Fix: Use wp_safe_redirect() instead of wp_redirect()

[masteradhoc]

Resolves two WordPress.Security.SafeRedirect.wp_redirect_wp_redirect warnings flagged by PHPCS.

• src/Admin/Actions.php:83 — wizard redirect now uses wp_safe_redirect()
• src/Ajax.php:162 — Ajax redirect now uses wp_safe_redirect()

Both calls are already followed by exit;, so no other changes were required. No functional changes expected since both URLs resolve to local admin URLs.

Summary by CodeRabbit

• Bug Fixes
  • Improved redirect handling to use safer redirects in wizard and AJAX flows.
  • Maintained the existing redirect behavior while reducing the chance of unsafe destination handling.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: fa8758d7-3acc-4294-8ae2-0df9b0a4e997

📥 Commits

Reviewing files that changed from the base of the PR and between 072e4cc and 71c1763.

📒 Files selected for processing (2)

• src/Admin/Actions.php
• src/Ajax.php

---

📝 Walkthrough

Walkthrough

Two redirect calls were changed from wp_redirect() to wp_safe_redirect(): one in the admin wizard-setup redirect flow and one in the AJAX redirect handler. Surrounding control flow, including the exit; calls, remains unchanged.

Changes

Safe Redirect Adoption

Layer / File(s)	Summary
Switch to safe redirects src/Admin/Actions.php, src/Ajax.php	Both maybe_redirect_to_wizard() and maybe_handle_redirect() now call wp_safe_redirect() instead of wp_redirect() for their respective URLs, keeping the existing exit behavior intact.

Poem

A hop, a skip, a redirect anew,
Safe_redirect now sees us through.
No stray URLs to wander far,
Just trusted paths, wherever you are.
🐇 Thump, thump — secure hooray!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: replacing wp_redirect() with wp_safe_redirect().
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}