{"filename":"wordpress-claude-stack.mdc","content":"---\ndescription: \"Complete AI coding setup for WordPress — themes, plugins, Gutenberg, WooCommerce, ACF, REST API with .cursorrules + CLAUDE.md + Copilot instructions + 5 generation skills.\"\nglobs: **/*\nalwaysApply: false\n---\nYou are an expert WordPress developer with deep knowledge of PHP, Gutenberg, WooCommerce, ACF, and the WordPress ecosystem.\n\n## Core Principles\n- Follow WordPress Coding Standards (WPCS) strictly\n- Always use `declare(strict_types=1)` in PHP files\n- Escape ALL output, sanitize ALL input, prepare ALL queries\n- Use WordPress APIs — never reinvent what WordPress provides\n- Prefix everything with project namespace to avoid conflicts\n\n## PHP Rules\n- Type hints on all parameters and return types\n- Use `WP_Query` or `get_posts()` — never `query_posts()`\n- Use `$wpdb->prepare()` for ALL database queries\n- Use `wp_verify_nonce()` on ALL form submissions\n- Use `current_user_can()` for ALL permission checks\n- Use `esc_html()`, `esc_attr()`, `esc_url()`, `wp_kses_post()` for output\n- Use `sanitize_text_field()`, `absint()`, `wp_unslash()` for input\n\n## Theme Development\n- Use `add_theme_support()` for WordPress features\n- Enqueue scripts/styles with `wp_enqueue_script()` / `wp_enqueue_style()`\n- Use template hierarchy: `single-{post_type}.php`, `archive-{post_type}.php`\n- Use `get_template_part()` for reusable components\n- Keep logic in `functions.php` / `inc/`, templates should only render\n\n## Plugin Development\n- Main plugin class pattern with singleton or DI\n- Activation/deactivation hooks with `register_activation_hook()`\n- `uninstall.php` for cleanup on uninstall\n- Use WordPress Settings API for admin pages\n- Use `register_rest_route()` for REST endpoints\n\n## Gutenberg Blocks\n- Use `block.json` for metadata\n- Use `@wordpress/scripts` for build tooling\n- Use `useBlockProps()` and `InnerBlocks` in React/JSX\n- Register with `register_block_type()` in PHP\n- Dynamic blocks: use `render_callback` or `render.php`\n\n## WooCommerce\n- Override templates via `theme/woocommerce/` directory\n- Use WooCommerce hooks, never modify core\n- Use `wc_get_product()`, `WC()->cart`, `WC()->session`\n- Use HPOS-compatible code (no direct postmeta for orders)\n\n## Advanced Custom Fields\n- Register field groups in PHP for version control\n- Use `get_field()`, `the_field()`, `have_rows()`\n- Use ACF blocks for Gutenberg integration\n- Always provide fallback values\n\n## Security\n- Never trust user input\n- Always escape, sanitize, prepare, verify nonces, check capabilities\n- Never use `extract()`, `eval()`, or short PHP tags\n\n## Database\n- `get_option()` / `update_option()` for settings\n- `get_post_meta()` / `update_post_meta()` for post data\n- `get_transient()` / `set_transient()` for caching\n- Custom tables only when WP data structures don't fit\n- Always `$wpdb->prepare()` for custom queries\n\n## Do NOT\n- Modify WordPress core files\n- Use `query_posts()`\n- Echo unescaped data\n- Write raw SQL without prepare\n- Use `extract()` or `eval()`\n- Hardcode URLs — use `home_url()`, `admin_url()`\n- Skip nonce verification\n- Put business logic in templates\n- Use short PHP tags\n"}