“Vibe coding” had a strange year. The term went from Andrej Karpathy’s playful description of letting AI write your code while you vibe, to a global hobby, to something even Karpathy has publicly moved on from — right as security researchers started publishing ugly numbers about AI-generated code. Reports like this Forbes piece now warn that a scary share of AI-written code ships with security flaws. So, as someone who recently vibe-coded a real plugin: is vibe coding safe for WordPress?
My answer, having actually done it: yes for building, no for trusting. Let me explain the difference.
What Happened When I Vibe-Coded a Plugin
I built my social-publishing plugin with Claude Code in an afternoon. The AI nailed the WordPress conventions — nonces, sanitization, options API — and then confidently shipped me a bug: a hardcoded, already-expired LinkedIn API version that broke every single post. The code looked professional. It was wrong. That’s the vibe coding experience in miniature: astonishing speed, punctuated by failures you can only catch if you can read what it wrote.
Where Vibe Coding Goes Wrong on WordPress Specifically
- Security is invisible until it isn’t. A missing capability check or unescaped output looks identical to safe code at vibe-speed. On WordPress — powering 40%+ of the web — those mistakes have a mass audience of attackers waiting.
- WordPress has landmines models step on. Direct database queries without
$wpdb->prepare(), hooks firing more often than expected, functions deprecated three versions ago. I’ve caught all three in generated code. - The maintenance debt is yours. APIs drift. My LinkedIn version bug will happen again someday, and no vibe will fix it — a person who understands the code will.
My Rules for Vibe Coding WordPress Safely
- Vibe the scaffold, review the surface. Let AI write structure and boilerplate freely. Anything touching input, output, auth, or the database gets read line-by-line by me.
- Never ship what you can’t debug. If you couldn’t fix it broken, don’t deploy it working.
- Test against the real world, not the happy path. My plugin “worked” until the actual LinkedIn API disagreed. External services are where generated code dies.
- Keep it in the sandbox until proven. New generated code runs on staging or a throwaway site first. Always.
The Honest Verdict
The name is retiring, but the practice is permanent — and genuinely valuable. AI-assisted coding turned a weekend plugin idea into an afternoon build for me, and I’ll keep doing it. The catch is that “vibes” describes the writing, not the shipping. Between generated code and production sits a boring, irreplaceable step: a human who understands WordPress reading what the machine wrote. Skip that step on your own hobby site if you like. Skip it on a client site, and you’re not vibe coding — you’re gambling with someone else’s business.
