cport1 · Oct 4, 2026 · Oct 3, 2026
diff --git a/admin/partials/detections-page.php b/admin/partials/detections-page.php
@@ -17,7 +17,7 @@
 
 global $wpdb;
 
-$table = $wpdb->prefix . 'webdecoy_detections';
+$table = esc_sql($wpdb->prefix . 'webdecoy_detections');
 // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only admin list filtering via GET, no state change
 $page = isset($_GET['paged']) ? max(1, intval($_GET['paged'])) : 1;
 $per_page = 50;

diff --git a/admin/partials/statistics-page.php b/admin/partials/statistics-page.php
@@ -16,9 +16,9 @@
 
 global $wpdb;
 
-$detections_table = $wpdb->prefix . 'webdecoy_detections';
-$blocked_table = $wpdb->prefix . 'webdecoy_blocked_ips';
-$checkout_table = $wpdb->prefix . 'webdecoy_checkout_attempts';
+$detections_table = esc_sql($wpdb->prefix . 'webdecoy_detections');
+$blocked_table = esc_sql($wpdb->prefix . 'webdecoy_blocked_ips');
+$checkout_table = esc_sql($wpdb->prefix . 'webdecoy_checkout_attempts');
 
 // 30-day detection trend
 $thirty_days_ago = gmdate('Y-m-d H:i:s', strtotime('-30 days'));

diff --git a/includes/class-webdecoy-actor-feed.php b/includes/class-webdecoy-actor-feed.php
@@ -312,7 +312,7 @@ public function intel_for(string $ip): ?array
     public static function purge_feed_blocks(): int
     {
         global $wpdb;
-        $table = $wpdb->prefix . 'webdecoy_blocked_ips';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_blocked_ips');
         $rows = $wpdb->get_col($wpdb->prepare(
             "SELECT ip_address FROM {$table} WHERE created_by = %s",
             self::CREATED_BY

diff --git a/includes/class-webdecoy-actor-intel.php b/includes/class-webdecoy-actor-intel.php
@@ -49,6 +49,11 @@ class WebDecoy_Actor_Intel
     /** @var string Plaintext API key. */
     private $apiKey;
 
+    /**
+     * Constructor
+     *
+     * @param string $apiKey WebDecoy Cloud API key
+     */
     public function __construct(string $apiKey)
     {
         $this->apiKey = $apiKey;

diff --git a/includes/class-webdecoy-ai-referrals.php b/includes/class-webdecoy-ai-referrals.php
@@ -31,10 +31,13 @@ class WebDecoy_AI_Referrals
     /** Distinct platform and path pairs kept before new ones are dropped. */
     private const MAX_ROWS = 5000;
 
+    /**
+     * The ai_referrals table name, prefixed and escaped for interpolation.
+     */
     public static function table(): string
     {
         global $wpdb;
-        return $wpdb->prefix . 'webdecoy_ai_referrals';
+        return esc_sql($wpdb->prefix . 'webdecoy_ai_referrals');
     }
 
     /**
@@ -103,6 +106,13 @@ public static function landingPath(string $uri): string
         return mb_check_encoding($path, 'UTF-8') ? $path : '/';
     }
 
+    /**
+     * Record one referral for a platform/landing-path pair, bounded to
+     * {@see self::MAX_ROWS} distinct pairs.
+     *
+     * @param string $platform Referring AI platform
+     * @param string $path Landing path the referral counted against
+     */
     private static function increment(string $platform, string $path): void
     {
         global $wpdb;

diff --git a/includes/class-webdecoy-blocker.php b/includes/class-webdecoy-blocker.php
@@ -78,7 +78,7 @@ public function block(string $ip, string $reason = '', ?int $duration_hours = nu
             }
         }
 
-        $table = $wpdb->prefix . 'webdecoy_blocked_ips';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_blocked_ips');
 
         $expires_at = null;
         if ($duration_hours !== null && $duration_hours > 0) {
@@ -261,7 +261,7 @@ public function unblock(string $ip): bool
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_blocked_ips';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_blocked_ips');
 
         $result = $wpdb->delete($table, ['ip_address' => $ip]);
 
@@ -292,7 +292,7 @@ public function is_blocked(string $ip): bool
 
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_blocked_ips';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_blocked_ips');
 
         // First check for exact IP match (fastest)
         $exact_blocked = $wpdb->get_var($wpdb->prepare(
@@ -344,7 +344,7 @@ public function get_blocked_ips(array $args = []): array
         ];
 
         $args = wp_parse_args($args, $defaults);
-        $table = $wpdb->prefix . 'webdecoy_blocked_ips';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_blocked_ips');
 
         $where = '1=1';
         if (!$args['include_expired']) {
@@ -375,7 +375,7 @@ public function get_blocked_count(bool $include_expired = false): int
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_blocked_ips';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_blocked_ips');
 
         $where = '1=1';
         if (!$include_expired) {
@@ -395,7 +395,7 @@ public function get_block_info(string $ip): ?array
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_blocked_ips';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_blocked_ips');
 
