wordpress-pro Skill (Jeffallan) for Claude: What It Does and How to Install It

Makes Claude build WordPress themes, plugins and Gutenberg blocks with secure, standards-based code.

Installs: 10K; on skills.sh
Stars: 12.2K; on GitHub
Files: 5; besides SKILL.md
Updated: Oct 2026; last repo commit

This skill is a WordPress developer playbook for Claude. It covers themes, plugins, Gutenberg blocks, WooCommerce, REST API endpoints, hooks and filters, caching and query tuning. It has strict rules: nonces on forms, sanitized input, escaped output, prepared queries and capability checks.

It triggers when you build or change WordPress themes and plugins. It is by Jeffallan, not by WordPress. It bundles no scripts, only SKILL.md and 5 reference files. It tells Claude to validate with phpcs --standard=WordPress.

Good for

WordPress developers building custom themes and plugins
Store builders extending WooCommerce
Teams hardening a WordPress site for security and speed

Install wordpress-pro

Claude Code

Copy this prompt.

Install the wordpress-pro skill in Claude Code. Run this command:

/plugin marketplace add jeffallan/claude-skills
/plugin install fullstack-dev-skills@fullstack-dev-skills

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Pick one route. The plugin route installs the whole fullstack-dev-skills plugin from the repo's plugin branch: 67 skills (counted from that branch) and a commands folder with 10 command files. The tree has no hooks or MCP config files. The skills CLI, folder and Claude upload routes install only wordpress-pro.

From the project README. Source.

What's in the skill

When it loads

Develops custom WordPress themes and plugins, creates and registers Gutenberg blocks and block patterns, configures WooCommerce stores, implements WordPress REST API endpoints, applies security hardening (nonces, sanitization, escaping, capability checks), and optimizes performance through caching and query tuning. Use when building WordPress themes, writing plugins, customizing Gutenberg blocks, extending WooCommerce, working with ACF, using the WordPress REST API, applying hooks and filters, or improving WordPress performance and security.

Sections in SKILL.md

Core Workflow
Reference Guide
Key Implementation Patterns
Nonce Verification (form submissions)
Sanitization & Escaping
Enqueuing Scripts & Styles
Prepared Database Queries
Capability Checks
Constraints
MUST DO
MUST NOT DO
Output Templates
Knowledge Reference

Key facts

Author: Jeffallan (SKILL.md: Principal Consultant at Synergetic Solutions)
License: MIT
Installs on skills.sh: 9,951 (Nov 2, 2026)
GitHub stars: 12,161 for the whole jeffallan/claude-skills repo (Nov 2, 2026)
Last repo commit: Oct 30, 2026
Audits on skills.sh: Gen Agent Trust Hub: fail, Socket: pass, Snyk: pass
What it includes: 6 files including SKILL.md: 5 reference files in references/ (no scripts)
Part of: The fullstack-dev-skills plugin (67 skills, counted from the repo's plugin branch)
Used for validation: phpcs --standard=WordPress (PHP CodeSniffer with the WordPress standard)

What it includes

Analyze, design, implement, validate, optimize, test and secure
Six steps. Validation runs phpcs --standard=WordPress and a manual check of nonces and capabilities.
Runs code · Core workflow
Templates, hierarchy, child themes, full site editing
Loads references/theme-development.md.
Write · Theme development
Structure, activation, settings API, updates
Loads references/plugin-architecture.md, which includes an uninstall routine.
Write · Plugin architecture
Block development, patterns, dynamic blocks
Loads references/gutenberg-blocks.md, which shows npx @wordpress/create-block commands.
Runs code · Gutenberg blocks
Actions, filters, custom hooks, priorities
Loads references/hooks-filters.md.
Write · Hooks and filters
Caching, optimization, hardening, backups
Loads references/performance-security.md.
Write · Performance and security
Nonces, sanitizing input, escaping output, prepared queries, capability checks
Five code patterns in SKILL.md, plus rules to always use them.
Write · Security patterns
Plugin or theme file, template or block code, hooks, security code, short note
What Claude should return for a WordPress feature.
Write · Output templates

From the official docs

Permissions

Medium risk

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

Sample code deletes data and tables
plugin-architecture.md shows an uninstall routine with DELETE FROM and DROP TABLE IF EXISTS. Check any uninstall code before you ship it or test it on a site with real data. github.com
A backup example writes DROP TABLE statements
performance-security.md builds an SQL dump that includes DROP TABLE IF EXISTS lines. Do not restore such a dump onto a live database by accident. github.com
It may run npx scaffolding
gutenberg-blocks.md shows npx @wordpress/create-block commands, which download a package. Review the command first. github.com
The plugin route installs 67 skills
The fullstack-dev-skills plugin on the plugin branch of the repo has 67 skills and a commands folder. The tree shows no hooks or MCP config files. The skills-only routes install just wordpress-pro. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	No read-only mode. Use version control and a staging site.
Talks to	npm registry (only if you run the create-block commands)
Sign-in and keys	SKILL.md does not mention any account or key.
Scopes	Writes PHP, JS and CSS files for themes and plugins in your project May run phpcs and npx @wordpress/create-block Sample code includes database deletes for plugin uninstall

Questions

What does the wordpress-pro skill do?

It makes Claude write WordPress themes, plugins and Gutenberg blocks the WordPress way. It covers WooCommerce, REST API endpoints, hooks and filters, caching, and security habits like nonces, escaping and capability checks.

Is this an official WordPress skill?

No. SKILL.md says it is maintained by @jeffallan, Principal Consultant at Synergetic Solutions. It is not made by WordPress or Automattic.

How do I install it?

Use the install box at the top of this page. The README documents a Claude Code plugin called fullstack-dev-skills that holds 67 skills. A skills CLI command, folder copy and Claude upload install only this skill.

What does it need on my machine?

SKILL.md says to validate with phpcs --standard=WordPress, so PHP CodeSniffer with the WordPress standard helps. Its knowledge list names WordPress 6.4+ and PHP 8.1+.

Which skills does it work with?

Its front matter lists related skills: php-pro, laravel-specialist, fullstack-guardian and security-reviewer. They are optional hand-offs, not requirements.

Does it include destructive code?

Its reference files include sample code that runs DELETE FROM and DROP TABLE for plugin uninstall, and a backup example that writes DROP TABLE statements. Review that code before you run it on a live site.

Is it safe?

It bundles no scripts, only SKILL.md and 5 reference files. Claude may write PHP and run npx @wordpress/create-block or phpcs. Develop on a local or staging site and review any database code first.

Information

updated Nov 2, 2026

Repository: jeffallan/claude-skills
Folder: skills/wordpress-pro

jeffallan/claude-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 6

jeffallan/claude-skills README · github.com
fullstack-dev-skills plugin.json · github.com
wordpress-pro SKILL.md · github.com
plugin-architecture.md · github.com
performance-security.md · github.com
gutenberg-blocks.md · github.com