<?php
/**
 * Plugin Name: My Custom Plugin
 * Plugin URI: https://example.com/plugin
 * Description: Description of the plugin
 * Version: 1.0.0
 * Author: Your Name
 * Author URI: https://example.com
 * License: GPL-2.0+
 * License URI: http://www.gnu.org/licenses/gpl-2.0.txt
 * Text Domain: my-custom-plugin
 * Domain Path: /languages
 * Requires at least: 6.0
 * Requires PHP: 8.0
 */

// Prevent direct access
if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

// Use proper naming conventions
class My_Custom_Plugin {

    private static ?My_Custom_Plugin $instance = null;

    public static function get_instance(): My_Custom_Plugin {
        if ( null === self::$instance ) {
            self::$instance = new self();
        }
        return self::$instance;
    }

    private function __construct() {
        $this->init_hooks();
    }

    private function init_hooks(): void {
        add_action( 'init', array( $this, 'load_textdomain' ) );
        add_action( 'wp_enqueue_scripts', array( $this, 'enqueue_assets' ) );
    }

    public function load_textdomain(): void {
        load_plugin_textdomain(
            'my-custom-plugin',
            false,
            dirname( plugin_basename( __FILE__ ) ) . '/languages'
        );
    }

    public function enqueue_assets(): void {
        wp_enqueue_style(
            'my-custom-plugin-style',
            plugins_url( 'assets/css/style.css', __FILE__ ),
            array(),
            '1.0.0'
        );

        wp_enqueue_script(
            'my-custom-plugin-script',
            plugins_url( 'assets/js/script.js', __FILE__ ),
            array( 'jquery' ),
            '1.0.0',
            true
        );

        wp_localize_script(
            'my-custom-plugin-script',
            'myPluginData',
            array(
                'ajaxUrl' => admin_url( 'admin-ajax.php' ),
                'nonce'   => wp_create_nonce( 'my_plugin_nonce' ),
            )
        );
    }
}

// Initialize plugin
add_action( 'plugins_loaded', array( 'My_Custom_Plugin', 'get_instance' ) );

/**
 * Custom plugin JavaScript
 *
 * @package My_Custom_Plugin
 */

( function( $ ) {
    'use strict';

    const MyPlugin = {
        init: function() {
            this.bindEvents();
        },

        bindEvents: function() {
            $( document ).on( 'click', '.my-button', this.handleClick );
        },

        handleClick: function( event ) {
            event.preventDefault();

            $.ajax( {
                url: myPluginData.ajaxUrl,
                type: 'POST',
                data: {
                    action: 'my_plugin_action',
                    nonce: myPluginData.nonce,
                },
                success: function( response ) {
                    if ( response.success ) {
                        console.log( response.data );
                    }
                },
            } );
        },
    };

    $( document ).ready( function() {
        MyPlugin.init();
    } );

} )( jQuery );

// Sanitize text input
$title = sanitize_text_field( $_POST['title'] ?? '' );

// Sanitize email
$email = sanitize_email( $_POST['email'] ?? '' );

// Sanitize URL
$url = esc_url_raw( $_POST['url'] ?? '' );

// Sanitize HTML content
$content = wp_kses_post( $_POST['content'] ?? '' );

// Sanitize array of integers
$ids = array_map( 'absint', (array) ( $_POST['ids'] ?? array() ) );

// Escape for HTML context
echo esc_html( $user_input );

// Escape for HTML attributes
echo esc_attr( $attribute_value );

// Escape for URLs
echo esc_url( $url );

// Escape for JavaScript
echo esc_js( $js_value );

// Escape for textarea
echo esc_textarea( $textarea_content );

// Translate and escape
echo esc_html__( 'Text to translate', 'text-domain' );
echo esc_attr__( 'Attribute text', 'text-domain' );

// Escape with placeholder
printf(
    /* translators: %s: user name */
    esc_html__( 'Hello, %s!', 'text-domain' ),
    esc_html( $username )
);

// Create nonce field in form
wp_nonce_field( 'my_action', 'my_nonce' );

// Verify nonce in handler
if ( ! isset( $_POST['my_nonce'] ) ||
     ! wp_verify_nonce( $_POST['my_nonce'], 'my_action' ) ) {
    wp_die( esc_html__( 'Security check failed.', 'text-domain' ) );
}