         $result = $wpdb->get_row($wpdb->prepare(
             "SELECT * FROM {$table} WHERE ip_address = %s AND (expires_at IS NULL OR expires_at > %s)",
@@ -417,7 +417,7 @@ public function extend_block(string $ip, int $hours): bool
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_blocked_ips';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_blocked_ips');
 
         $info = $this->get_block_info($ip);
         if (!$info) {
@@ -449,7 +449,7 @@ public function clear_all(): int
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_blocked_ips';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_blocked_ips');
 
         $count = $wpdb->query("DELETE FROM {$table}");
 
@@ -470,7 +470,7 @@ public function cleanup_expired(): int
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_blocked_ips';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_blocked_ips');
 
         return $wpdb->query($wpdb->prepare(
             "DELETE FROM {$table} WHERE expires_at IS NOT NULL AND expires_at < %s",
@@ -740,7 +740,7 @@ public function get_stats(): array
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_blocked_ips';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_blocked_ips');
 
         $total = $wpdb->get_var("SELECT COUNT(*) FROM {$table}");
         $active = $wpdb->get_var($wpdb->prepare(

diff --git a/includes/class-webdecoy-cli.php b/includes/class-webdecoy-cli.php
@@ -76,8 +76,8 @@ public function status($args, $assoc_args): void
             $mode .= ' [forced by WEBDECOY_DEFAULT_MODE]';
         }
 
-        $detections = $wpdb->prefix . 'webdecoy_detections';
-        $blocked = $wpdb->prefix . 'webdecoy_blocked_ips';
+        $detections = esc_sql($wpdb->prefix . 'webdecoy_detections');
+        $blocked = esc_sql($wpdb->prefix . 'webdecoy_blocked_ips');
         $now = gmdate('Y-m-d H:i:s');
 
         $total = (int) $wpdb->get_var("SELECT COUNT(*) FROM {$detections}"); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- table name from $wpdb->prefix
@@ -284,7 +284,7 @@ public function logs($args, $assoc_args): void
 
         \WP_CLI::confirm('Delete ALL recorded detections on this site?', $assoc_args);
 
-        $detections = $wpdb->prefix . 'webdecoy_detections';
+        $detections = esc_sql($wpdb->prefix . 'webdecoy_detections');
         $deleted = $wpdb->query("DELETE FROM {$detections}"); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- table name from $wpdb->prefix
         \WP_CLI::success(sprintf('Deleted %d detection%s.', (int) $deleted, (int) $deleted === 1 ? '' : 's'));
     }

diff --git a/includes/class-webdecoy-cloud-connect.php b/includes/class-webdecoy-cloud-connect.php
@@ -555,6 +555,14 @@ public static function connected_notice_message(string $org): string
         return sprintf(__('Connected to WebDecoy Cloud (%s).', 'webdecoy'), $org) . ' ' . $tail;
     }
 
+    /**
+     * Stash an admin notice for display on the next page load.
+     *
+     * @param string $type Notice type (e.g. 'success', 'error')
+     * @param string $message Notice text
+     * @param string $url Optional action link URL
+     * @param string $label Optional action link label
+     */
     private function set_notice(string $type, string $message, string $url = '', string $label = ''): void
     {
         set_transient(

diff --git a/includes/class-webdecoy-cloud-policy.php b/includes/class-webdecoy-cloud-policy.php
@@ -174,6 +174,9 @@ public static function clear(): void
         delete_option(self::OPTION);
     }
 
+    /**
+     * The connected organization id from the stored plugin options, if any.
+     */
     private static function organization_id(): string
     {
         $options = get_option('webdecoy_options', []);

diff --git a/includes/class-webdecoy-decoy-response.php b/includes/class-webdecoy-decoy-response.php
@@ -48,6 +48,12 @@ private static function secret(): string
         return $secret;
     }
 
+    /**
+     * Derive a stable per-label canary value from the site secret.
+     *
+     * @param string $label Canary label
+     * @param int $len Length of the returned hex string
+     */
     private static function derive(string $label, int $len = 16): string
     {
         return substr(hash_hmac('sha256', $label, self::secret()), 0, $len);
@@ -204,6 +210,9 @@ public function served_canaries(string $path): array
         return $this->decoy_for($path) === null ? [] : self::canaries();
     }
 
+    /**
+     * Send a plain 404 response and stop execution.
+     */
     private function serve_404(): void
     {
         nocache_headers();
@@ -213,6 +222,13 @@ private function serve_404(): void
         exit;
     }
 
+    /**
+     * Send a 200 response with the given body and content type, and stop
+     * execution.
+     *
+     * @param string $body Response body
+     * @param string $type Content-Type value
+     */
     private function serve_body(string $body, string $type): void
     {
         nocache_headers();

diff --git a/includes/class-webdecoy-detector.php b/includes/class-webdecoy-detector.php
@@ -236,9 +236,9 @@
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_detections';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_detections');
 
