A modular prompt engineering framework that turns Claude into a Senior WordPress & Elementor developer — with strict security, modern APIs, and 30 live-source audit rounds behind it.
WordPress 7.0.2 (July 17, 2026) · Elementor 4.2.0 free + Pro (July 20, 2026) · WooCommerce 10.9.4.
Elementor's Atomic Editor is the default for new installs; V3 Widget_Base remains fully supported — all skill code is production-safe on any site.
Pro changelog →
wordpress.org →
Generic AI models output outdated WordPress code, reach for deprecated jQuery, skip nonce verification, and miss HPOS requirements. This skill enforces strict modern SOPs — verified against official live sources every audit round.
A SKILL.md router loads only the docs relevant to each task — widget boilerplate, REST rules, HPOS patterns — keeping responses fast and context lean.
Enforces wp_unslash() before every sanitizer, WP 6.8+ bcrypt/BLAKE2b hashing, nonce verification on every AJAX action, and WP_Error on REST permission failures.
Every audit round fetches live data from official changelogs and APIs. Round 30 synced WordPress 7.0.2, Elementor 4.2.0 (free + Pro, July 20) and WooCommerce 10.9 — and corrected a stale Elementor date; earlier rounds folded in field-tested lessons from real plugin builds and a live wordpress.org review cycle.
Every Elementor native widget type has a dedicated boilerplate — correct control IDs, selectors, render logic, content_template(), has_widget_inner_wrapper(): false, and is_dynamic_content() — all verified against Elementor's own source. Button, Image, Carousel, Accordion, Tabs, Video, Maps, Rating, Text Path, Nested, and 25 more.
Golden Rule #6 and SKILL.md §5 enforce that every visual property (color, font, spacing, border, shadow, alignment) must be an Elementor control with selectors. A full controls checklist covers Typography, Background, Border, Box Shadow, Padding, Margin, Hover state, and more.
Complete WP_Error handling, transient caching with 172-char key guard, ES6+ IIFE patterns, secure PHP-to-JS data passing via wp_add_inline_script(). Zero jQuery unless forced by WP core. No deprecated wp_localize_script() for data passing.
Full HPOS compatibility declaration, HPOS-native order API (wc_get_order(), get_meta(), update_meta_data()), and the WC 10.7 “sync on read” default change (shipped April 14, 2026) with source code citation.
WCAG 2.2 AA checklist, accessible off-canvas panels with inert and --hidden in HTML markup (not only JS), focus trap, iOS scroll lock. Full frontend checklist: LCP, Speculative Loading, WP 6.9+ IE conditional comment removal, WP 7.0 RTC-aware query scoping.
All code patterns validated against these versions. Verified from official live sources every audit round.
| Component | Version | Notes |
|---|---|---|
| WordPress | 7.0.2 | "Armstrong" 7.0 released May 20, 2026; 7.0.2 security release July 17. PHP 7.2/7.3 dropped; new minimum PHP 7.4. WP 7.1 lands Aug 19, 2026. |
| PHP | 8.3+ | Officially recommended. PHP 8.4 & 8.5 carry a “beta support” label. |
| Elementor (free) | 4.2.0 STABLE | Current July 20, 2026 — adds Atomic Grid. Atomic Editor default for new installs (since 4.0). V3 Widget_Base fully supported. |
| Elementor Pro | 4.2.0 STABLE | Current July 20, 2026 — adds Atomic Loop. Atomic Forms, Pro Interactions, Component creation & detach (since 4.0). |
| WooCommerce | 10.9.4 min: 8.2+ | HPOS default-on since 8.2. WC 10.7 disabled “sync on read” by default; WC 10.9 (June 23, 2026) defers Store API draft-order creation. |
14 core reference files + 35 widget boilerplates + a 5-file SVN sub-bundle. Claude loads only what each task needs.
