Wp Guard

If you've ever had Claude write a WordPress plugin that looked fine until you noticed the raw echo of $_POST data or the AJAX handler with no nonce check, this is the guardrail you needed three plugins ago. It enforces the unglamorous essentials that separate demo code from production code: escaping at output, sanitization on input, prepared statements for every query, capability checks on state changes, translation wrappers on user strings, and query discipline so you don't accidentally fetch ten thousand posts. Best run reactively after code generation, not during. It catches the systematic failures AI makes with WordPress security and i18n, the kind WPCS would flag if you remembered to run it.