) --> |
| 84 | <arg value="ps"/> |
| 85 | <arg name="extensions" value="php"/> |
| 86 | <arg name="colors"/> |
| 87 | </ruleset> |
| 88 | ``` |
| 89 | |
| 90 | ### 3. Run |
| 91 | |
| 92 | ```bash |
| 93 | # Check |
| 94 | vendor/bin/phpcs |
| 95 | |
| 96 | # Auto-fix (safe mechanical fixes only — review after) |
| 97 | vendor/bin/phpcbf |
| 98 | |
| 99 | # Single file or directory |
| 100 | vendor/bin/phpcs includes/class-my-class.php |
| 101 | |
| 102 | # Show full sniff code for each violation (useful for writing suppressions) |
| 103 | vendor/bin/phpcs --report=full -s |
| 104 | ``` |
| 105 | |
| 106 | ### 4. Inline suppression |
| 107 | |
| 108 | Suppress only when the s |