A modular prompt engineering framework that turns Claude into a Senior WordPress & Elementor developer — with strict security, modern APIs, and 35 live-source audit rounds behind it.
WordPress 7.1 “Mary Lou” (Aug 19, 2026) · Elementor free 4.2.3 / Pro 4.2.2 · WooCommerce 11.0.1.
Elementor's Atomic Editor is the default for new installs; V3 Widget_Base remains fully supported — all skill code is production-safe on any site.
Pro changelog →
wordpress.org →
Generic AI models output outdated WordPress code, reach for deprecated jQuery, skip nonce verification, and miss HPOS requirements. This skill enforces strict modern SOPs — verified against official live sources every audit round.
A SKILL.md router loads only the docs relevant to each task — widget boilerplate, REST rules, HPOS patterns — keeping responses fast and context lean.
Enforces wp_unslash() before every sanitizer, WP 6.8+ bcrypt/BLAKE2b hashing, nonce verification on every AJAX action, and WP_Error on REST permission failures.
Every audit round fetches live data from official changelogs and APIs, or verifies against a live install. Round 34 caught WordPress 7.1’s unconditional editor iframe and WooCommerce 11.0’s removal of the product editor beta — and corrected a claim the skill had carried since the iframe was still “punted to a later release.”
Every Elementor native widget type has a dedicated boilerplate — correct control IDs, selectors, render logic, content_template(), has_widget_inner_wrapper(): false, and is_dynamic_content() — all verified against Elementor's own source. Button, Image, Carousel, Accordion, Tabs, Video, Maps, Rating, Text Path, Nested, and 25 more.
Golden Rule #6 and SKILL.md §5 enforce that every visual property (color, font, spacing, border, shadow, alignment) must be an Elementor control with selectors. A full controls checklist covers Typography, Background, Border, Box Shadow, Padding, Margin, Hover state, and more.
Complete WP_Error handling, transient caching with 172-char key guard, ES6+ IIFE patterns, secure PHP-to-JS data passing via wp_add_inline_script(). Zero jQuery unless forced by WP core. No deprecated wp_localize_script() for data passing.
Custom tables via dbDelta() and its unforgiving formatting rules, why WordPress indexes strings at varchar(191) (InnoDB’s 767-byte prefix cap ÷ 4 bytes per utf8mb4 character), the leftmost-prefix rule, and reading EXPLAIN. Plus MariaDB↔MySQL portability — your plugin doesn’t choose the engine, and JSON is stored and compared differently on each. Sourced from the official MariaDB Knowledge Base.
Full HPOS compatibility declaration and the HPOS-native order API (wc_get_order(), get_meta(), update_meta_data()), the WC 10.7 “sync on read” change with source citation, and WC 11.0’s removal of the product editor beta — including its extension points, so any UI registered through them must move to the classic screen.
WCAG 2.2 AA checklist, accessible off-canvas panels with inert and --hidden in HTML markup (not only JS), focus trap, iOS scroll lock. Full frontend checklist: LCP, Speculative Loading, WP 6.9+ IE conditional comment removal, RTC-aware query scoping, and running EXPLAIN on a slow query instead of guessing at indexes.
The part you can’t get from documentation: an untyped override of a typed Elementor method that white-screens every page, a colour control with a default the user can never switch off, CSS custom properties that don’t cascade upward to Elementor’s wrapper, {{{ }}} in a Backbone preview getting a submission rejected, and a min-width floor on a flex child that forces overflow. Every entry exists because the opposite shipped and broke something.
The 18 Detailed Plugin Guidelines in actionable form, Plugin Check 2.1.0 (the reviewer’s own tool — now scanning your SVN repo, not just your zip), how the review really works round to round, and hard lines learned in a live review: no user-authored SQL, external-services disclosure, escaping at the point of output. Then a self-contained SVN sub-bundle to actually ship it — trunk/tags/assets, tagging a release, matching Stable tag.
