README

Custom PHPStan rules for WordPress projects. Provides a unified static analysis configuration and custom rules across all Apermo projects.

Requirements

composer require --dev apermo/phpstan-wordpress-rules

If you use phpstan/extension-installer, the rules are registered automatically.

Add to your phpstan.neon:

includes:
    - vendor/apermo/phpstan-wordpress-rules/rules.neon

This package automatically includes:

Rule	Category	What it detects
DisallowQueryPostsRule	wp-api	`query_posts()` usage
PostTypeNameLengthRule	wp-api	`register_post_type()` name > 20 chars
TaxonomyNameLengthRule	wp-api	`register_taxonomy()` name > 32 chars
TransientExpirationRule	wp-api	`set_transient()` without expiration
RemoteRequestTimeoutRule	wp-api	`wp_remote_*` without explicit timeout
PreSerializedDataRule	data-integrity	Pre-serialized data in WP storage functions
PreEncodedJsonDataRule	data-integrity	Pre-encoded JSON in WP storage functions
NoDynamicCodeExecutionRule	security	`create_function()`, `assert()` with string, `preg_replace()` with `/e`
NoEvalRule	security	`eval()` usage
UnsafeUnserializeRule	security	`unserialize()` without `allowed_classes`
NoHtmlDomParsingRule	code-quality	`DOMDocument::loadHTML`, tidy functions, `Masterminds\HTML5`
NoConcatenationInTranslationRule	i18n	String concatenation inside `__()`, `_e()`, etc.
NoBlanketSuppressionRule	code-quality	`phpcs:disable`/`phpcs:ignore`/`@phpstan-ignore` without specific rules

composer install

composer test

composer analyse

composer cs

MIT — see LICENSE for details.