Last updated: 10th July 2026 for CC Security Essentials version 1.0

Introduction

WordPress filters allow developers to customise selected CC Security Essentials values and behaviour without modifying the plugin’s source files.

A filter callback receives a value, may modify it, and must return a value of the expected type.

Only the filters documented on this page form part of the supported developer API. The plugin contains a small number of additional filters used for internal interface composition and product integration; these are deliberately not documented and should not be relied upon.

Using Filters

A typical filter callback follows this pattern:

add_filter(
    'ccse_example_filter',
    function ( $value ) {
        // Modify the value as required.

        return $value;
    }
);

Always return the expected data type. Returning an incompatible value may cause unexpected behaviour.

Filter Index

Modules and Options

Filter	Purpose
`ccse_modules`	Modify the modules initialised by the plugin.
`ccse_default_options`	Add or modify default settings.
`ccse_recommended_options`	Modify the settings applied by the recommended-settings action.
`ccse_sanitized_options`	Process settings after core sanitisation.
`ccse_import_settings`	Process imported settings after validation and sanitisation.
`ccse_export_payload`	Modify the generated settings export.

Features, Status and Recommendations

Filter	Purpose
`ccse_feature_metadata`	Add or modify feature descriptions and metadata.
`ccse_site_profile`	Modify the detected website profile and guidance.
`ccse_status_checks`	Add or modify Security Health status checks.
`ccse_status_check_weights`	Adjust Protection Score weighting.
`ccse_recommendations`	Add or modify Security Guide recommendations.

Verification

Filter	Purpose
`ccse_verify_check`	Supply a custom verification result for a check.
`ccse_verification_result`	Modify a completed verification result.

Compatibility

Filter	Purpose
`ccse_compatibility_items`	Add or modify compatibility guidance.
`ccse_detected_overlap_features`	Modify detected overlapping security features.
`ccse_overlap_provider_labels`	Modify labels describing external protection providers.

REST API Protection

Filter	Purpose
`ccse_rest_allowed_route_prefixes`	Add or remove publicly permitted REST route prefixes.
`ccse_rest_public_request_allowed`	Allow an individual public REST request.
`ccse_rest_visitor_block_status`	Modify the HTTP status returned for a blocked request.
`ccse_rest_visitor_block_error_code`	Modify the REST error code returned for a blocked request.
`ccse_rest_visitor_block_message`	Modify the error message returned for a blocked request.

Diagnostics

Filter	Purpose
`ccse_diagnostic_report`	Modify the downloadable diagnostic report.

Modules and Options

`ccse_modules`

$modules = apply_filters( 'ccse_modules', $modules );

Purpose

Filters the collection of module objects before their WordPress hooks are registered.

This allows an extension to add a compatible module without modifying the core plugin.

Parameters

Parameter	Type	Description
`$modules`	`array<int,object>`	Module objects to be initialised.

Return Value

Return the complete array of module objects.

Every added object must provide a public register_hooks() method.

Example

add_filter(
    'ccse_modules',
    function ( $modules ) {
        if ( class_exists( '\MyPlugin\SecurityModule' ) ) {
            $modules[] = new \MyPlugin\SecurityModule();
        }

        return $modules;
    }
);

Notes

An incompatible object is ignored because the plugin checks for register_hooks() before calling it.

Even so, extensions should add only objects deliberately designed to operate as modules.

`ccse_default_options`

$defaults = apply_filters( 'ccse_default_options', $defaults );

Purpose

Filters the complete default option tree.

Extensions may use this filter to add defaults for their own settings while preserving compatibility with the plugin’s normal settings, import and merge processes.

Parameters

Parameter	Type	Description
`$defaults`	`array<string,mixed>`	The default option tree, grouped by section.

Return Value

Return the complete default option tree.

Example

add_filter(
    'ccse_default_options',
    function ( $defaults ) {
        $defaults['my_extension'] = [
            'enabled' => false,
        ];

        return $defaults;
    }
);

Notes

New settings should be grouped within a unique section to avoid collisions with existing settings.

The value type of each default also influences the core sanitisation process. Boolean defaults are sanitised as boolean values, while array defaults are processed as string arrays.

