[huubl]

Adds wp_get_style_link_tag() and wp_print_style_link_tag(), which build a <link rel="stylesheet"> tag with WP_HTML_Tag_Processor, and the wp_style_attributes filter, so that attributes such as a CSP nonce, integrity or crossorigin can be added to stylesheet LINK tags without editing HTML strings. This complements wp_get_script_tag() and the wp_script_attributes filter, as wp_get_inline_style_tag() from #13250 complements wp_get_inline_script_tag(). The names follow the suggestion on Core-51325, where stylesheet LINK tags were noted as out of scope for that ticket.

WP_Styles::do_item(), including right-to-left and alternate stylesheets, wp_admin_css() and locale_stylesheet() print their LINK tags with the API.

Stylesheet concatenation was removed from Core in r64585. This PR has been updated to the current trunk, preserving that removal and dropping the _print_styles() integration and its two obsolete concatenation-specific tests.

Backward compatibility

• The style_loader_tag and wp_admin_css filters are kept, and the markup they are passed is unchanged: the values Core supplies are still escaped with esc_attr() or esc_url(), single-quoted and in the same order, since callbacks have long edited it as a string, for example to replace rel='stylesheet'. Only attributes that wp_style_attributes adds or changes are escaped by the Tag Processor, and added attributes are printed after Core's. Tests pin this with exact strings, including values that esc_attr() and the Tag Processor escape differently, such as an apostrophe or a character reference in a title or handle, so the test for #30036 is kept as it was.
• A title or media that is not a string, such as true, or an array passed by mistake as the $media argument, is printed as before, rather than as a boolean attribute or a fatal error.
• style_loader_tag is still passed the escaped URL from before wp_style_attributes, and each URL is still escaped, and passed to the clean_url filter, once. A right-to-left URL that escaping empties is still printed as href=''.
• A quote returned by a filtered escaping function, such as a clean_url callback, is encoded in these tags, so it cannot end an attribute value early.
• A supplied id cannot be changed or removed by wp_style_attributes, as for wp_inline_style_attributes in Script Loader: Add an API for filtering inline style attributes #13250, since code locates LINK tags by it, such as user-profile.js with #colors-css. A _doing_it_wrong() notice that names the function which printed the tag is issued if a filter tries.
• WP_Styles::do_item() no longer calls WP_Styles::_css_href(), so overriding that method in a subclass no longer changes the printed URL. Its docblock says so.
• The URL printed by locale_stylesheet() is now escaped.

Attribute escaping

Attribute values passed to wp_style_attributes are not yet escaped, as for wp_script_attributes; the filter documentation says that the printed URL may differ (see Core-66308). As in wp_get_script_tag(), the Tag Processor prints the href of wp_get_style_link_tag() as esc_url() returns it, so a clean_url callback that returns a double quote can end that attribute early, as it can for a script's src. Hardening that belongs in WP_HTML_Tag_Processor::set_attribute(), for every URL attribute, in a follow-up.

For scripts, r56687 and r61485 changed the quoting and order of the markup passed to script_loader_tag; styles keep the historical markup, so callbacks that edit it as a string keep working.

Related PRs

Two follow-up PRs depend on this one:

• Script Loader: Use the style link tag API for the remaining Core stylesheet LINK tags #14499 for the remaining Core call sites (wp_ajax_parse_embed(), wp_ajax_parse_media_shortcode() and the theme compatibility header).
• Bundled Themes: Print the stylesheet LINK tag with wp_print_style_link_tag() when available #14500 for Twenty Ten and Twenty Eleven.

This replaces #14310.

Trac ticket: https://core.trac.wordpress.org/ticket/66342

Use of AI Tools

AI assistance: Yes
Tool(s): GitHub Copilot, Claude Code, ChatGPT
Model(s): GPT-6 Luna, GPT-6, Claude Opus 5.5, Claude Fable 5.1
Used for: The initial implementation and tests were written with GitHub Copilot. Claude Code was used under my direction for review, the backward compatibility fixes, splitting the change, and tests, and I reviewed the result. ChatGPT was used to resolve the merge conflict with the current trunk and adapt the implementation and tests to the removal of stylesheet concatenation.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props huubl.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.