All code patterns validated against these versions. Verified from official live sources every audit round.
| Component | Version | Notes |
|---|---|---|
| WordPress | 7.1 | “Mary Lou”, released Aug 19, 2026. Post editor now always iframed; __next40pxDefaultSize is a no-op; list-table row headers moved; new SVG Icon API. Minimum PHP 7.4. |
| PHP | 8.3+ | Officially recommended. PHP 8.4 & 8.5 carry a “beta support” label. Database: MariaDB 10.11+ / MySQL 8.0+. |
| Elementor (free) | 4.2.3 STABLE | Current Aug 19, 2026. Atomic Grid since 4.2.0; Atomic Editor default for new installs (since 4.0). Still declares Tested up to 7.0.4. V3 Widget_Base fully supported. |
| Elementor Pro | 4.2.2 STABLE | Current Aug 19, 2026 — versions independently of free. Atomic Loop since 4.2.0; Atomic Forms, Pro Interactions, Component creation & detach (since 4.0). |
| WooCommerce | 11.0.1 min: 8.2+ | 11.0 (Aug 4, 2026) removed the product editor beta and its extension points; bundles Action Scheduler 4.0. HPOS default-on since 8.2; 10.7 disabled “sync on read”; 10.9 defers Store API draft orders. |
15 core reference files + 35 widget boilerplates + a 5-file SVN sub-bundle. Claude loads only what each task needs.
SKILL.mdRouter, 7 golden rules (incl. no hardcoded visuals, directory-safe naming), current stack (WP 7.0 / Elementor 4.x), widget mapscaffolding.mdPlugin scaffold, singleton, CPT + taxonomy, AJAX, child theme, widget reminderphp-standards.mdSanitize/escape, nonces, WP_Error, transients, bcrypt/BLAKE2b hashingjs-css-standards.mdES6+ IIFE, enqueue defer/async, BEM, design tokens, Elementor 4.x selector ruleselementor-patterns.mdV4 stable rules, widgets, mandatory controls rule, Dynamic Tags, Loop Grid, Form actionselementor-extending.mdCustom form fields, theme locations, inject controls into native widgets, Finder/context-menu, hooks + deprecationswoocommerce.mdHPOS, order API, WC 10.7 migration with source code citationrest-api.mdREST endpoints, JSON Schema draft-04, nonce auth + 24-hour refresh patternoffcanvas-ui.mdOff-canvas: inert + --hidden in HTML, focus trap, scroll lockperformance.mdLCP, Speculative Loading, cache keys, WP 7.0 RTC query scoping, WCAG 2.2 AAfield-notes.mdBattle-tested gotchas: widget-lifecycle fatals, content_template escaping, CSS-in-Elementor footguns, wp_mail, wp.org review/packagingwp-org-guidelines.mdThe 18 Directory Guidelines, Plugin Check 2.0.0 categories + usage, review process, required headers/readmedebugging.mdPHPCS+WPCS, PHPStan, Plugin Check, WP_DEBUG/Query Monitor, Elementor Safe Mode/cache, symptom→cause tablewordpress-apis.mdSettings/Options API, register_meta, capabilities, WP-Cron, internationalization (i18n)mariadb.mdCustom tables + dbDelta(), the varchar(191) index rule, indexes, EXPLAIN, MariaDB↔MySQL portability, sql_mode, full-textsvn/Subversion sub-bundle (SVN Book 1.7): work cycle, branch/tag/merge, properties, repo admin + wordpress.org SVN deployVerified against Elementor native widget source. Every file has has_widget_inner_wrapper(), is_dynamic_content(), content_template(), and correct Group Controls.
Every round verifies official live sources only. No blog posts, no third-party tutorials.
Monolithic SKILL.md — 56 bugs fixed across all rounds.
Split into 9-file core bundle + 35 widget boilerplates. Elementor 3.35.6 → 3.35.7.
WordPress 6.9.4, WP 7.0 Beta 5, wp_kces_post typo fix, full verification pass.
Fixed missing inert on off-canvas panel HTML. JSON Schema draft-04 comment. WP 7.0 Beta 6 / RC1 sync.
Fixed backdrop overlay visible before JS load. WP AI API pre-stable caveat. WooCommerce filter source citation. Full 46-file scan.
Live-source audit: Elementor 4.0 Beta status synced across 4 files. V3 Widget_Base confirmed fully supported.
