Claude Code for WordPress Development: Plugins, Themes & Blocks

WordPress still powers over 40% of the web, but most WordPress developers have never used an AI coding agent for more than autocomplete. That's a gap — Claude Code can scaffold a custom post type, wire up a REST API controller, or generate a full block theme from a Figma export, all from your terminal, while following WordPress Coding Standards instead of generic PHP conventions.

This guide walks through the actual workflow: setup, the WordPress-specific patterns Claude needs to know about, security guardrails you should never skip, and a step-by-step example of building a real plugin.

Why WordPress Development Needs a Different Approach

Generic AI coding help falls apart on WordPress because the platform has conventions that don't exist anywhere else in PHP:

• Hooks and filters — WordPress is event-driven through add_action() and add_filter(), not typical MVC routing
• The Options and Transients APIs — for persistence, instead of ad-hoc config files
• Nonce verification and capability checks — required on every form submission and REST endpoint, or you ship a vulnerability
• The Block Editor (Gutenberg) — themes and many plugins now need block.json, React-based edit components, and render.php server-side rendering
• WordPress Coding Standards (WPCS) — a stricter, more opinionated style than PSR-12

An AI agent that doesn't know these patterns will generate code that "works" in a demo but fails a plugin review, misses a nonce check, or breaks on multisite. The fix isn't a smarter model — it's giving Claude Code the right context before you start.

Step 1: Set Up Your Local Environment

Don't point Claude Code at a production site on day one.

markdown# CLAUDE.md
This is a WordPress plugin for [purpose].
- Target: WordPress 6.8+, PHP 8.2+
- Follow WordPress Coding Standards (WPCS), not PSR-12
- All user input must be sanitized; all output must be escaped
- REST routes live under the `myplugin/v1` namespace
- Use `add_action`/`add_filter`, not direct hook table manipulation

This single file does more for output quality than any prompt tweak — Claude reads it automatically at the start of every session.

Step 2: Add WordPress-Specific Skills and MCP Connectors

Claude Code supports Skills (packaged instructions for a recurring task) and MCP servers (live connections to external systems). For WordPress work, two integrations matter most:

If you don't want live-site access yet, skip the MCP connector and just work against your local instance with file access — you still get the coding-standards benefit from CLAUDE.md.

Step 3: Build a Plugin, Step by Step

Here's a realistic example: a plugin that adds a custom post type for "Case Studies" with a REST endpoint.

Create a WordPress plugin that registers a case_study custom post type (public, with REST support), adds a custom taxonomy industry, and exposes a read-only REST route at myplugin/v1/case-studies filterable by industry. Follow WPCS, sanitize all inputs, and use register_post_type/register_taxonomy inside an init hook.

Claude Code will typically produce:

php<?php
/**
 * Plugin Name: Case Studies
 * Description: Adds a Case Study post type with a filterable REST endpoint.
 * Version: 1.0.0
 */

defined( 'ABSPATH' ) || exit;

add_action( 'init', function () {
    register_post_type( 'case_study', [
        'public'       => true,
        'label'        => __( 'Case Studies', 'case-studies' ),
        'show_in_rest' => true,
        'supports'     => [ 'title', 'editor', 'thumbnail' ],
    ] );

    register_taxonomy( 'industry', 'case_study', [
        'public'       => true,
        'show_in_rest' => true,
        'hierarchical' => true,
    ] );
} );

add_action( 'rest_api_init', function () {
    register_rest_route( 'myplugin/v1', '/case-studies', [
        'methods'             => 'GET',
        'callback'            => 'myplugin_get_case_studies',
        'permission_callback' => '__return_true',
        'args'                => [
            'industry' => [
                'sanitize_callback' => 'sanitize_text_field',
            ],
        ],
    ] );
} );

function myplugin_get_case_studies( WP_REST_Request $request ) {
    $industry = $request->get_param( 'industry' );

    $query_args = [
        'post_type'      => 'case_study',
        'posts_per_page' => 20,
    ];

    if ( $industry ) {
        $query_args['tax_query'] = [
            [
                'taxonomy' => 'industry',
                'field'    => 'slug',
                'terms'    => sanitize_title( $industry ),
            ],
        ];
    }

    $query = new WP_Query( $query_args );

    return array_map( function ( $post ) {
        return [
            'id'    => $post->ID,
            'title' => get_the_title( $post ),
            'link'  => get_permalink( $post ),
        ];
    }, $query->posts );
}

Notice the details a WordPress-aware prompt produces automatically: defined('ABSPATH') || exit; to block direct file access, sanitize_callback on the REST argument, and registration inside proper hooks rather than at the top level of the file. This is the difference a good CLAUDE.md and WordPress-specific context make.

• "Add a nonce-protected admin settings page for the industry list"
• "Add PHPUnit tests using the WordPress test scaffold"
• "Convert the taxonomy registration to use WP_REST_Terms_Controller conventions"

Step 4: Security Checklist Before You Ship

AI-generated WordPress code is only as safe as the review it gets. Before activating anything on a live site, verify:

Ask Claude directly: "Review this file for WordPress security issues — missing nonces, unescaped output, unsanitized input, and REST permission gaps." This catches most of the checklist above in one pass, but a human review is still worth doing before deploying to production.

Blocks and Themes: The Same Pattern, Different Files

For block development, the workflow is the same but the file set changes: block.json for metadata, edit.js for the editor-side React component, and render.php for server-side rendering. Prompt Claude with the block's purpose and ask it to scaffold all three files together — mismatches between them are the most common source of "works in editor, broken on the front end" bugs.

Key Takeaways

• WordPress has its own conventions (hooks, nonces, WPCS) that generic AI coding help doesn't know by default — a project CLAUDE.md fixes this in one file
• Start local, not on production — WordPress Studio or wp-env plus file access gets you 90% of the value without live-site risk
• WordPress MCP connectors and the emerging Abilities API let Claude verify behavior against a running site instead of guessing
• Never skip the security checklist: sanitize input, escape output, verify nonces, gate REST permissions, and use $wpdb->prepare()
• Treat blocks and custom post types as multi-file units — ask Claude to generate all related files together to avoid editor/frontend mismatches

Next Steps

Want a structured way to validate what you actually understand about AI-assisted development workflows like this one? AI for Anything offers a free practice quiz and study path for the Claude Certified Architect (CCA) track — useful whether you're prepping for certification or just want to stress-test your grasp of how Claude's tools fit together in a real dev workflow.