`ccse_recommended_options`

$recommended = apply_filters( 'ccse_recommended_options', $recommended );

Purpose

Filters the low-risk settings applied when an administrator chooses to apply the plugin’s recommended configuration.

Parameters

Parameter	Type	Description
`$recommended`	`array<string,mixed>`	The complete recommended option tree.

Return Value

Return the complete recommended option tree.

Example

add_filter(
    'ccse_recommended_options',
    function ( $recommended ) {
        if ( isset( $recommended['my_extension'] ) ) {
            $recommended['my_extension']['enabled'] = true;
        }

        return $recommended;
    }
);

Notes

Only add settings that are low risk and suitable for the majority of affected websites.

This filter should not be used to silently enable potentially disruptive functionality.

`ccse_sanitized_options`

$sanitized = apply_filters(
    'ccse_sanitized_options',
    $sanitized,
    $input
);

Purpose

Filters plugin settings after the core settings have been sanitised and merged with their defaults, but before they are saved.

The filter runs for both individual settings-section submissions and full option processing.

Parameters

Parameter	Type	Description
`$sanitized`	`array<string,mixed>`	The sanitised and merged option tree.
`$input`	`mixed`	The originally submitted input.

Return Value

Return the complete sanitised option tree.

Example

add_filter(
    'ccse_sanitized_options',
    function ( $sanitized, $input ) {
        if ( isset( $sanitized['my_extension']['enabled'] ) ) {
            $sanitized['my_extension']['enabled'] =
                (bool) $sanitized['my_extension']['enabled'];
        }

        return $sanitized;
    },
    10,
    2
);

Security

The second parameter contains the original submitted input and must be treated as untrusted.

Any value introduced through this filter must be independently validated and sanitised before it is returned.

`ccse_import_settings`

$settings = apply_filters(
    'ccse_import_settings',
    $settings,
    $input
);

Purpose

Filters imported settings after the core plugin has validated, sanitised and merged recognised settings.

Extensions may use this filter to validate or migrate their own imported settings.

Parameters

Parameter	Type	Description
`$settings`	`array<string,mixed>`	Sanitised settings prepared for import.
`$input`	`array<string,mixed>`	The original imported settings.

Return Value

Return the complete sanitised settings array.

Example

add_filter(
    'ccse_import_settings',
    function ( $settings, $input ) {
        if ( isset( $input['my_extension']['mode'] ) ) {
            $allowed_modes = [ 'standard', 'strict' ];
            $mode          = sanitize_key( $input['my_extension']['mode'] );

            $settings['my_extension']['mode'] =
                in_array( $mode, $allowed_modes, true )
                    ? $mode
                    : 'standard';
        }

        return $settings;
    },
    10,
    2
);

Security

Never copy values directly from $input into $settings.

Imported files must always be treated as untrusted input.

`ccse_export_payload`

$payload = apply_filters( 'ccse_export_payload', $payload );

Purpose

Filters the complete settings export payload before it is encoded and downloaded.

Extensions can use this filter to add version information or export their own settings alongside the core settings.

Parameters

Parameter	Type	Description
`$payload`	`array<string,mixed>`	The complete export payload.

The payload initially includes:

Key	Description
`plugin`	Plugin identifier.
`plugin_name`	Human-readable plugin name.
`schema`	Export schema version.
`version`	Installed plugin version.
`site_url`	Website URL.
`wordpress`	WordPress version.
`exported_at`	UTC export time.
`settings`	The exported option tree.

Return Value

Return the complete export payload.

Example

add_filter(
    'ccse_export_payload',
    function ( $payload ) {
        $payload['my_extension'] = [
            'version' => '1.0.0',
        ];

        return $payload;
    }
);

Privacy

Avoid adding personal information, secrets, credentials or unnecessary server information to the export.

Export files may be downloaded, copied or retained outside WordPress.

Features, Status and Recommendations

`ccse_feature_metadata`

$features = apply_filters( 'ccse_feature_metadata', $features );

Purpose

Filters the metadata used to describe security features throughout the plugin.

