phpcs.xml

<?xml version="1.0"?>
<ruleset name="PSR12-based Coding Standards">
	<description>Custom variant of PSR12 with WordPress security checks for PHP development</description>

	<!-- Default ruleset is PSR12 with one exception - tabs instead of spaces is allowed and preferred -->
	<rule ref="PSR12">
		<exclude name="Generic.WhiteSpace.DisallowTabIndent"/>
	</rule>
	<rule ref="Generic.WhiteSpace.DisallowSpaceIndent"/>

	<!-- WordPress security rules are included to check for sanitization of WordPress code -->
	<rule ref="WordPress.DB.PreparedSQLPlaceholders"/>
	<rule ref="WordPress.DB.RestrictedFunctions"/>
	<rule ref="WordPress.DB.RestrictedClasses"/>
	<rule ref="WordPress.Security.EscapeOutput"/>
	<rule ref="WordPress.Security.NonceVerification"/>
	<rule ref="WordPress.WP.EnqueuedResources"/>

	<!-- Check for WordPress deprecated code -->
	<rule ref="WordPress.WP.DeprecatedFunctions"/>
	<rule ref="WordPress.WP.DeprecatedClasses"/>
	<rule ref="WordPress.WP.DeprecatedParameters"/>
	<rule ref="WordPress.WP.DeprecatedParameterValues"/>
	<rule ref="WordPress.WP.AlternativeFunctions"/>
	<rule ref="WordPress.WP.DiscouragedConstants"/>
	<rule ref="WordPress.WP.DiscouragedFunctions"/>

	<!-- Exclude node and vendor directories -->
	<exclude-pattern>*/node_modules/*</exclude-pattern>
	<exclude-pattern>*/vendor/*</exclude-pattern>

	<!-- Check the files in the project directory. Where this xml file should be located. -->
	<file>.</file>

	<!-- Exclude the project directory path from the report, making for cleaner output. -->
	<arg name="basepath" value="."/>

	<!-- Check only PHP files. -->
	<arg name="extensions" value="php"/>

	<!-- Display output in color on the command line. Show the sniffs. Show progress. -->
	<arg name="colors" />
	<arg value="s" />
	<arg value="p" />

</ruleset>