diff --git a/.phpcs.xml.dist b/.phpcs.xml.dist
index 4e354fa..0a997b6 100644
--- a/.phpcs.xml.dist
+++ b/.phpcs.xml.dist
@@ -5,6 +5,7 @@
     <!-- What to scan -->
     <file>.</file>
     <exclude-pattern>/.dev-notes/</exclude-pattern>
+    <exclude-pattern>/blocks/</exclude-pattern>
     <exclude-pattern>/tests/</exclude-pattern>
     <exclude-pattern>/vendor/</exclude-pattern>
     <exclude-pattern>/node_modules/</exclude-pattern>
@@ -34,7 +35,8 @@
         <!-- exclude name="WordPress.VIP"/ --><!-- removed as error Referenced sniff "WordPress.VIP" does not exist and can't find the fix or additional installation anywhere. -->
         <exclude name="Generic.Classes.OpeningBraceSameLine.BraceOnNewLine"></exclude>
         <exclude name="Generic.CodeAnalysis.EmptyStatement.DetectedIf"></exclude>
-        <exclude name="Generic.Files.EndFileNewline.NotFound"></exclude>
+        <exclude name="Generic.CodeAnalysis.UnusedFunctionParameter.Found"></exclude>
+        <exclude name="Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed"></exclude>
         <exclude name="Generic.Formatting.MultipleStatementAlignment.NotSameWarning"></exclude>
         <exclude name="Generic.Functions.OpeningFunctionBraceKernighanRitchie.BraceOnNewLine"></exclude>
         <exclude name="Generic.WhiteSpace.ArbitraryParenthesesSpacing.SpaceAfterOpen"></exclude>
@@ -42,33 +44,43 @@
         <exclude name="Generic.WhiteSpace.DisallowSpaceIndent.SpacesUsed"></exclude>
         <exclude name="Generic.WhiteSpace.ScopeIndent.Incorrect"></exclude>
         <exclude name="Generic.WhiteSpace.ScopeIndent.IncorrectExact"></exclude>
+        <exclude name="NormalizedArrays.Arrays.ArrayBraceSpacing.SpaceAfterArrayOpenerSingleLine"></exclude>
+        <exclude name="NormalizedArrays.Arrays.ArrayBraceSpacing.SpaceBeforeArrayCloserSingleLine"></exclude>
+        <exclude name="NormalizedArrays.Arrays.ArrayBraceSpacing.NoSpaceAfterArrayOpener"></exclude>
+        <exclude name="NormalizedArrays.Arrays.ArrayBraceSpacing.NoSpaceBeforeArrayCloser"></exclude>
+        <exclude name="NormalizedArrays.Arrays.CommaAfterLast.NoComma"></exclude>
+        <exclude name="NormalizedArrays.Arrays.CommaAfterLast.NoSpaceAfterComma"></exclude>
         <exclude name="PEAR"></exclude>
         <exclude name="PHPCompatibility.FunctionUse.ArgumentFunctionsReportCurrentValue.Changed"></exclude>
         <exclude name="PHPCompatibility.Variables.ForbiddenGlobalVariableVariable.NonBareVariableFound"></exclude>
+        <exclude name="PSR2.Classes.ClassDeclaration.CloseBraceAfterBody"></exclude>
+        <exclude name="PSR2.Files.EndFileNewline.NotFound"></exclude>
+        <exclude name="PSR2.Files.EndFileNewline.NoneFound"></exclude>
+        <exclude name="PSR2.Files.EndFileNewline.TooMany"></exclude>
         <exclude name="PSR2.Namespaces.NamespaceDeclaration.BlankLineAfter"></exclude>
         <exclude name="Squiz.Commenting.ClassComment.Missing"></exclude>
         <exclude name="Squiz.Commenting.ClosingDeclarationComment.Incorrect"></exclude>
         <exclude name="Squiz.Commenting.FileComment.Missing"></exclude>
         <exclude name="Squiz.Commenting.FileComment.SpacingAfterComment"></exclude>
-        <exclude name="Squiz.Commenting.FunctionComment.ParamCommentFullStop"></exclude>
         <exclude name="Squiz.Commenting.FunctionComment.MissingParamComment"></exclude>
+        <exclude name="Squiz.Commenting.FunctionComment.ParamCommentFullStop"></exclude>
         <exclude name="Squiz.Commenting.FunctionComment.SpacingAfterParamType"></exclude>
         <exclude name="Squiz.Commenting.InlineComment.InvalidEndChar"></exclude>
+        <exclude name="Squiz.Commenting.VariableComment.Missing"></exclude>
         <exclude name="Squiz.ControlStructures.ControlSignature.NewlineAfterOpenBrace"></exclude>
         <exclude name="Squiz.Functions.FunctionDeclarationArgumentSpacing.SpacingAfterOpen"></exclude>