Feature metadata connects status checks with labels, explanations, recommendations and relevant administration sections.

Parameters

Parameter	Type	Description
`$features`	`array<string,array<string,mixed>>`	Feature metadata keyed by feature or status-check identifier.

Return Value

Return the complete feature metadata array.

Example

add_filter(
    'ccse_feature_metadata',
    function ( $features ) {
        $features['my_security_check'] = [
            'label'       => __( 'Custom protection', 'my-plugin' ),
            'description' => __( 'Explains the custom protection.', 'my-plugin' ),
            'tab'         => 'overview',
            'anchor'      => '',
        ];

        return $features;
    }
);

Notes

Feature metadata is consumed by several parts of the administration interface. Extensions should preserve the structure and data types used by existing entries.

A custom feature normally also requires a matching status check and, where appropriate, a recommendation or verification callback.

`ccse_site_profile`

$profile = apply_filters(
    'ccse_site_profile',
    $profile,
    $profile_id
);

Purpose

Filters the detected website profile and its context-sensitive guidance.

The core plugin currently recognises profiles such as:

WooCommerce;
membership or community;
blog or content;
brochure website.

Parameters

Parameter	Type	Description
`$profile`	`array<string,string>`	Profile label, description and recommendation.
`$profile_id`	`string`	Machine-readable profile identifier.

Return Value

Return an array containing the profile information.

The expected keys are:

Key	Description
`label`	Human-readable profile name.
`description`	Explanation of the detected profile.
`recommendation`	Context-sensitive security guidance.

Example

add_filter(
    'ccse_site_profile',
    function ( $profile, $profile_id ) {
        if ( 'woocommerce' === $profile_id ) {
            $profile['recommendation'] .= ' ' .
                __( 'Also test the custom product application.', 'my-plugin' );
        }

        return $profile;
    },
    10,
    2
);

Notes

This filter modifies the profile selected by the core detection process. It does not change which profile is detected.

`ccse_status_checks`

$checks = apply_filters( 'ccse_status_checks', $checks );

Purpose

Filters the Security Health checks after the core checks and their available verification results have been prepared.

Extensions can add their own status checks or modify existing checks.

Parameters

Parameter	Type	Description
`$checks`	`array<string,array<string,mixed>>`	Status checks keyed by check identifier.

Return Value

Return the complete status-check array.

Example

add_filter(
    'ccse_status_checks',
    function ( $checks ) {
        $checks['my_security_check'] = [
            'label'       => __( 'Custom protection', 'my-plugin' ),
            'protected'   => true,
            'managed_by'  => __( 'My Plugin', 'my-plugin' ),
            'verification' => [
                'supported' => false,
                'verified'  => null,
            ],
        ];

        return $checks;
    }
);

Notes

The status-check structure contains values used by the Overview, Security Health, recommendations and Protection Score.

Review the current core check structure before adding a custom item, and use a unique identifier.

`ccse_status_check_weights`

$weights = apply_filters( 'ccse_status_check_weights', $weights );

Purpose

Filters the relative weights used when calculating the Protection Score.

Higher values give a status check greater influence over the final score.

Parameters

Parameter	Type	Description
`$weights`	`array<string,int>`	Weights keyed by status-check identifier.

Return Value

Return the complete weights array.

All effective weights are normalised to a minimum value of 1.

Example

add_filter(
    'ccse_status_check_weights',
    function ( $weights ) {
        $weights['my_security_check'] = 2;

        return $weights;
    }
);

Notes

Weights should represent the relative security importance of each check.

Avoid excessively high values that distort the score or make other protections appear insignificant.

`ccse_recommendations`

$recommendations = apply_filters(
    'ccse_recommendations',
    $recommendations
);

Purpose

Filters the recommendations generated for the Security Guide and related interfaces.

Extensions may add relevant recommendations or adjust those associated with custom status checks.

Parameters

Parameter	Type	Description
`$recommendations`	`array<int,array<string,mixed>>`	Generated recommendation items.

Return Value

Return the complete recommendation list.