// For AJAX requests
check_ajax_referer( 'my_plugin_nonce', 'nonce' );

// Check user capabilities
if ( ! current_user_can( 'manage_options' ) ) {
    wp_die( esc_html__( 'Unauthorized access.', 'text-domain' ) );
}

// Check specific post capability
if ( ! current_user_can( 'edit_post', $post_id ) ) {
    wp_die( esc_html__( 'You cannot edit this post.', 'text-domain' ) );
}

/**
 * Register custom post type
 */
function my_plugin_register_post_types(): void {
    $labels = array(
        'name'                  => _x( 'Projects', 'Post type general name', 'text-domain' ),
        'singular_name'         => _x( 'Project', 'Post type singular name', 'text-domain' ),
        'menu_name'             => _x( 'Projects', 'Admin Menu text', 'text-domain' ),
        'add_new'               => __( 'Add New', 'text-domain' ),
        'add_new_item'          => __( 'Add New Project', 'text-domain' ),
        'edit_item'             => __( 'Edit Project', 'text-domain' ),
        'new_item'              => __( 'New Project', 'text-domain' ),
        'view_item'             => __( 'View Project', 'text-domain' ),
        'search_items'          => __( 'Search Projects', 'text-domain' ),
        'not_found'             => __( 'No projects found', 'text-domain' ),
        'not_found_in_trash'    => __( 'No projects found in Trash', 'text-domain' ),
        'all_items'             => __( 'All Projects', 'text-domain' ),
    );

    $args = array(
        'labels'             => $labels,
        'public'             => true,
        'publicly_queryable' => true,
        'show_ui'            => true,
        'show_in_menu'       => true,
        'show_in_rest'       => true, // Enable Gutenberg
        'query_var'          => true,
        'rewrite'            => array( 'slug' => 'projects' ),
        'capability_type'    => 'post',
        'has_archive'        => true,
        'hierarchical'       => false,
        'menu_position'      => 20,
        'menu_icon'          => 'dashicons-portfolio',
        'supports'           => array(
            'title',
            'editor',
            'thumbnail',
            'excerpt',
            'custom-fields'
        ),
    );

    register_post_type( 'project', $args );
}
add_action( 'init', 'my_plugin_register_post_types' );

/**
 * Register custom taxonomy
 */
function my_plugin_register_taxonomies(): void {
    $labels = array(
        'name'              => _x( 'Project Types', 'taxonomy general name', 'text-domain' ),
        'singular_name'     => _x( 'Project Type', 'taxonomy singular name', 'text-domain' ),
        'search_items'      => __( 'Search Project Types', 'text-domain' ),
        'all_items'         => __( 'All Project Types', 'text-domain' ),
        'parent_item'       => __( 'Parent Project Type', 'text-domain' ),
        'parent_item_colon' => __( 'Parent Project Type:', 'text-domain' ),
        'edit_item'         => __( 'Edit Project Type', 'text-domain' ),
        'update_item'       => __( 'Update Project Type', 'text-domain' ),
        'add_new_item'      => __( 'Add New Project Type', 'text-domain' ),
        'new_item_name'     => __( 'New Project Type Name', 'text-domain' ),
        'menu_name'         => __( 'Project Types', 'text-domain' ),
    );

    $args = array(
        'hierarchical'      => true,
        'labels'            => $labels,
        'show_ui'           => true,
        'show_admin_column' => true,
        'show_in_rest'      => true,
        'query_var'         => true,
        'rewrite'           => array( 'slug' => 'project-type' ),
    );

    register_taxonomy( 'project_type', array( 'project' ), $args );
}
add_action( 'init', 'my_plugin_register_taxonomies' );

/**
 * Safe database operations with $wpdb
 */
global $wpdb;

// Prepared statement for SELECT
$user_id = 123;
$results = $wpdb->get_results(
    $wpdb->prepare(
        "SELECT * FROM {$wpdb->prefix}custom_table WHERE user_id = %d",
        $user_id
    )
);

// Insert with proper escaping
$wpdb->insert(
    $wpdb->prefix . 'custom_table',
    array(
        'user_id'    => $user_id,
        'title'      => $title,
        'created_at' => current_time( 'mysql' ),
    ),
    array( '%d', '%s', '%s' )
);

// Update with proper escaping
$wpdb->update(
    $wpdb->prefix . 'custom_table',
    array( 'title' => $new_title ),
    array( 'id' => $record_id ),
    array( '%s' ),
    array( '%d' )
);

