Last updated: 10th July 2026 for CC Security Essentials version 1.0

Introduction

CC Security Essentials has been designed to integrate naturally with WordPress while providing carefully considered extension points for developers.

This guide documents the actions, filters and APIs that are intended for use by third-party plugins, themes and custom code.

If you’re simply using CC Security Essentials to protect your website, you won’t normally need this guide. It’s intended for developers who want to customise or extend the plugin’s behaviour.

Philosophy

Like WordPress itself, CC Security Essentials aims to be extensible without requiring changes to the plugin’s source code.

Where customisation is supported, the plugin provides documented actions and filters that allow developers to integrate safely with future releases.

Only documented extension points should be considered part of the supported developer API.

Undocumented hooks, methods and classes are internal implementation details and may change without notice.

Before You Begin

We recommend that developers extending CC Security Essentials are familiar with:

WordPress actions and filters
WordPress capability checks
WordPress nonces
WordPress Coding Standards
WordPress internationalisation

Following standard WordPress development practices will help ensure your code remains compatible with future versions of both WordPress and CC Security Essentials.

Supported Extension Points

The developer documentation is organised into the following sections.

Actions

Actions allow your code to respond when significant events occur within CC Security Essentials.

Typical uses include:

performing additional processing
integrating with another plugin
logging information
triggering custom workflows

Filters

Filters allow your code to modify specific values before they are used by the plugin.

Typical uses include:

changing default behaviour
customising output
modifying recommendations
integrating organisation-specific requirements

Public APIs

Some functionality is provided through documented public PHP classes and methods.

Where these APIs are available, they are documented separately and may be relied upon by third-party developers.

Compatibility

The documented developer API is intended to remain stable throughout future 1.x releases wherever practical.

If changes become necessary:

replacement APIs will normally be introduced before older ones are removed
deprecated functionality will generally remain available for a reasonable period
significant changes will be documented in the release notes

This approach helps developers maintain compatibility while allowing the plugin to continue evolving.

Coding Guidelines

When extending CC Security Essentials we recommend that your code:

uses only documented extension points
escapes output appropriately
sanitises input
validates permissions
verifies nonces where appropriate
remains translation-ready
follows the WordPress Coding Standards

Avoid modifying the plugin’s source files directly, as these changes will be lost when the plugin is updated.

Finding What You Need

The remainder of this guide is organised by feature.

For example:

Security Health
Verification
XML-RPC Protection
REST API Protection
Disable Comments

Each section documents the supported actions, filters and public APIs relating to that feature.

Versioning

Each documented action, filter or API includes:

the version in which it was introduced
its purpose
its parameters
example usage where appropriate

This makes it easier to write extensions that remain compatible with future releases.

Getting Help

If you require functionality that isn’t currently exposed through the documented developer API, please let us know.

Where appropriate, additional extension points may be introduced in future releases to support common development scenarios.

Wherever possible, avoid relying on undocumented behaviour, as internal implementation details may change between versions.

Continue with:

CC Security Essentials Development Guide