Native WP

Author: PDowney

.vscode/settings.json

@@ -5,6 +5,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+### Changed
+
+- **Code Quality**: Replaced PHP-native IP validation with WordPress native IP validation for resource hint host checks
+
 ## [2.1.0] - 2026-06-10
 
 ### Fixed

CHANGELOG.md

@@ -26,7 +26,9 @@
     "php-stubs/wordpress-stubs": "^6.9",
     "szepeviktor/phpstan-wordpress": "^2.0",
     "phpstan/phpstan": "^2.1",
-    "phpcompatibility/phpcompatibility-wp": "^2.1"
+    "phpcompatibility/phpcompatibility-wp": "^2.1",
+    "automattic/vipwpcs": "^3.0.1",
+    "z4kn4fein/php-semver": "^3.0"
   },
   "scripts": {
     "phpcs": "phpcs --standard=phpcs.xml",

composer.json

@@ -458,7 +458,7 @@ function es_optimizer_is_disallowed_resource_hint_host( string $host ): bool {
  * @return bool True when the host is an IP literal.
  */
 function es_optimizer_is_ip_literal_host( string $host ): bool {
-	return false !== filter_var( $host, FILTER_VALIDATE_IP );
+	return false !== rest_is_ip_address( $host );
 }
 
 /**

composer.lock

@@ -43,6 +43,9 @@ No, the plugin has a simple interface where you can toggle features on and off.
 
 == Changelog ==
 
+= Unreleased =
+* **CODE QUALITY**: Replaced PHP-native IP validation with WordPress native IP validation for resource hint host checks
+
 = 2.1.0 - 2026-06-10 =
 * **BUG FIX**: Removed a redundant `is_array()` check in `es_optimizer_disable_emojis_tinymce()` after adding a strict `array` parameter type, resolving a PHPStan always-true warning on PHP 8.3
 * **BUG FIX (Critical)**: Fixed License URI pointing to GPL 2.0 instead of GPL 3.0 in plugin header and readme.txt

includes/options.php

@@ -269,6 +269,18 @@ function wp_parse_url( string $url, ?int $component = null ): mixed {
 	}
 }
 
+if ( ! function_exists( 'rest_is_ip_address' ) ) {
+	/**
+	 * Check whether a value is an IP address.
+	 *
+	 * @param string $ip IP address.
+	 * @return string|false IP address when valid; false otherwise.
+	 */
+	function rest_is_ip_address( string $ip ): string|false {
+		return false !== filter_var( $ip, FILTER_VALIDATE_IP ) ? $ip : false;
+	}
+}
+
 if ( ! function_exists( '__' ) ) {
 	/**
 	 * Return translated text.