Example

add_filter(
    'ccse_recommendations',
    function ( $recommendations ) {
        $recommendations[] = [
            'id'          => 'my_security_check',
            'title'       => __( 'Review the custom protection', 'my-plugin' ),
            'description' => __( 'Explain why this protection matters.', 'my-plugin' ),
            'tab'         => 'overview',
            'anchor'      => '',
            'complete'    => false,
            'optional'    => true,
        ];

        return $recommendations;
    }
);

Notes

Recommendations should be:

relevant to the website;
understandable without specialist knowledge;
actionable;
calm and proportionate;
linked to an appropriate configuration or information page where possible.

Verification

`ccse_verify_check`

$custom_result = apply_filters(
    'ccse_verify_check',
    null,
    $check_id
);

Purpose

Allows an extension to supply a verification result for a status check before the core verification handlers run.

Returning an array short-circuits the normal core verification process for that check. Returning null allows normal processing to continue.

Parameters

Parameter	Type	Description
`$custom_result`	`array<string,mixed>\|null`	A custom result, or `null` to continue.
`$check_id`	`string`	The status-check identifier being verified.

Return Value

Return either:

null to allow normal verification to continue; or
a complete verification-result array.

The expected result keys are:

Key	Type	Description
`supported`	`bool`	Whether verification is available.
`verified`	`bool\|null`	Whether protection was confirmed, or `null` when unavailable.
`label`	`string`	Short result label.
`message`	`string`	Explanatory result message.

Example

add_filter(
    'ccse_verify_check',
    function ( $result, $check_id ) {
        if ( 'my_security_check' !== $check_id ) {
            return $result;
        }

        $verified = my_plugin_protection_is_active();

        return [
            'supported' => true,
            'verified'  => $verified,
            'label'     => $verified
                ? __( 'Verified', 'my-plugin' )
                : __( 'Requires attention', 'my-plugin' ),
            'message'   => $verified
                ? __( 'The custom protection is operating correctly.', 'my-plugin' )
                : __( 'The custom protection could not be confirmed.', 'my-plugin' ),
        ];
    },
    10,
    2
);

Notes

Only return a result for check identifiers owned by your extension unless you deliberately intend to replace a core verifier.

Verification should confirm actual behaviour wherever practical rather than merely reading a saved setting.

`ccse_verification_result`

$result = apply_filters(
    'ccse_verification_result',
    $result,
    $check_id
);

Purpose

Filters a completed verification result before it is returned to the caller.

This applies to both core verification results and results supplied through ccse_verify_check.

Parameters

Parameter	Type	Description
`$result`	`array<string,mixed>`	The completed verification result.
`$check_id`	`string`	The status-check identifier.

Return Value

Return the complete verification-result array.

Example

add_filter(
    'ccse_verification_result',
    function ( $result, $check_id ) {
        if ( 'my_security_check' === $check_id ) {
            $result['message'] .= ' ' .
                __( 'Reviewed by the custom integration.', 'my-plugin' );
        }

        return $result;
    },
    10,
    2
);

Notes

Preserve the expected supported, verified, label and message keys.

This filter is best used for small amendments. Use ccse_verify_check to provide a complete custom verifier.

Compatibility

`ccse_compatibility_items`

$items = apply_filters( 'ccse_compatibility_items', $items );

Purpose

Filters compatibility notices and review items shown by the plugin.

Extensions may add guidance when another plugin, theme or website configuration requires administrator attention.

Parameters

Parameter	Type	Description
`$items`	`array<int,array<string,string>>`	Compatibility items.

Return Value

Return the complete compatibility-item array.

Example

add_filter(
    'ccse_compatibility_items',
    function ( $items ) {
        $items[] = [
            'status'         => 'review',
            'title'          => __( 'Review the custom integration', 'my-plugin' ),
            'description'    => __( 'This integration may require public REST access.', 'my-plugin' ),
            'recommendation' => __( 'Test it while signed out before restricting REST access.', 'my-plugin' ),
        ];

        return $items;
    }
);

Notes

Compatibility messages should explain the practical issue and provide a proportionate next step. Avoid vague warnings or unnecessarily alarming language.

