Vibe Coding for WordPress

Vibe coding means describing what you want in natural language, letting an AI write the code, then steering it with feedback until it works. It’s the fastest way for non-developers to build custom WordPress features — and a huge speed boost for developers.

The 6-step vibe coding loop

1. Describe the outcome — What should users see and do? Where in WordPress does it live (post, settings page, block, shortcode)?
2. Ask for a plugin, not theme edits — A small standalone plugin survives theme changes and can be switched off instantly.
3. Generate & read — Ask the AI to explain each function in plain English. If you can’t follow it, ask for a simpler version.
4. Security review — Run the checklist below (and ask the AI to review its own code against it).
5. Test off-site — Load it in WordPress Playground or a staging site. Turn on WP_DEBUG and watch for notices.
6. Ship & version — Zip it, upload via Plugins → Add New → Upload, and keep the code in Git so you can roll back.

The Professor’s security checklist

• Sanitize input — sanitize_text_field(), absint(), sanitize_email()…
• Escape output — esc_html(), esc_attr(), esc_url(), wp_kses_post().
• Nonces on every form/action — wp_nonce_field() + check_admin_referer().
• Capability checks — current_user_can( 'manage_options' ) before anything privileged.
• Prepared SQL — always $wpdb->prepare().
• Unique prefixes — on functions, options and hooks to avoid collisions.
• No secrets in code — use constants in wp-config.php or the options table.

Starter prompt

Write a small, self-contained WordPress plugin that [FEATURE].
Requirements:
- Single PHP file with a proper plugin header and ABSPATH guard
- Prefix everything with [prefix]_
- Sanitize all input, escape all output, use nonces and capability checks
- Use the Settings API for any options; clean up options on uninstall
- Translation-ready strings with text domain [text-domain]
Explain each function in one sentence after the code.

Tools for vibe coding

Deep dives