woo-security

WooCommerce Security

Before writing code

Fetch live docs:

1. Web-search site:developer.wordpress.org plugins security for WordPress security handbook
2. Web-search site:developer.woocommerce.com security best practices for WooCommerce security
3. Web-search wordpress security hardening latest for current hardening guidance

Nonces (CSRF Protection)

How Nonces Work

WordPress nonces prevent Cross-Site Request Forgery:

• Generate: wp_create_nonce( 'my_action' ) or wp_nonce_field( 'my_action', 'my_nonce' ) (for forms)
• Verify: wp_verify_nonce( $_POST['my_nonce'], 'my_action' ) or check_admin_referer( 'my_action', 'my_nonce' )
• Valid for 24 hours (two 12-hour ticks)

AJAX Nonces

• Generate: wp_create_nonce( 'my_ajax_action' )
• Pass to JS via wp_localize_script(): ['nonce' => wp_create_nonce('my_ajax_action')]
• Verify in handler: check_ajax_referer( 'my_ajax_action', 'nonce' )

REST API Nonces

• Cookie auth uses X-WP-Nonce header with wp_create_nonce( 'wp_rest' )
• API key auth doesn't need nonces (keys provide authentication)

Capabilities (Authorization)

WordPress Capability System

Always check capabilities before performing actions:

• current_user_can( 'manage_woocommerce' ) — WooCommerce admin
• current_user_can( 'edit_shop_orders' ) — order management
• current_user_can( 'edit_products' ) — product management
• current_user_can( 'view_woocommerce_reports' ) — view reports

WooCommerce Capabilities

| Capability | Access | |------------|--------| | manage_woocommerce | Full WooCommerce admin | | edit_products | Create/edit products | | edit_shop_orders | Manage orders | | view_woocommerce_reports | View analytics/reports | | edit_shop_coupons | Manage coupons |

Custom Capabilities

Register custom capabilities via add_cap() on role objects during plugin activation.

Input Sanitization

Sanitization Functions

Always sanitize data before using or storing it:

| Function | Use For | |----------|---------| | sanitize_text_field() | Single-line text input | | sanitize_textarea_field() | Multi-line text | | sanitize_email() | Email addresses | | sanitize_url() | URLs | | absint() | Positive integers | | intval() | Integers (any sign) | | floatval() | Float numbers | | wp_kses() | HTML with allowed tags | | wp_kses_post() | HTML safe for post content | | wc_clean() | WooCommerce string/array sanitizer | | wc_sanitize_textarea() | WooCommerce textarea sanitizer |

Array Sanitization

wc_clean() recursively sanitizes arrays — use for multi-value inputs.

File Upload Validation

• Validate MIME type with wp_check_filetype()
• Use wp_handle_upload() for proper file upload processing
• Never trust file extensions — validate content

Output Escaping

Escaping Functions

Always escape data on output:

| Function | Context | |----------|---------| | esc_html() | Inside HTML tags | | esc_attr() | HTML attribute values | | esc_url() | URLs (href, src) | | esc_js() | Inline JavaScript | | esc_textarea() | Inside textarea elements | | wp_kses() | HTML with specific allowed tags | | wp_kses_post() | HTML safe for post content |

Translation + Escaping

Combine translation with escaping:

• esc_html__() / esc_html_e() — escaped translated strings
• esc_attr__() / esc_attr_e() — escaped for attributes
• wp_kses( sprintf(...), $allowed_html ) — formatted HTML

The Rule

Sanitize early (on input), escape late (on output). Never trust any data from users, databases, or external APIs.

Data Validation

Validation Patterns

• Validate data type, format, and range before processing
• Use is_email(), wp_http_validate_url(), WordPress validators
• WooCommerce validators: wc_format_decimal(), wc_is_valid_url()
• Return errors via WP_Error or wc_add_notice( $msg, 'error' )

SQL Injection Prevention

Prepared Statements

Always use $wpdb->prepare() for custom queries:

• $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}my_table WHERE id = %d", $id )
• Placeholders: %d (integer), %s (string), %f (float)
• Never concatenate user input into SQL strings

Use CRUD/APIs Instead

Prefer WooCommerce CRUD and WordPress APIs over raw SQL:

• wc_get_orders(), wc_get_products() — safe query builders
• $order->get_meta(), $product->get_price() — safe data access

PCI Compliance Considerations

• Never store raw credit card numbers
• Use tokenized payment methods (Stripe, Braintree SDKs handle card data client-side)
• Serve checkout over HTTPS
• Keep WordPress, WooCommerce, and all plugins up to date
• Use payment gateways that are PCI DSS compliant

Additional Hardening

• Set DISALLOW_FILE_EDIT in wp-config.php
• Limit login attempts (plugin or .htaccess)
• Use strong admin passwords and enforce password policies
• Enable two-factor authentication for admin users
• Keep all software updated (WordPress, WooCommerce, plugins, PHP)
• Use HTTPS everywhere
• Set secure cookie flags
• Restrict REST API access where appropriate (rest_authentication_errors filter)
• Disable XML-RPC if not needed: add_filter( 'xmlrpc_enabled', '__return_false' )

Best Practices

• Check nonces on every form submission and AJAX request
• Check capabilities before every privileged operation
• Sanitize ALL input — even from trusted sources
• Escape ALL output — even data from the database
• Use $wpdb->prepare() for any custom SQL
• Never store sensitive data in plain text
• Use WordPress APIs instead of raw PHP functions for security-sensitive operations
• Run security audits with WPScan or similar tools

Fetch the WordPress Security handbook and WooCommerce security documentation for exact function signatures, capability mappings, and current best practices before implementing.