SKILL.mdRouter, 7 golden rules (incl. no hardcoded visuals, directory-safe naming), current stack (WP 7.0 / Elementor 4.x), widget mapscaffolding.mdPlugin scaffold, singleton, CPT + taxonomy, AJAX, child theme, widget reminderphp-standards.mdSanitize/escape, nonces, WP_Error, transients, bcrypt/BLAKE2b hashingjs-css-standards.mdES6+ IIFE, enqueue defer/async, BEM, design tokens, Elementor 4.x selector ruleselementor-patterns.mdV4 stable rules, widgets, mandatory controls rule, Dynamic Tags, Loop Grid, Form actionselementor-extending.mdCustom form fields, theme locations, inject controls into native widgets, Finder/context-menu, hooks + deprecationswoocommerce.mdHPOS, order API, WC 10.7 migration with source code citationrest-api.mdREST endpoints, JSON Schema draft-04, nonce auth + 24-hour refresh patternoffcanvas-ui.mdOff-canvas: inert + --hidden in HTML, focus trap, scroll lockperformance.mdLCP, Speculative Loading, cache keys, WP 7.0 RTC query scoping, WCAG 2.2 AAfield-notes.mdBattle-tested gotchas: widget-lifecycle fatals, content_template escaping, CSS-in-Elementor footguns, wp_mail, wp.org review/packagingwp-org-guidelines.mdThe 18 Directory Guidelines, Plugin Check 2.0.0 categories + usage, review process, required headers/readmedebugging.mdPHPCS+WPCS, PHPStan, Plugin Check, WP_DEBUG/Query Monitor, Elementor Safe Mode/cache, symptom→cause tablewordpress-apis.mdSettings/Options API, register_meta, capabilities, WP-Cron, internationalization (i18n)svn/Subversion sub-bundle (SVN Book 1.7): work cycle, branch/tag/merge, properties, repo admin + wordpress.org SVN deployVerified against Elementor native widget source. Every file has has_widget_inner_wrapper(), is_dynamic_content(), content_template(), and correct Group Controls.
Every round verifies official live sources only. No blog posts, no third-party tutorials.
Monolithic SKILL.md — 56 bugs fixed across all rounds.
Split into 9-file core bundle + 35 widget boilerplates. Elementor 3.35.6 → 3.35.7.
WordPress 6.9.4, WP 7.0 Beta 5, wp_kces_post typo fix, full verification pass.
Fixed missing inert on off-canvas panel HTML. JSON Schema draft-04 comment. WP 7.0 Beta 6 / RC1 sync.
Fixed backdrop overlay visible before JS load. WP AI API pre-stable caveat. WooCommerce filter source citation. Full 46-file scan.
Live-source audit: Elementor 4.0 Beta status synced across 4 files. V3 Widget_Base confirmed fully supported.
Elementor 4.0.0 shipped March 30, 2026 (free + Pro). Version numbers updated to 4.0.0; Atomic Editor now Stable. Skill continues targeting V3 Widget_Base.
WordPress 7.0 "Armstrong" (May 20) and WooCommerce 10.8 synced (this round's Elementor 4.2.0 dating was later corrected in Round 30). Retired the WP 7.0 pre-release narration; consolidated duplicate widget files; release history moved into CHANGELOG.md.
Full restructure + per-widget audit; first field-notes mining from real plugin builds; developer.wordpress.org & developers.elementor.com deep-dives (4 new core files: debugging, wp.org guidelines, WordPress APIs, Elementor extending); the content_template() escaping sweep; SVN sub-bundle bundled (49 → 54 files).
Lessons from a real wordpress.org review cycle: $wpdb sniff-suppression mechanics + an OWASP-ZAP triage table (debugging.md); “Hard lines from real 2026 reviews” — no user-authored SQL ever (whitelist identifiers, parameterize values), external-services disclosure, wp_print_styles() for standalone pages (wp-org-guidelines.md); the sanitize-callback purity trap; transients under a persistent object cache; field notes on security headers, CSP scope, web-cache-deception defense, and packaging.
Live-source currency sweep. WordPress 7.0.2 (security, July 17), Elementor free + Pro both at 4.2.0 (July 20 — free adds Atomic Grid, Pro adds Atomic Loop; corrected a Round 21 error that dated 4.2.0 to June 5), WooCommerce 10.9.4 with new woocommerce.md notes (deferred Store API draft orders, product editor beta’s final deprecation window). Re-verified developers.elementor.com still documents only V3 Widget_Base — the V3 stance stands. Next audit: WordPress 7.1, August 19, 2026.
Every fact verified against the canonical source. Round 21 confirmed WordPress 7.0 and Elementor 4.2 from live changelogs; later rounds add only field-verified lessons from real builds and reviews.