# Security, Compliance & Accessibility Rules > **MANDATORY RULES** - These must be followed in ALL code generation and modifications --- ## 🔒 Security Rules (Zero Tolerance) ### Authentication & Authorization - **NEVER** use `is_admin()` as a security check - it only checks page location - **ALWAYS** use `current_user_can()` for capability checks - **REQUIRED** nonce verification for all POST requests: `wp_verify_nonce()` or `check_admin_referer()` - **FORBIDDEN** `wp_ajax_nopriv_` hooks for sensitive actions - **MANDATORY** `permission_callback` for all REST API endpoints (never `__return_true`) ### Input Validation & Sanitization - **VALIDATE EARLY**: Use `is_email()`, `is_int()`, `absint()`, `validate_file()` - **SANITIZE INPUT**: `sanitize_text_field()`, `sanitize_key()`, `sanitize_email()` - **ESCAPE LATE**: Use context-specific escaping at output point: - HTML: `esc_html()`, `esc_html__()` - Attributes: `esc_attr()`, `esc_attr__()` - URLs: `esc_url()` - JavaScript: `esc_js()`, `wp_json_encode()` ### Database Security - **FORBIDDEN**: Direct variable concatenation in SQL queries - **MANDATORY**: Use `$wpdb->prepare()` with placeholders (`%s`, `%d`, `%f`) - **ORDER BY**: Use whitelist validation or `sanitize_sql_orderby()` - **LIKE queries**: Use `$wpdb->esc_like()` before `prepare()` ### File Operations - **UPLOADS**: Always use `wp_handle_upload()` with restricted MIME types - **INCLUDES**: Validate file paths with `validate_file()` and whitelist - **FORBIDDEN**: `unserialize()` on user input - use `json_decode()` instead ### Network Security - **REMOTE REQUESTS**: Use `wp_safe_remote_get()` instead of `wp_remote_get()` - **REDIRECTS**: Use `wp_safe_redirect()` instead of `wp_redirect()` --- ## 📋 WordPress.org Compliance Rules ### Naming Conventions - **PREFIX**: All functions, classes, constants must use `presszone_translate_` prefix (minimum 4 chars) - **DATABASE OPTIONS**: All option names must start with full prefix - **FORBIDDEN**: Generic names like `save_data()`, `admin_init()`, `Debug()` ### Code Standards - **DIRECT ACCESS**: Every PHP file must start with: `if ( ! defined( 'ABSPATH' ) ) exit;` - **TEXT DOMAIN**: Must match plugin slug exactly: `'translate-press-zone'` - **ENQUEUING**: Never enqueue globally - check specific admin pages with `$hook` parameter - **NO CDNs**: All assets must be bundled locally ### Performance - **AUTOLOADING**: Use WordPress autoloading, not Composer for production - **CACHING**: Implement proper caching for expensive operations - **DATABASE**: Minimize queries, use proper indexing --- ## ♿ Accessibility Rules (WCAG 2.1 AA) ### Semantic HTML - **HEADINGS**: Proper hierarchy (h1 → h2 → h3), no skipping levels - **LANDMARKS**: Use `
`, `