+        <exclude name="Squiz.Functions.FunctionDeclarationArgumentSpacing.SpacingBeforeClose"></exclude>
+        <exclude name="Squiz.Functions.MultiLineFunctionDeclaration.SpaceAfterFunction"></exclude>
         <exclude name="Squiz.PHP.CommentedOutCode.Found"></exclude>
         <exclude name="Squiz.PHP.EmbeddedPhp.ContentAfterEnd"></exclude>
+        <exclude name="Squiz.PHP.EmbeddedPhp.ContentBeforeOpen"></exclude>
         <exclude name="Squiz.PHP.NonExecutableCode.ReturnNotRequired"></exclude>
         <exclude name="Squiz.Strings.ConcatenationSpacing.PaddingFound"></exclude>
         <exclude name="Squiz.WhiteSpace.SemicolonSpacing.Incorrect"></exclude>
         <exclude name="Squiz.WhiteSpace.SuperfluousWhitespace.EndLine"></exclude>
         <exclude name="Universal.Arrays.DisallowShortArraySyntax.Found"></exclude>
         <exclude name="Universal.ControlStructures.DisallowLonelyIf.Found"></exclude>
-        <exclude name="WordPress.Arrays.ArrayDeclarationSpacing.NoSpaceAfterArrayOpener"></exclude>
-        <exclude name="WordPress.Arrays.ArrayDeclarationSpacing.NoSpaceBeforeArrayCloser"></exclude>
         <exclude name="WordPress.Arrays.ArrayKeySpacingRestrictions.NoSpacesAroundArrayKeys"></exclude>
-        <exclude name="WordPress.Arrays.CommaAfterArrayItem.NoComma"></exclude>
-        <exclude name="WordPress.Arrays.CommaAfterArrayItem.NoSpaceAfterComma"></exclude>
         <exclude name="WordPress.Arrays.MultipleStatementAlignment.DoubleArrowNotAligned"></exclude>
         <exclude name="WordPress.Files.FileName.InvalidClassFileName"></exclude>
         <exclude name="WordPress.Files.FileName.NotHyphenatedLowercase"></exclude>
@@ -76,6 +88,7 @@
         <exclude name="WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound"></exclude>
         <exclude name="WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedNamespaceFound"></exclude>
         <exclude name="WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound"></exclude>
+        <exclude name="WordPress.NamingConventions.ValidFunctionName.FunctionNameInvalid"></exclude>
         <exclude name="WordPress.NamingConventions.ValidFunctionName.MethodNameInvalid"></exclude>
         <exclude name="WordPress.NamingConventions.ValidVariableName.PropertyNotSnakeCase"></exclude>
         <exclude name="WordPress.NamingConventions.ValidVariableName.UsedPropertyNotSnakeCase"></exclude>
@@ -93,13 +106,11 @@
         <exclude name="WordPress.WhiteSpace.ControlStructureSpacing"></exclude>
         <exclude name="WordPress.WhiteSpace.OperatorSpacing.NoSpaceBefore"></exclude>
         <exclude name="WordPress.WhiteSpace.OperatorSpacing.NoSpaceAfter"></exclude>
+        <exclude name="WordPress.WP.AlternativeFunctions.curl_curl_close"></exclude>
+        <exclude name="WordPress.WP.AlternativeFunctions.curl_curl_exec"></exclude>
         <exclude name="WordPress.WP.AlternativeFunctions.curl_curl_init"></exclude>
         <exclude name="WordPress.WP.AlternativeFunctions.curl_curl_setopt"></exclude>
-        <exclude name="WordPress.WP.AlternativeFunctions.curl_curl_exec"></exclude>
-        <exclude name="WordPress.WP.AlternativeFunctions.curl_curl_close"></exclude>
         <exclude name="WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents"></exclude>
-        <exclude name="WordPress.WP.AlternativeFunctions.json_encode_json_encode"></exclude><!-- The function `wp_json_encode()` does not support PHP less than 5.6. -->
-        <exclude name="WordPress.WP.AlternativeFunctions.strip_tags_strip_tags"></exclude>
         <exclude name="WordPress.WP.EnqueuedResourceParameters.MissingVersion"></exclude>
         <exclude name="WordPress.WP.EnqueuedResourceParameters.NoExplicitVersion"></exclude>
         <exclude name="WordPress.WP.I18n.MissingArgDomain"></exclude>
diff --git a/App/App.php b/App/App.php
index 8ae23ea..d314961 100644
--- a/App/App.php
+++ b/App/App.php
@@ -8,7 +8,6 @@
 