Elementor 4.0.0 shipped March 30, 2026 (free + Pro). Version numbers updated to 4.0.0; Atomic Editor now Stable. Skill continues targeting V3 Widget_Base.
WordPress 7.0 "Armstrong" (May 20) and WooCommerce 10.8 synced (this round's Elementor 4.2.0 dating was later corrected in Round 30). Retired the WP 7.0 pre-release narration; consolidated duplicate widget files; release history moved into CHANGELOG.md.
Full restructure + per-widget audit; first field-notes mining from real plugin builds; developer.wordpress.org & developers.elementor.com deep-dives (4 new core files: debugging, wp.org guidelines, WordPress APIs, Elementor extending); the content_template() escaping sweep; SVN sub-bundle bundled (49 → 54 files).
Lessons from a real wordpress.org review cycle: $wpdb sniff-suppression mechanics + an OWASP-ZAP triage table (debugging.md); “Hard lines from real 2026 reviews” — no user-authored SQL ever (whitelist identifiers, parameterize values), external-services disclosure, wp_print_styles() for standalone pages (wp-org-guidelines.md); the sanitize-callback purity trap; transients under a persistent object cache; field notes on security headers, CSP scope, web-cache-deception defense, and packaging.
Live-source currency sweep. WordPress 7.0.2 (security, July 17), Elementor free + Pro both at 4.2.0 (July 20 — free adds Atomic Grid, Pro adds Atomic Loop; corrected a Round 21 error that dated 4.2.0 to June 5), WooCommerce 10.9.4 with new woocommerce.md notes (deferred Store API draft orders, product editor beta’s final deprecation window). Re-verified developers.elementor.com still documents only V3 Widget_Base.
Three field-verified pieces from real plugin work. Editor panel tabs — Elementor 4.x’s official elementorV2.editorElementsPanel.injectTab() for a tab beside Widgets / Components / Globals (built end-to-end), plus the regex-into-editor/footer anti-pattern and two linter-invisible traps. Dynamic-tag parents — the Tag vs Data_Tag split (wrong parent = silent empty). The no-default colour rule — a colour control with a default can’t be switched off.
Shipping a translation for a directory-hosted plugin (GlotPress vs bundled languages/, the JS i18n path, SVN implications), PHPStan configuration for Elementor plugins with Plugin Check triage, and two ways your own CSS disables your own controls — both found by debugging a real “this control does nothing” report, and both invisible to every linter.
WordPress 7.1 “Mary Lou” (Aug 19) makes the post editor iframe unconditional — editor JS using the global document/window now hits the wrong document and must use the canvas node’s ownerDocument/defaultView; this corrected a now-false claim the skill had carried saying the iframe was “punted to a later release.” Also: __next40pxDefaultSize is a no-op, list-table row headers moved off th.check-column, and the new SVG Icon API allowlists only <svg>/<path>/<polygon>. WooCommerce 11.0 removed the product editor beta and its extension points; Action Scheduler 4.0 put arguments into $unique, silently breaking “only one ever queued” guards. Plugin Check 2.1.0 adds an SVN-repo scan and per-dependency Requires Plugins validation.
New mariadb.md (54 → 55 files), from the official MariaDB Knowledge Base. The skill had $wpdb security guidance but nothing on schema and performance: custom tables via dbDelta() and its unforgiving formatting rules (two spaces after PRIMARY KEY…), why core indexes strings at varchar(191) (InnoDB’s 767-byte prefix cap ÷ 4 bytes per utf8mb4 char), the leftmost-prefix rule for composite indexes, reading EXPLAIN, and — since a distributed plugin can’t choose its engine — MariaDB↔MySQL portability, where JSON is the headline: MariaDB stores it as TEXT and compares it as a string, not by value. Plus the ONLY_FULL_GROUP_BY trap (MySQL enables it by default, MariaDB doesn’t) and full-text search’s silent minimum-word-length failure.
Every fact verified against the canonical source — official changelogs, handbooks and release notes, never third-party tutorials. Where a claim can’t be corroborated it doesn’t ship: the database file cites the MariaDB Knowledge Base directly, and a version number it couldn’t confirm was replaced with portable guidance rather than a guess.