Your first review
Start with one part of your project and get a review you can check and act on.
Read the guide →WordPress engineering / Claude + Codex
Find the right workflow for your WordPress project, ask a clear question and check the result.
Free & open source. An agent skill pack for your WordPress projects.
$wp-devkit-security-review
Review this plugin without editing files.
Trace authorization and output paths.
Separate confirmed issues from candidates.
Record checks you could not run.01 / Find your footing
Learn how the pack works, establish the project context, then choose a focused review.
Start with one part of your project and get a review you can check and act on.
Read the guide →Choose the installation method that fits your Claude or Codex setup.
Read the guide →Run Doctor, read its report and compare evidence over time.
Read the guide →02 / Choose a domain
Explore every workflow, with a scoped prompt, review steps and an acceptance checklist.
Get to know an unfamiliar WordPress project and decide what to review first.
Read the guide →Follow user input through your WordPress code and check that permissions are enforced.
Read the guide →Find out which queries, hooks or cache behavior are slowing down your project.
Read the guide →Check how your plugin is organized, how it handles its lifecycle and how it works with WordPress.
Read the guide →Work with classic, hybrid, child and block themes without losing saved customizations.
Read the guide →Check your blocks in the editor and on the frontend, including content users have already saved.
Read the guide →Check orders, checkout, payments and background jobs against the way your store actually works.
Read the guide →Check who can use each REST route, what input it accepts and what it returns.
Read the guide →Check your GraphQL schema, content previews and how frontend caches respond to updates.
Read the guide →Plan content that is easy to maintain, and check that your ACF field groups stay in sync.
Read the guide →Build admin screens with clear settings, the right permissions and assets loaded where they are needed.
Read the guide →Design WordPress pages that look good and work well across screen sizes.
Read the guide →Check how your site works with a keyboard, where focus moves and how controls are labelled.
Read the guide →Review the WCAG 2.1 and 2.2 A and AA criteria that apply to your pages, with evidence for each result.
Read the guide →Plan data and schema upgrades, and make sure an interrupted migration can recover.
Read the guide →Plan maintenance with a dry run, progress checkpoints and a clear record of any failures.
Read the guide →Set up PHPStan for WordPress and work through its findings without hiding useful warnings.
Read the guide →Create WordPress demos you can reproduce, and check Blueprints before running them.
Read the guide →Choose tests that cover the things most likely to go wrong in your project.
Read the guide →Check what goes into your release, how it gets deployed and how you can roll it back.
Read the guide →No matching skills. Try a broader term or clear your search.
03 / Finish the work
Keep fixes bounded, validate the relevant behavior and preserve the evidence.
Understand the problem, agree on the fix and check that it works.
Read the guide →Work through migrations, tests, packaging and rollback before you release.
Read the guide →Find answers about setup, updates, reports and common installation problems.
Read the guide →