phpcs.xml.dist

<?xml version="1.0"?>
<ruleset name="WebDecoy">
    <description>WebDecoy WordPress Plugin — security checks</description>

    <file>.</file>

    <exclude-pattern>vendor/</exclude-pattern>
    <exclude-pattern>node_modules/</exclude-pattern>
    <exclude-pattern>sdk/vendor/</exclude-pattern>
    <exclude-pattern>build/</exclude-pattern>
    <exclude-pattern>dist/</exclude-pattern>
    <exclude-pattern>assets/</exclude-pattern>
    <exclude-pattern>languages/</exclude-pattern>
    <exclude-pattern>*.css</exclude-pattern>
    <exclude-pattern>*.js</exclude-pattern>

    <arg name="extensions" value="php"/>
    <arg value="s"/>

    <!--
        This codebase uses PSR-style formatting (spaces, short arrays, Allman braces).
        We enforce WordPress security and database rules only — no formatting opinions.
    -->

    <!-- Escaping, sanitization, nonces, validated input -->
    <rule ref="WordPress.Security"/>

    <!-- Proper use of $wpdb->prepare() -->
    <rule ref="WordPress.DB"/>

    <config name="minimum_supported_wp_version" value="5.6"/>
</ruleset>