wp-dev-prompts/platforms/cursor/cursorrules.template at main · courtneyr-dev/wp-dev-prompts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
# .cursorrules Template for WordPress Projects

> **Platform**: Cursor
> **Purpose**: Project-specific rules for Cursor AI
> **Usage**: Copy to your project root as `.cursorrules`

## Instructions

Copy this file to your WordPress plugin/theme project root as `.cursorrules` and customize the placeholders.

---

# WordPress Development Rules

## Project Context

You are working on a WordPress [plugin/theme] called [PROJECT_NAME].

- **Slug**: [project-slug]
- **Text Domain**: [text-domain]
- **Prefix**: [prefix_]
- **Minimum WordPress**: 6.9
- **Minimum PHP**: 8.2

## Coding Standards

### PHP Standards

- Follow WordPress PHP Coding Standards
- Use tabs for indentation
- Use Yoda conditions: `if ( 'value' === $var )`
- Add spaces inside parentheses: `function_name( $arg )`
- Use single quotes for strings unless interpolating

### JavaScript Standards

- Follow WordPress JavaScript Coding Standards
- Use tabs for indentation
- Use @wordpress/scripts for builds
- Prefer @wordpress packages over custom implementations

### Naming Conventions

- Functions: `[prefix_]snake_case`
- Classes: `[Prefix_]Class_Name`
- Constants: `[PREFIX_]UPPER_CASE`
- Hooks: `[prefix_]_hook_name`

## Security Requirements

ALWAYS when handling user input:
1. Sanitize input with appropriate function (sanitize_text_field, absint, etc.)
2. Escape output with context function (esc_html, esc_attr, esc_url)
3. Verify nonces for form submissions
4. Check user capabilities before privileged operations
5. Use $wpdb->prepare() for database queries

## Common Patterns

### Admin Page Handler

```php
function [prefix_]handle_settings() {
    if ( ! isset( $_POST['[prefix_]_nonce'] ) ||
         ! wp_verify_nonce( $_POST['[prefix_]_nonce'], '[prefix_]_save_settings' ) ) {
        return;
    }

    if ( ! current_user_can( 'manage_options' ) ) {
        return;
    }

    $value = isset( $_POST['option'] )
        ? sanitize_text_field( wp_unslash( $_POST['option'] ) )
        : '';

    update_option( '[prefix_]_option', $value );
}
```

### AJAX Handler

```php
add_action( 'wp_ajax_[prefix_]_action', '[prefix_]_ajax_handler' );

function [prefix_]_ajax_handler() {
    check_ajax_referer( '[prefix_]_nonce', 'nonce' );

    if ( ! current_user_can( 'edit_posts' ) ) {
        wp_send_json_error( 'Unauthorized' );
    }

    // Process...
    wp_send_json_success( $data );
}
```

### Block Registration

```php
function [prefix_]_register_blocks() {
    register_block_type( __DIR__ . '/build/blocks/my-block' );
}
add_action( 'init', '[prefix_]_register_blocks' );
```

## File Structure

Expect this structure:
```
[project-slug]/
├── [project-slug].php
├── includes/
├── src/
├── build/
├── assets/
├── languages/
└── tests/
```

## i18n

Wrap all user-facing strings:
- `__( 'text', '[text-domain]' )`
- `_e( 'text', '[text-domain]' )`
- `esc_html__( 'text', '[text-domain]' )`

## Testing

When creating code, also suggest tests:
- PHPUnit for PHP functions
- Jest for JavaScript
- Include edge cases and error conditions

## DO NOT

- Use `eval()` or similar
- Trust user input without sanitization
- Output without escaping
- Use deprecated WordPress functions
- Hard-code URLs (use `home_url()`, `admin_url()`, etc.)
- Skip nonce verification on forms

## When Asked to Review Code

Check for:
1. Missing sanitization/escaping
2. Missing nonce verification
3. Missing capability checks
4. SQL injection vulnerabilities
5. XSS vulnerabilities
6. Proper use of WordPress APIs