Start with a mask
Use a mask when the value has a predictable input shape. A phone number is a familiar example. Masks guide typing while server-side rules check the submitted value. Configure masks on supported text inputs and test optional values as well as complete ones.
Check the value with regex
Use a regular expression for a format that can be described as a pattern. This PHP pattern accepts three uppercase letters, a dash and four digits:
/^[A-Z]{3}-[0-9]{4}$/VLD-2026 passes. vld-2026 and VLD-26 do not. Set the field’s error message to explain the expected format, rather than simply saying the input is invalid.
Choose a uniqueness scope
Original validated fields can check uniqueness site-wide, within a post type, with a matching field key, or within a single post, depending on the configured scope. Choose the scope for the identifier, rather than making every field globally unique.
Set the scope in your field settings. Managed application records use transactional unique claims and version checks through the Records service.
Use PHP for custom server-side rules
Administrators can define PHP validation rules in the field editor. Check the submitted value and return a clear failure message when it does not meet the rule.
Validation runs in WordPress, independently of license and update requests.
Test real editing paths
Check valid and invalid input, empty optional fields, numeric zero, duplicate values and any nested field paths your content uses. Read-only fields and conditionally hidden inputs need checks too.
Managed records have a shared write service
Managed record operations apply permissions, validation, relationships and version checks through the Records service. Pro tools use those same checks.