Security

What the plugin checks for you on the way in, and what you're still responsible for on the way out.

Saving is capability- and nonce-gated

Every save path checks a nonce and a capability before writing anything:

Option panel saves verify a nonce and current_user_can( $panel['capability'] ) — the capability you set in set_args() (default manage_options).
User-profile field saves verify their own nonce (_nonce_tp_user_meta) before calling update_user_meta().
Export/Import and the builders all require manage_options.

If you build a custom admin screen that writes Pure Metafields data directly (bypassing the plugin's own save handlers), you're responsible for adding equivalent checks yourself.

Escape on output — the plugin doesn't do this for you

Read helpers return the raw stored value. You still need to choose the right escaping function when you print it:

Value	Escape with
Plain text	`esc_html()`
URLs, image src	`esc_url()`
HTML attributes	`esc_attr()`
`editor` field (stores HTML)	`wp_kses_post()`

SVG and rich text are sanitized, not blocked

Textarea and editor-type values pass through wp_kses() with an allow-list of SVG-safe tags on save, rather than being stripped of markup entirely. If your theme needs an SVG tag or attribute that isn't in the default allow-list, extend it with the tpmeta_allowed_svg_tags filter — see Extensibility — rather than disabling sanitization.

Custom sanitize_callback

Option fields accept a sanitize_callback key to fully replace the default sanitizer for that field — see Validation. Use it to enforce a stricter format (e.g. a URL that must be on your own domain) rather than trusting client-side validation alone.