// Delete with prepared statement
$wpdb->delete(
    $wpdb->prefix . 'custom_table',
    array( 'id' => $record_id ),
    array( '%d' )
);

// Create custom table on activation
function my_plugin_create_tables(): void {
    global $wpdb;

    $table_name      = $wpdb->prefix . 'custom_table';
    $charset_collate = $wpdb->get_charset_collate();

    $sql = "CREATE TABLE $table_name (
        id bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
        user_id bigint(20) UNSIGNED NOT NULL,
        title varchar(255) NOT NULL,
        content longtext,
        created_at datetime DEFAULT CURRENT_TIMESTAMP,
        PRIMARY KEY  (id),
        KEY user_id (user_id)
    ) $charset_collate;";

    require_once ABSPATH . 'wp-admin/includes/upgrade.php';
    dbDelta( $sql );
}
register_activation_hook( __FILE__, 'my_plugin_create_tables' );

/**
 * Register custom Gutenberg blocks
 */
function my_plugin_register_blocks(): void {
    register_block_type(
        __DIR__ . '/blocks/my-block',
        array(
            'render_callback' => 'my_plugin_render_block',
        )
    );
}
add_action( 'init', 'my_plugin_register_blocks' );

/**
 * Dynamic block render callback
 */
function my_plugin_render_block( array $attributes, string $content ): string {
    $title = $attributes['title'] ?? '';

    ob_start();
    ?>
    <div class="my-custom-block">
        <h3><?php echo esc_html( $title ); ?></h3>
        <div class="block-content">
            <?php echo wp_kses_post( $content ); ?>
        </div>
    </div>
    <?php
    return ob_get_clean();
}

{
    "$schema": "https://schemas.wp.org/trunk/block.json",
    "apiVersion": 3,
    "name": "my-plugin/my-block",
    "version": "1.0.0",
    "title": "My Custom Block",
    "category": "widgets",
    "icon": "star-filled",
    "description": "A custom Gutenberg block",
    "keywords": ["custom", "block"],
    "supports": {
        "html": false,
        "align": ["wide", "full"],
        "color": {
            "background": true,
            "text": true
        },
        "spacing": {
            "margin": true,
            "padding": true
        }
    },
    "attributes": {
        "title": {
            "type": "string",
            "default": ""
        },
        "content": {
            "type": "string",
            "source": "html",
            "selector": ".block-content"
        }
    },
    "textdomain": "my-plugin",
    "editorScript": "file:./index.js",
    "editorStyle": "file:./index.css",
    "style": "file:./style-index.css"
}

import { __ } from '@wordpress/i18n';
import { useBlockProps, RichText, InspectorControls } from '@wordpress/block-editor';
import { PanelBody, TextControl } from '@wordpress/components';
import './editor.scss';

export default function Edit( { attributes, setAttributes } ) {
    const { title, content } = attributes;
    const blockProps = useBlockProps();

    return (
        <>
            <InspectorControls>
                <PanelBody title={ __( 'Settings', 'my-plugin' ) }>
                    <TextControl
                        label={ __( 'Title', 'my-plugin' ) }
                        value={ title }
                        onChange={ ( value ) => setAttributes( { title: value } ) }
                    />
                </PanelBody>
            </InspectorControls>
            <div { ...blockProps }>
                <h3>{ title }</h3>
                <RichText
                    tagName="div"
                    className="block-content"
                    value={ content }
                    onChange={ ( value ) => setAttributes( { content: value } ) }
                    placeholder={ __( 'Enter content...', 'my-plugin' ) }
                />
            </div>
        </>
    );
}

/**
 * Register custom REST API endpoints
 */
function my_plugin_register_rest_routes(): void {
    register_rest_route(
        'my-plugin/v1',
        '/items',
        array(
            array(
                'methods'             => WP_REST_Server::READABLE,
                'callback'            => 'my_plugin_get_items',
                'permission_callback' => '__return_true',
                'args'                => array(
                    'per_page' => array(
                        'default'           => 10,
                        'sanitize_callback' => 'absint',
                    ),
                    'page' => array(
                        'default'           => 1,
                        'sanitize_callback' => 'absint',
                    ),
                ),
            ),
            array(
                'methods'             => WP_REST_Server::CREATABLE,
                'callback'            => 'my_plugin_create_item',
                'permission_callback' => 'my_plugin_can_manage',
                'args'                => array(
                    'title' => array(
                        'required'          => true,
                        'sanitize_callback' => 'sanitize_text_field',
                    ),
                ),
            ),
        )
    );

