Overview

WPZylos Security provides essential security utilities for WordPress plugins: nonce management, capability gates, sanitization, and escaping helpers.

Purpose

Security is non-negotiable in WordPress. This package provides:

1. Nonce Manager - Create and verify nonces with automatic prefixing
2. Gate - Capability-based authorization with clean API
3. Sanitizer - Per-field input sanitization with explicit modes
4. Escape Helpers - Safe output functions (e(), ea(), eu(), kses())

Key Components

Nonce

Context-aware nonce creation and verification:

use WPZylos\Framework\Security\Nonce;

$nonce = new Nonce($context);

// Create nonce for form (prefixed: myplugin_save_settings)
$token = $nonce->create('save_settings');

// In form
echo '<input type="hidden" name="_wpnonce" value="' . ea($token) . '">';

// Verify on submit
if (!$nonce->verify($_POST['_wpnonce'], 'save_settings')) {
    wp_die('Security check failed');
}

Gate

Capability checking with authorize/deny pattern:

use WPZylos\Framework\Security\Gate;

$gate = new Gate();

// Authorize or die
$gate->authorize('manage_options');

// Check without dying
if ($gate->can('edit_posts')) {
    // User has capability
}

Sanitizer

Per-field input sanitization:

use WPZylos\Framework\Security\Sanitizer;

$sanitizer = new Sanitizer();
$clean = $sanitizer->sanitize($_POST, [
    'name' => 'text',
    'email' => 'email',
    'website' => 'url',
    'content' => 'html',
]);

Escape Helpers

Global functions for safe output:

// Escape for HTML attribute
echo '<input value="' . ea($value) . '">';

// Escape for URL
echo '<a href="' . eu($url) . '">Link</a>';

// Escape for HTML content
echo e($content);

// KSES for allowed HTML
echo kses($html, ['strong', 'em', 'a']);

Design Philosophy

1. Explicit Over Implicit - Every sanitization/escape is intentional
2. Fail Secure - Deny on invalid nonce/capability
3. Plugin-Scoped - Nonces use plugin prefix to avoid collisions