jakariawpxpo / wpguard

v0.2.0 2026-10-21 09:37 UTC

Requires

• php: >=7.4

Suggests

• ext-zip: Needed to scan a release .zip
• squizlabs/php_codesniffer: Needed for the PHPCS step
• wp-coding-standards/wpcs: WordPress Coding Standards for the PHPCS step

MIT

• plugin
• wordpress
• lint
• phpcs
• guidelines
• wpcs
• wordpress.org

Published on Packagist.org on 2026-10-21 11:28 UTC

README

RuboCop/Brakeman-style checker for WordPress plugins, written in PHP. It combines:

1. wpguard rules: WordPress.org plugin guideline candidates (remote assets, tracking, trialware gates, public REST routes, unescaped output, readme and header problems, package files, and more). Run wpguard --rules for the list.
2. PHPCS + WordPress Coding Standards if phpcs is installed, using the plugin's phpcs.xml[.dist] when present.
3. Plugin Check (--pcp), as raw wp plugin check output.

Every finding prints file:line:col and the code line with one line of context. Findings are review candidates, not verdicts.

wpguard                      # scan current directory
wpguard path/to/plugin
wpguard plugin.zip           # scan a release ZIP
wpguard --strict             # PHPCS with --ignore-annotations
wpguard --format=json        # for CI
wpguard --fail-on=medium     # CI exit code

Suppress a reviewed line with // wpguard-ignore: WG-RULE-ID (same line or line above), or use .wpguard.json: {"ignore_rules":["WG-IFRAME"],"ignore_paths":["tests/"]}

Install

git clone https://github.com/jakariawpxpo/wpguard.git
ln -s "$PWD/wpguard/bin/wpguard" ~/.local/bin/wpguard

Or with Composer, once published to Packagist: composer global require jakariawpxpo/wpguard. Needs PHP 7.4+ (the zip extension for ZIP input). Not an official WordPress.org tool; a clean run is not an approval.

Limits: line-based regex rules, so multi-line constructs are missed and some hits are false positives. Trialware, service-substance and readme-versus-code parity still need human review.