    register_rest_route(
        'my-plugin/v1',
        '/items/(?P<id>[\d]+)',
        array(
            array(
                'methods'             => WP_REST_Server::READABLE,
                'callback'            => 'my_plugin_get_item',
                'permission_callback' => '__return_true',
                'args'                => array(
                    'id' => array(
                        'validate_callback' => function( $param ) {
                            return is_numeric( $param );
                        },
                    ),
                ),
            ),
            array(
                'methods'             => WP_REST_Server::EDITABLE,
                'callback'            => 'my_plugin_update_item',
                'permission_callback' => 'my_plugin_can_manage',
            ),
            array(
                'methods'             => WP_REST_Server::DELETABLE,
                'callback'            => 'my_plugin_delete_item',
                'permission_callback' => 'my_plugin_can_manage',
            ),
        )
    );
}
add_action( 'rest_api_init', 'my_plugin_register_rest_routes' );

/**
 * Permission callback
 */
function my_plugin_can_manage(): bool {
    return current_user_can( 'manage_options' );
}

/**
 * GET items callback
 */
function my_plugin_get_items( WP_REST_Request $request ): WP_REST_Response {
    $per_page = $request->get_param( 'per_page' );
    $page     = $request->get_param( 'page' );

    // Fetch items from database
    $items = array(); // Your logic here

    return new WP_REST_Response( $items, 200 );
}

/**
 * POST item callback
 */
function my_plugin_create_item( WP_REST_Request $request ): WP_REST_Response {
    $title = $request->get_param( 'title' );

    // Create item logic
    $item_id = 0; // Your logic here

    if ( ! $item_id ) {
        return new WP_REST_Response(
            array( 'message' => __( 'Failed to create item.', 'text-domain' ) ),
            500
        );
    }

    return new WP_REST_Response(
        array(
            'id'      => $item_id,
            'message' => __( 'Item created successfully.', 'text-domain' ),
        ),
        201
    );
}

theme-name/
├── style.css              # Theme metadata and base styles
├── functions.php          # Theme setup and functions
├── index.php              # Main template file
├── header.php             # Header template
├── footer.php             # Footer template
├── sidebar.php            # Sidebar template
├── single.php             # Single post template
├── page.php               # Page template
├── archive.php            # Archive template
├── search.php             # Search results template
├── 404.php                # 404 error template
├── screenshot.png         # Theme screenshot (1200x900)
├── theme.json             # Block theme configuration
├── templates/             # Block templates (FSE)
├── parts/                 # Template parts
├── patterns/              # Block patterns
├── inc/                   # PHP includes
│   ├── customizer.php     # Customizer settings
│   ├── template-tags.php  # Template functions
│   └── acf-fields.php     # ACF field groups
├── assets/
│   ├── css/
│   ├── js/
│   ├── images/
│   └── fonts/
└── languages/             # Translation files

{
    "$schema": "https://schemas.wp.org/trunk/theme.json",
    "version": 3,
    "settings": {
        "color": {
            "palette": [
                {
                    "slug": "primary",
                    "color": "#0073aa",
                    "name": "Primary"
                },
                {
                    "slug": "secondary",
                    "color": "#23282d",
                    "name": "Secondary"
                }
            ],
            "gradients": [],
            "custom": true
        },
        "typography": {
            "fontFamilies": [
                {
                    "fontFamily": "-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif",
                    "slug": "system-font",
                    "name": "System Font"
                }
            ],
            "fontSizes": [
                {
                    "slug": "small",
                    "size": "0.875rem",
                    "name": "Small"
                },
                {
                    "slug": "medium",
                    "size": "1rem",
                    "name": "Medium"
                },
                {
                    "slug": "large",
                    "size": "1.5rem",
                    "name": "Large"
                }
            ]
        },
        "spacing": {
            "units": ["px", "em", "rem", "%"],
            "padding": true,
            "margin": true
        },
        "layout": {
            "contentSize": "800px",
            "wideSize": "1200px"
        }
    },
    "styles": {
        "color": {
            "background": "var(--wp--preset--color--white)",
            "text": "var(--wp--preset--color--secondary)"
        },
        "typography": {
            "fontFamily": "var(--wp--preset--font-family--system-font)",
            "fontSize": "var(--wp--preset--font-size--medium)"
        }
    }
}

