Developer Best Practices

Last updated: 10th July 2026 for CC Security Essentials version 1.0

Introduction

CC Security Essentials has been designed to be extended where appropriate, but not every customisation requires integration with the plugin.

This guide explains how to decide whether your functionality should extend CC Security Essentials or exist independently.

In general, extensions should complement the plugin rather than replace or duplicate its behaviour.

Extend Rather Than Replace

If the functionality you need builds naturally on an existing feature provided by CC Security Essentials, consider extending it using the documented developer API.

For example:

  • reacting to a completed verification
  • adding additional checks to Security Health
  • customising recommendations
  • integrating with another plugin
  • responding to security-related events

This approach keeps your extension lightweight while allowing CC Security Essentials to continue managing its own functionality.

Build Independently Where Appropriate

Not every security-related feature belongs inside CC Security Essentials.

If your functionality is unrelated to the plugin’s existing capabilities, it may be better implemented as a separate plugin.

Examples include:

  • bespoke business workflows
  • organisation-specific administration tools
  • reporting systems
  • integrations with external services

Keeping responsibilities separate generally makes both plugins easier to maintain.

Avoid Duplicating Existing Features

Before writing custom code, check whether CC Security Essentials already provides the functionality you need.

For example, avoid writing your own implementation of:

  • XML-RPC protection
  • REST API visitor restriction
  • login protection
  • password policies

Instead, consider whether your extension can build upon the existing behaviour.

Reducing duplicated functionality helps avoid conflicting behaviour and simplifies ongoing maintenance.

Keep Extensions Focused

Extensions are usually easier to understand and maintain when they have a single purpose.

For example:

  • integrate with another plugin
  • add organisation-specific checks
  • customise recommendations
  • automate an administrative task

Avoid creating extensions that attempt to modify large parts of the plugin simultaneously.

Smaller, focused extensions are generally more reliable and easier to test.

Respect Administrator Choices

Extensions should work with the website administrator rather than against them.

For example:

  • respect configured settings
  • honour user capabilities
  • avoid silently changing configuration
  • provide clear administrative feedback where appropriate

Administrators should always remain in control of their website’s security configuration.

Avoid Making Assumptions

Different websites use CC Security Essentials in different ways.

Avoid assuming that:

  • every protection is enabled
  • every recommendation has been accepted
  • Pro is installed
  • particular plugins are present
  • particular themes are active

Your extension should adapt gracefully to different environments.

Handle Missing Functionality Gracefully

If your extension depends on functionality provided by CC Security Essentials, always check that the required feature is available before attempting to use it.

For example:

  • verify that required classes exist
  • confirm that documented APIs are available
  • handle unavailable functionality without generating fatal errors

Providing sensible fallback behaviour improves compatibility across different installations.

Respect Performance

Security plugins run on every website request.

Extensions should therefore be efficient.

Avoid:

  • unnecessary database queries
  • expensive processing on every page load
  • loading large libraries when they’re not required
  • repeated calculations that can be cached

Efficient extensions benefit both administrators and visitors.

Write Predictable Code

Administrators value software that behaves consistently.

Your extension should therefore:

  • produce predictable results
  • avoid unexpected side effects
  • log meaningful errors where appropriate
  • fail gracefully if required functionality isn’t available

Predictability makes both support and troubleshooting much easier.

Think About the Administrator Experience

Good extensions don’t simply work well—they’re also pleasant to use.

If your extension includes administrative pages:

  • follow standard WordPress interface conventions
  • use clear language
  • explain settings before presenting options
  • avoid unnecessary technical jargon
  • provide helpful validation messages

A consistent user experience helps administrators feel confident when configuring your extension.

Test with Realistic Websites

Whenever possible, test your extension against websites that reflect real-world usage.

For example:

  • a small business website
  • an online shop
  • a content-focused website
  • a website with several administrator accounts

Testing with realistic scenarios often reveals issues that synthetic test environments can miss.

Maintain Compatibility

Before releasing an extension, test it with:

  • the latest version of WordPress
  • the latest version of CC Security Essentials
  • both PHP versions supported by the plugin (where practical)

Regular compatibility testing helps reduce support issues after release.

Summary

Well-designed extensions should:

  • build upon documented functionality
  • remain independent of internal implementation
  • respect administrator choices
  • perform efficiently
  • integrate naturally with WordPress
  • remain easy to maintain

Following these principles helps ensure that your extensions continue to work reliably as both WordPress and CC Security Essentials evolve.

Next Step

The following sections document the supported developer APIs, beginning with the plugin’s public Actions and Filters.

Related Articles

Continue with: