WPZylos Security

Security primitives: nonces, capabilities, sanitization, rate limiting, and secure uploads.

What You Get

Nonce — CSRF protection with context-prefixed actions
Gate — Capability checking and authorization
Sanitizer — Field-level input sanitization
RateLimiter — Request throttling per user/IP
UploadSecurity — Secure file upload handling

Quick Start

use WPZylos\Framework\Security\Nonce;
use WPZylos\Framework\Security\Gate;
use WPZylos\Framework\Security\Sanitizer;

// Nonce verification
$nonce = new Nonce($context);
if (!$nonce->verify($_POST['_nonce'], 'save_settings')) {
    wp_die('Invalid request');
}

// Capability check
$gate = new Gate();
if (!$gate->can('manage_options')) {
    wp_die('Unauthorized');
}

// Sanitization
$sanitizer = new Sanitizer();
$title = $sanitizer->text($_POST['title']);
$email = $sanitizer->email($_POST['email']);

Documentation

Overview — Security architecture
Installation — Setup
Usage — Core patterns
API Reference — Class documentation
Examples — Real-world usage
Testing — Security testing
Security — Extended security guide
Troubleshooting — Common issues

Common Pitfalls

1. Blanket Sanitization

Bad: Wrong: Sanitize entire arrays

$data = array_map('sanitize_text_field', $_POST);

Good: Correct: Field-level sanitization

$title = $sanitizer->text($_POST['title']);
$content = $sanitizer->html($_POST['content']);

2. Missing Output Escaping

Sanitization is for input. Escaping is for output:

// Sanitize on input
$title = $sanitizer->text($_POST['title']);

// Escape on output
echo esc_html($title);

3. Hardcoded Nonce Actions

Bad: Collision with other plugins:

wp_verify_nonce($token, 'save');  // Generic action

Good: Prefixed via context:

$nonce->verify($token, 'save');  // myplugin_save

wpzylos-validation — Input validation
wpzylos-http — Request handling

Troubleshooting

Overview