// Transient API for caching
function my_plugin_get_cached_data(): array {
    $cache_key = 'my_plugin_data';
    $data      = get_transient( $cache_key );

    if ( false === $data ) {
        // Fetch fresh data
        $data = my_plugin_fetch_expensive_data();

        // Cache for 1 hour
        set_transient( $cache_key, $data, HOUR_IN_SECONDS );
    }

    return $data;
}

// Object cache for frequently accessed data
function my_plugin_get_settings(): array {
    $cache_key   = 'my_plugin_settings';
    $cache_group = 'my_plugin';

    $settings = wp_cache_get( $cache_key, $cache_group );

    if ( false === $settings ) {
        $settings = get_option( 'my_plugin_settings', array() );
        wp_cache_set( $cache_key, $settings, $cache_group );
    }

    return $settings;
}

// Conditionally load assets
function my_plugin_enqueue_assets(): void {
    // Only load on specific pages
    if ( ! is_singular( 'project' ) ) {
        return;
    }

    wp_enqueue_style(
        'my-plugin-style',
        plugins_url( 'assets/css/style.min.css', __FILE__ ),
        array(),
        filemtime( plugin_dir_path( __FILE__ ) . 'assets/css/style.min.css' )
    );

    wp_enqueue_script(
        'my-plugin-script',
        plugins_url( 'assets/js/script.min.js', __FILE__ ),
        array(),
        filemtime( plugin_dir_path( __FILE__ ) . 'assets/js/script.min.js' ),
        array(
            'strategy' => 'defer',
            'in_footer' => true,
        )
    );
}
add_action( 'wp_enqueue_scripts', 'my_plugin_enqueue_assets' );

// BAD: SQL Injection vulnerability
$results = $wpdb->get_results(
    "SELECT * FROM {$wpdb->posts} WHERE post_author = $user_id"
);

// GOOD: Prepared statement
$results = $wpdb->get_results(
    $wpdb->prepare(
        "SELECT * FROM {$wpdb->posts} WHERE post_author = %d",
        $user_id
    )
);

// BAD: XSS vulnerability
echo $user_input;
echo '<a href="' . $url . '">' . $title . '</a>';

// GOOD: Proper escaping
echo esc_html( $user_input );
echo '<a href="' . esc_url( $url ) . '">' . esc_html( $title ) . '</a>';

// BAD: Hardcoded paths
include '/var/www/html/wp-content/plugins/my-plugin/includes/class.php';

// GOOD: Use WordPress functions
include plugin_dir_path( __FILE__ ) . 'includes/class.php';

// BAD: No ABSPATH check
<?php
// Direct access possible

// GOOD: Prevent direct access
<?php
if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

// BAD: No sanitization
$search = $_GET['s'];
$email = $_POST['email'];

// GOOD: Proper sanitization
$search = isset( $_GET['s'] ) ? sanitize_text_field( wp_unslash( $_GET['s'] ) ) : '';
$email = isset( $_POST['email'] ) ? sanitize_email( wp_unslash( $_POST['email'] ) ) : '';

// wp-config.php debugging settings
define( 'WP_DEBUG', true );
define( 'WP_DEBUG_LOG', true );
define( 'WP_DEBUG_DISPLAY', false );
define( 'SCRIPT_DEBUG', true );
define( 'SAVEQUERIES', true );

<?xml version="1.0"?>
<ruleset name="My Plugin Coding Standards">
    <description>WordPress Coding Standards for My Plugin</description>

    <rule ref="WordPress"/>
    <rule ref="WordPress-Core"/>
    <rule ref="WordPress-Docs"/>
    <rule ref="WordPress-Extra"/>

    <config name="minimum_supported_wp_version" value="6.0"/>
    <config name="testVersion" value="8.0-"/>

    <arg name="extensions" value="php"/>
    <arg name="colors"/>
    <arg value="sp"/>

    <file>./</file>
    <exclude-pattern>/vendor/*</exclude-pattern>
    <exclude-pattern>/node_modules/*</exclude-pattern>
    <exclude-pattern>/tests/*</exclude-pattern>
</ruleset>