`ccse_detected_overlap_features`

$features = apply_filters(
    'ccse_detected_overlap_features',
    $features
);

Purpose

Filters the feature identifiers that appear to be provided by another active plugin or service.

This allows an integration to report that a protection is already being managed elsewhere.

Parameters

Parameter	Type	Description
`$features`	`array<string,bool>`	Detected feature identifiers and their status.

Return Value

Return the complete detected-feature map.

Example

add_filter(
    'ccse_detected_overlap_features',
    function ( $features ) {
        if ( my_plugin_blocks_xmlrpc() ) {
            $features['xmlrpc'] = true;
        }

        return $features;
    }
);

Notes

Only report a feature when the integration can determine with reasonable confidence that it is actively managed elsewhere.

`ccse_overlap_provider_labels`

$provider_map = apply_filters(
    'ccse_overlap_provider_labels',
    $provider_map
);

Purpose

Filters the human-readable labels used when CC Security Essentials reports that another component appears to provide a protection.

Parameters

Parameter	Type	Description
`$provider_map`	`array<string,string>`	Provider labels keyed by feature identifier.

Return Value

Return the complete provider-label map.

Example

add_filter(
    'ccse_overlap_provider_labels',
    function ( $provider_map ) {
        $provider_map['my_security_check'] =
            __( 'the organisation security plugin', 'my-plugin' );

        return $provider_map;
    }
);

Notes

Labels are inserted into administrator-facing sentences. Use concise, lower-case wording that reads naturally in context.

REST API Protection

`ccse_rest_allowed_route_prefixes`

$allowed_prefixes = apply_filters(
    'ccse_rest_allowed_route_prefixes',
    $allowed_prefixes,
    $request
);

Purpose

Filters the REST route prefixes that remain publicly accessible when REST API visitor restriction and its compatibility allowlist are enabled.

A route is allowed when its normalised path begins with one of the returned prefixes.

Parameters

Parameter	Type	Description
`$allowed_prefixes`	`array<int,string>`	Publicly permitted REST route prefixes.
`$request`	`WP_REST_Request`	The current REST request.

Return Value

Return the complete array of route prefixes.

Example

add_filter(
    'ccse_rest_allowed_route_prefixes',
    function ( $prefixes, $request ) {
        $prefixes[] = '/my-plugin/v1/public/';

        return $prefixes;
    },
    10,
    2
);

Security

Adding a prefix may expose every route beginning with that value.

Use the narrowest practical prefix and verify that every matching endpoint is intended for public access.

`ccse_rest_public_request_allowed`

$allowed = apply_filters(
    'ccse_rest_public_request_allowed',
    false,
    $route,
    $method,
    $request
);

Purpose

Allows an extension to approve an individual unauthenticated REST API request that was not matched by the compatibility allowlist.

Parameters

Parameter	Type	Description
`$allowed`	`bool`	Whether the request is allowed. Defaults to `false`.
`$route`	`string`	The normalised REST route.
`$method`	`string`	The uppercase HTTP request method.
`$request`	`WP_REST_Request`	The complete request object.

Return Value

Return true to permit the request or false to leave it blocked.

Example

add_filter(
    'ccse_rest_public_request_allowed',
    function ( $allowed, $route, $method, $request ) {
        if (
            '/my-plugin/v1/availability' === $route
            && 'GET' === $method
        ) {
            return true;
        }

        return $allowed;
    },
    10,
    4
);

Security

Review the route, method and purpose carefully before allowing a request.

Do not return true unconditionally, as doing so would effectively bypass visitor restriction for every unmatched REST request.

`ccse_rest_visitor_block_status`

$status = apply_filters(
    'ccse_rest_visitor_block_status',
    403,
    $route,
    $method,
    $request
);

Purpose

Filters the HTTP status code returned when REST API Protection blocks an unauthenticated visitor request.

The default is 403 Forbidden.

Parameters

Parameter	Type	Description
`$status`	`int`	HTTP status code.
`$route`	`string`	Requested REST route.
`$method`	`string`	Uppercase HTTP request method.
`$request`	`WP_REST_Request`	The complete request object.

