.phpcs.xml

<?xml version="1.0"?>
<ruleset name="Custom 404 Pro">
    <description>Coding standards for Custom 404 Pro</description>

    <file>.</file>
    <exclude-pattern>vendor/*</exclude-pattern>
    <exclude-pattern>tests/*</exclude-pattern>

    <!-- Only lint PHP files; skip JS, CSS, etc. -->
    <arg name="extensions" value="php"/>

    <arg name="basepath" value="."/>
    <arg name="colors"/>
    <arg value="sp"/>
    <!-- Do not fail CI on warnings — only errors count -->
    <arg name="warning-severity" value="0"/>

    <config name="minimum_supported_wp_version" value="5.0"/>

    <rule ref="WordPress-Core">
        <!--
            Docblocks for all classes/methods/properties are intentionally deferred.
            Adding them to the entire codebase is a separate effort.
        -->
        <exclude name="Squiz.Commenting"/>
        <!--
            This plugin intentionally uses custom database tables and performs direct queries.
            Caching these queries would require significant architectural changes.
            Individual queries are annotated with phpcs:ignore where appropriate.
        -->
        <exclude name="WordPress.DB.DirectDatabaseQuery"/>
        <!--
            Table names are constructed from $wpdb->prefix and hardcoded strings — never
            from user input. The PreparedSQL sniff cannot distinguish this, so it is
            excluded at the ruleset level. User-input values are always passed via
            $wpdb->prepare() placeholders.
        -->
        <exclude name="WordPress.DB.PreparedSQL.NotPrepared"/>
        <exclude name="WordPress.DB.PreparedSQLPlaceholders"/>
        <!--
            WP_List_Table uses standard GET parameters (orderby, order, s) for sorting
            and search without nonces — this is the established WordPress list table pattern.
        -->
        <exclude name="WordPress.Security.NonceVerification"/>
    </rule>
    <rule ref="WordPress-Extra">
        <exclude name="Squiz.Commenting"/>
        <exclude name="WordPress.DB.DirectDatabaseQuery"/>
        <exclude name="WordPress.DB.PreparedSQL.NotPrepared"/>
        <exclude name="WordPress.DB.PreparedSQLPlaceholders"/>
        <exclude name="WordPress.Security.NonceVerification"/>
    </rule>
</ruleset>