- How do I install szepeviktor/phpstan-wordpress in a Laravel project?
- Install it as a dev dependency with composer require --dev szepeviktor/phpstan-wordpress. If you already use phpstan/extension-installer, the extension is registered automatically; otherwise include its extension.neon manually in your phpstan.neon. It requires PHPStan 2.0 or higher and PHP 7.4 or higher, tested up to PHP 8.3. Only add it when the project actually contains WordPress code or integrations.
- Does phpstan-wordpress make sense for a pure Laravel project with no WordPress?
- No. The package assumes a WordPress environment and loads WordPress stubs, globals, constants, and hook-related types, so pure Laravel code can produce false positives. It is intended for hybrid apps, headless WordPress backends, Laravel modules that interact with WordPress, or legacy WordPress codebases being modernized. For a pure Laravel app, use Larastan and standard PHPStan rules instead.
- Which PHPStan and PHP versions are supported by phpstan-wordpress?
- The README lists PHPStan 2.0 or higher and PHP 7.4 or higher, with testing up to PHP 8.3. Because it is a PHPStan extension, your project's PHPStan version must satisfy that requirement before Composer will install it. Laravel version compatibility is separate and depends on your PHP runtime and the PHPStan or Larastan setup you use.
- How should I configure phpstan-wordpress for a hybrid Laravel and WordPress codebase?
- Load the extension through phpstan/extension-installer or include extension.neon manually, then scope PHPStan's analysed paths to the WordPress-related modules. Bootstrap WordPress where needed, or rely on stubs for classes and functions that are not available during analysis. Exclude pure Laravel directories from WordPress-specific rules if they create noise, and use feature flags or separate phpstan.neon configs for WordPress-integrated modules.
- Will phpstan-wordpress cause false positives because Laravel does not bootstrap WordPress globals?
- Yes, that is a real risk when WordPress is not bootstrapped or stubbed, especially around globals such as $wpdb and $post and dynamically registered hooks. Mitigate it by isolating WordPress integration code, whitelisting known patterns in phpstan.neon, providing stubs, and adding annotations or custom rules for dynamic behaviour. Keep WordPress-specific analysis scoped to the files that actually depend on WordPress.
- Can phpstan-wordpress analyze WordPress hooks such as add_action and apply_filters?
- It provides WordPress stubs, dynamic return type extensions, and validation of optional docblocks before apply_filters and do_action calls, treating the first @param type as definitive. That helps catch type mistakes around hook callbacks and filtered values. Dynamically registered hooks still often need manual @method or @var annotations or custom PHPStan rules, because static analysis cannot always infer runtime registration.
- Can I use phpstan-wordpress together with Larastan?
- Generally yes, because both are PHPStan extensions and can be loaded in the same phpstan.neon setup. Keep WordPress-specific paths scoped so Larastan's Laravel rules and this package's WordPress rules do not fight over unrelated code. If you see conflicts, use separate PHPStan configurations for Laravel-only and WordPress-integrated modules.
- How do I run phpstan-wordpress in CI for a Laravel app?
- Install it as a dev dependency, commit your phpstan.neon configuration, and run vendor/bin/phpstan analyse in your CI pipeline. Scope the analysed paths to WordPress-integrated code and decide whether WordPress findings should block pull requests or remain advisory. Surface results through GitHub PR checks or your existing quality gate, and cache Composer and PHPStan results to reduce runtime.
- What are alternatives to szepeviktor/phpstan-wordpress?
- You can use php-stubs/wordpress-stubs directly with PHPStan, add custom PHPStan rules and stubs, or use another static analyser with WordPress stubs such as Psalm. This package is convenient because it bundles WordPress stubs, constants, dynamic return types, and hook docblock validation in one extension. For pure Laravel projects, Larastan plus standard PHPStan is usually the better fit.
- Is szepeviktor/phpstan-wordpress actively maintained and safe for production teams?
- The README includes a maintainer note about planning to stop contributing to the WordPress ecosystem and asks users to support the work, so maintenance risk should be evaluated. The package is still published and usable, but teams should pin versions, review release activity, and be prepared to fork or contribute fixes. For critical production use, treat it as a dependency with a clear ownership and upgrade plan.