Return Value

Return an appropriate integer HTTP status code.

Example

add_filter(
    'ccse_rest_visitor_block_status',
    function ( $status, $route, $method, $request ) {
        return 403;
    },
    10,
    4
);

Notes

Use a status code that accurately represents the website’s behaviour.

Changing the status may affect clients or integrations that interpret REST responses programmatically.

`ccse_rest_visitor_block_error_code`

$code = apply_filters(
    'ccse_rest_visitor_block_error_code',
    'ccse_rest_visitor_blocked',
    $request
);

Purpose

Filters the WordPress REST error code returned when a visitor request is blocked.

Parameters

Parameter	Type	Description
`$code`	`string`	REST error code.
`$request`	`WP_REST_Request`	The blocked request.

Return Value

Return a valid machine-readable error-code string.

Example

add_filter(
    'ccse_rest_visitor_block_error_code',
    function ( $code, $request ) {
        return 'organisation_rest_access_restricted';
    },
    10,
    2
);

Notes

Changing the error code may affect integrations that test for the default value.

Use a stable, lower-case identifier containing only appropriate key characters.

`ccse_rest_visitor_block_message`

$message = apply_filters(
    'ccse_rest_visitor_block_message',
    $message,
    $request
);

Purpose

Filters the message returned when REST API Protection blocks a visitor request.

Parameters

Parameter	Type	Description
`$message`	`string`	Visitor-facing REST error message.
`$request`	`WP_REST_Request`	The blocked request.

Return Value

Return the complete visitor-facing message.

Example

add_filter(
    'ccse_rest_visitor_block_message',
    function ( $message, $request ) {
        return __(
            'Public access to this service is not available.',
            'my-plugin'
        );
    },
    10,
    2
);

Notes

Keep the message clear without exposing unnecessary implementation or security details.

Because this text may be shown to visitors or API consumers, it should also be translation-ready.

Diagnostics

`ccse_diagnostic_report`

$report = apply_filters(
    'ccse_diagnostic_report',
    $report,
    $checks,
    $items
);

Purpose

Filters the plain-text diagnostic report before it is downloaded.

Extensions may add concise information needed to investigate their own integration.

Parameters

Parameter	Type	Description
`$report`	`string`	Generated diagnostic-report text.
`$checks`	`array<int,array>`	Current status-check information.
`$items`	`array<int,array>`	Current compatibility items.

Return Value

Return the complete plain-text report.

Example

add_filter(
    'ccse_diagnostic_report',
    function ( $report, $checks, $items ) {
        $report .= "\n\nMY EXTENSION\n";
        $report .= 'Version: ' . MY_PLUGIN_VERSION . "\n";
        $report .= 'Mode: ' . my_plugin_get_mode() . "\n";

        return $report;
    },
    10,
    3
);

Privacy

Diagnostic reports may be copied or sent to a support provider.

Do not include:

passwords or authentication tokens;
API keys;
private request data;
personal information that is not genuinely required;
database credentials or filesystem secrets.

Filter Interaction Summary

A more advanced extension may use several filters together.

For example, a custom security feature might:

add its default settings through ccse_default_options;
register a module through ccse_modules;
describe itself through ccse_feature_metadata;
report its current state through ccse_status_checks;
provide verification through ccse_verify_check;
add administrator guidance through ccse_recommendations;
contribute troubleshooting information through ccse_diagnostic_report.

Each filter remains independent, so an extension should use only those it genuinely requires.

API Stability

The filters documented on this page are treated as supported extension points for the CC Security Essentials 1.x release series.

Where practical:

filter names will remain unchanged;
parameter meanings and expected types will remain stable;
existing filters will not be removed without prior deprecation;
significant changes will be documented in release notes.

Developers should not rely on undocumented filters, internal classes or private methods.

Best Practices

When using these filters:

always return the expected value;
preserve the documented data structure;
validate and sanitise untrusted input;
use unique identifiers for custom checks and settings;
keep callbacks efficient;
avoid changing core behaviour more broadly than necessary;
test custom integrations on a development or staging website;
review the security and privacy consequences of each customisation.

Continue with: