Testing WordPress code

Pest for WordPress plugin tests Pest is a testing framework on top of PHPUnit with a shorter syntax: tests are closures with a description instead of methods in classes, and expectations read like sentences. For WordPress plugins, it runs on the same WordPress test suite and bootstrap as PHPUnit, so an existing setup can switch…

Debug WordPress with wp-env, Xdebug and PhpStorm @wordpress/env (wp-env) starts a complete WordPress development environment in Docker with one command, with the current plugin or theme mounted inside. It also has Xdebug built in: one flag enables it, and PhpStorm (or VS Code) can then stop at breakpoints in your plugin, step through the code…

wp-env: a local WordPress for plugin and block development in one command For developing a plugin or a block, a full local stack is often more than needed. @wordpress/env (wp-env) is the tool the WordPress project uses itself: one .wp-env.json in the plugin folder, one command, and Docker runs WordPress with the plugin mounted, a…

Git hooks with Husky and lint-staged in a WordPress project A coding standards check in CI catches problems after the push, and the developer has to fix and push again. A pre-commit hook catches them before the commit exists. Husky installs git hooks from the repository for everybody who runs npm install, and lint-staged runs…

A security review of a WordPress plugin with PHPCS and Semgrep Most vulnerabilities in WordPress plugins belong to a few patterns: output without escaping, input without sanitizing, a missing nonce or capability check, SQL built from variables, a file path from a request. Static analysis tools find many of them in minutes, before a human…

GitHub Actions CI/CD for WordPress plugin testing and deployment GitHub Actions runs a pipeline on every push and pull request: free for public repositories and with a monthly allowance of minutes for private ones. That is enough to run PHPUnit, the WordPress Coding Standards and PHPStan for a plugin on several PHP and WordPress versions,…

Add static analysis with PHPStan to WordPress plugin development PHPStan reads PHP code and finds bugs without running it: calling a method on something that can be null or a WP_Error, passing the wrong type to a function, using an undefined variable, a missing array key. It infers types from native declarations, docblocks and function…

Write unit tests for WordPress plugins with PHPUnit and WP-CLI scaffolding WordPress unit tests run against a real WordPress loaded with a separate test database. Every test runs inside a database transaction that is rolled back afterwards, so each test starts from a clean state. WP-CLI generates the whole setup, and the base class WP_UnitTestCase…

Git hooks for code quality: PHPCS before commit, tests before push Code style errors and failing tests are cheapest to fix before they leave the developer’s machine. Git can run a script before each commit and before each push; if the script fails, the commit or the push is stopped. Kept in the repository and…