         $wpdb->insert($table, [
             'ip_address' => $ip,
            'user_agent' => $this->get_signal_collector()->getUserAgent(),
            'score' => $result->getScore(),
@@ -271,9 +271,9 @@
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_detections';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_detections');
 
         return $wpdb->get_results($wpdb->prepare(
             "SELECT * FROM {$table} ORDER BY created_at DESC LIMIT %d",
            $limit
        ), ARRAY_A) ?: [];
@@ -289,25 +289,25 @@
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_detections';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_detections');
         $since = gmdate('Y-m-d H:i:s', strtotime("-{$days} days"));
 
         $total = $wpdb->get_var($wpdb->prepare(
            "SELECT COUNT(*) FROM {$table} WHERE created_at > %s",
            $since
        ));

        $by_level = $wpdb->get_results($wpdb->prepare(
            "SELECT threat_level, COUNT(*) as count FROM {$table} WHERE created_at > %s GROUP BY threat_level",
            $since
        ), OBJECT_K);

        $by_day = $wpdb->get_results($wpdb->prepare(
            "SELECT DATE(created_at) as date, COUNT(*) as count FROM {$table} WHERE created_at > %s GROUP BY DATE(created_at) ORDER BY date",
            $since
        ), ARRAY_A);

        $high_risk = $wpdb->get_var($wpdb->prepare(
            "SELECT COUNT(*) FROM {$table} WHERE created_at > %s AND threat_level IN ('HIGH', 'CRITICAL')",
            $since
        ));
@@ -331,7 +331,7 @@
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_detections';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_detections');
         $since = gmdate('Y-m-d H:i:s', strtotime("-{$days} days"));
 
         return (int) $wpdb->get_var($wpdb->prepare(

diff --git a/includes/class-webdecoy-honeytoken.php b/includes/class-webdecoy-honeytoken.php
@@ -39,6 +39,11 @@ class WebDecoy_Honeytoken
     /** @var bool */
     private $rotate;
 
+    /**
+     * Constructor
+     *
+     * @param bool $rotate Whether to rotate the per-site secret on next use
+     */
     public function __construct(bool $rotate = false)
     {
         $this->rotate = $rotate;

diff --git a/includes/class-webdecoy-ip-enrichment.php b/includes/class-webdecoy-ip-enrichment.php
@@ -35,6 +35,11 @@ class WebDecoy_IP_Enrichment
     /** @var int Request timeout in seconds (filterable). */
     private $timeout;
 
+    /**
+     * Constructor
+     *
+     * @param string $apiKey WebDecoy Cloud API key
+     */
     public function __construct(string $apiKey)
     {
         $this->apiKey = $apiKey;

diff --git a/includes/class-webdecoy-rate-limiter.php b/includes/class-webdecoy-rate-limiter.php
@@ -84,7 +84,7 @@ public function check_and_increment(string $key): array
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_rate_limits';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_rate_limits');
         $now = current_time('mysql', true);
         $window_start_threshold = gmdate('Y-m-d H:i:s', strtotime("-{$this->window} seconds"));
 
@@ -126,7 +126,7 @@ public function increment(string $ip): int
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_rate_limits';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_rate_limits');
         $now = current_time('mysql', true);
         $window_start = gmdate('Y-m-d H:i:s', strtotime("-{$this->window} seconds"));
 
@@ -168,7 +168,7 @@ public function get_count(string $ip): int
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_rate_limits';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_rate_limits');
         $window_start = gmdate('Y-m-d H:i:s', strtotime("-{$this->window} seconds"));
 
         $count = $wpdb->get_var($wpdb->prepare(
@@ -202,7 +202,7 @@ public function get_reset_time(string $ip): int
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_rate_limits';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_rate_limits');
         $window_start_threshold = gmdate('Y-m-d H:i:s', strtotime("-{$this->window} seconds"));
 
         $window_start = $wpdb->get_var($wpdb->prepare(
@@ -231,7 +231,7 @@ public function reset(string $ip): bool
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_rate_limits';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_rate_limits');
 
         return $wpdb->delete($table, ['ip_address' => $ip]) !== false;
     }
@@ -245,7 +245,7 @@ public function cleanup(): int
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_rate_limits';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_rate_limits');
         $threshold = gmdate('Y-m-d H:i:s', strtotime('-1 hour'));
 
         return $wpdb->query($wpdb->prepare(
@@ -338,7 +338,7 @@ public function get_stats(): array
     {
         global $wpdb;
 
-        $table = $wpdb->prefix . 'webdecoy_rate_limits';
+        $table = esc_sql($wpdb->prefix . 'webdecoy_rate_limits');
         $window_start = gmdate('Y-m-d H:i:s', strtotime("-{$this->window} seconds"));
 
         $active_ips = $wpdb->get_var($wpdb->prepare(

diff --git a/includes/class-webdecoy-updater.php b/includes/class-webdecoy-updater.php
@@ -21,6 +21,9 @@
  */
 class WebDecoy_Updater
 {
+    /**
+     * Constructor
+     */
     public function __construct()
     {
         add_filter('pre_set_site_transient_update_plugins', [$this, 'check_for_updates']);