To assist you in developing secure WordPress plugins and themes,
there are a number of tools available that can help you detect security vulnerabilities in your code.
In this lesson, you'll learn about some of the tools available to test your code for
security vulnerabilities and a brief introduction on how to use them. You will also learn where to
find more information about critical security risks to web applications. There are two plugins
available in the WordPress.org repository that can help you validate your code.
Plug-in check is a WordPress plugin that you can use to test whether your plugin meets the
required standards for the WordPress.org plugin directory, with one of those requirements being
that your plugin code is secure. Once the plugin is installed and active, you can access the
plugin check admin page from the tools menu in your WordPress dashboard. Select the plugin you
want to test and make sure the security checkbox is checked. Click the check it button to run the
test. The results are displayed in a table with a list of issues that need to be addressed,
including the file names and line numbers. There is also the theme check plugin, which is similar
to plugin check, but for themes. Once this plugin is installed and active, you can access the theme
check admin page from the appearance menu in your WordPress dashboard. Again, you select the theme
to be checked and click the check it button to run the test. The results are displayed at the
bottom of the page with a list of issues that need to be addressed. If you're looking for something
that can be run from the command line, you can use PHP code sniffer with the WordPress coding
standards rules. This combination not only checks your code against the WordPress coding standards,
but also checks for security vulnerabilities. To use PHP code sniffer with the WordPress coding
standards, you need to install Composer, which is a dependency manager for PHP projects.
Installing Composer is outside the scope of this lesson, but you can find instructions on the
Composer website for both Mac OS and Linux and Windows operating systems. Composer to work,
you also need PHP installed on your computer so that you can use the PHP CLI binary, which
allows you to run PHP scripts in the terminal instead of just the browser. You can find ways
to install PHP on your system in the PHP manual under the installation and configuration section.
Once you've installed PHP, make sure to add the path to the PHP CLI binary to the operating system
path of your computer so that you can run PHP commands from anywhere on your computer.
To test this, you can run PHP minus V and it should give you the PHP version.
Once you have Composer installed, you can run the following command in your terminal to
initiate a new Composer project inside your plugin or theme directory. Composer in it.
Follow the internal instructions to create a new Composer project.
This will create a Composer.json file in the current directory, which will contain a list
of the dependencies for your project. Next, follow the instructions in the WordPress
coding standards repository to install all the required dependencies inside your plugin directory.
So we'll start by allowing the plugin, and then we'll require the coding standards.
With this installed, you can now run PHP code sniffer against your code using the WordPress
standard, and it will output a list of issues that need to be addressed.
Depending on your code editor, there are a number of ways to check for vulnerabilities
while you code. For example, Visual Studio Code has a number of extensions that run the PHP code
sniffer tool inside the editor, which you can find by searching for PHP CS in the Visual Studio Code
extensions marketplace. Additionally, there are third-party services that can scan your code for
vulnerabilities, like Sonos Solar Lint tool. Solar Lint is entirely free for all open source projects.
You only pay for it if you want to analyze private repositories.
Solar Lint is available as a plugin for Visual Studio Code, JetBrains editors, and Eclipse.
When configured correctly, these extensions will highlight issues in your code as you write it,
so you can fix them before you commit your code.
While not specifically a tool, it's also a good idea to familiarize yourself with the Open Web
Application Security Project, or OWASP. OWASP is a non-profit foundation that works to improve
the security of software. They provide a number of resources, including the OWASP Top 10,
which is a list of the top 10 most critical security risks for open source applications.
Security is an ever-changing landscape, and vulnerabilities evolve over time.
By following the OWASP Top 10, you can stay up to date with the latest security risks and best practices.
To learn more about the OWASP Top 10, you can stay up to date with the latest security risks and best practices.