 namespace RundizOauth\App;
 
-use RundizOauth\App\Controllers as Controllers;
 
 if (!class_exists('\\RundizOauth\\App\\App')) {
     class App
diff --git a/App/Controllers/Front/HookLoginPage.php b/App/Controllers/Front/HookLoginPage.php
index eb63f99..6d98dee 100644
--- a/App/Controllers/Front/HookLoginPage.php
+++ b/App/Controllers/Front/HookLoginPage.php
@@ -217,7 +217,7 @@ public function loadProfile()
                         $user = get_user_by('ID', $user_id);
                         wp_update_user([
                             'ID' => $user->ID, 
-                            'user_email' => $email
+                            'user_email' => $email,
                         ]);
                         do_action('rundiz_oauth_changeemail_success', $user->ID, $email);
                         unset($email, $user, $user_id);
@@ -226,7 +226,7 @@ public function loadProfile()
                             'rundiz-oauth-error', 
                             maybe_serialize([
                                 'class' => 'notice-success', 
-                                'message' => __('Your email has been changed.', 'okv-oauth')
+                                'message' => __('Your email has been changed.', 'okv-oauth'),
                             ])
                         );
                     } elseif (is_wp_error($email)) {
@@ -234,7 +234,7 @@ public function loadProfile()
                             'rundiz-oauth-error', 
                             maybe_serialize([
                                 'class' => 'notice-error', 
-                                'message' => $email->get_error_message()
+                                'message' => $email->get_error_message(),
                             ])
                         );
                     }
diff --git a/App/Libraries/Loader.php b/App/Libraries/Loader.php
index e270082..54e0bf9 100644
--- a/App/Libraries/Loader.php
+++ b/App/Libraries/Loader.php
@@ -96,7 +96,7 @@ public function loadTemplate($view_name, array $data = [])
                     // if not found the template file in plugin itself.
                     // throw the error to notice the developers.
                     /* translators: %s: Template path. */
-                    throw new \Exception(sprintf(__('The template file was not found. (%s)', 'okv-oauth'), $template_path));
+                    throw new \Exception(esc_html(sprintf(__('The template file was not found. (%s)', 'okv-oauth'), $template_path)));
                 }
             }
 
diff --git a/App/Libraries/MyOauth/Facebook.php b/App/Libraries/MyOauth/Facebook.php
index df79a77..3be0577 100644
--- a/App/Libraries/MyOauth/Facebook.php
+++ b/App/Libraries/MyOauth/Facebook.php
@@ -3,6 +3,7 @@
  * Facebook login
  * 
  * @package rundiz-oauth
+ * // phpcs:ignoreFile -- no longer supported.
  */
 
 
diff --git a/App/Libraries/MyOauth/Google.php b/App/Libraries/MyOauth/Google.php
index 0f76431..4e5cd43 100644
--- a/App/Libraries/MyOauth/Google.php
+++ b/App/Libraries/MyOauth/Google.php
@@ -277,7 +277,7 @@ public function wpLoginWithGoogle($user)
                                     // found user by this email.
                                     // keep $user because we will use it as return value.
                                     // set token cookie.
-                                    setcookie('rundiz_oauth_google_tokens', json_encode([$access_token, $id_token]), time()+(2 * DAY_IN_SECONDS), '/', defined(COOKIE_DOMAIN) ? COOKIE_DOMAIN : '');
+                                    setcookie('rundiz_oauth_google_tokens', wp_json_encode([$access_token, $id_token]), time()+(2 * DAY_IN_SECONDS), '/', defined(COOKIE_DOMAIN) ? COOKIE_DOMAIN : '');
                                     // complete.
                                 } else {
                                     // user was not found.
@@ -349,7 +349,7 @@ public function wpRegisterWithGoogle()
                                 // got user profile and email was verified.
                                 if (email_exists($result['data']->email) === false && username_exists($result['data']->email) === false) {
                                     // if user that is using this email is NOT already exists (yay).
-                                    setcookie('rundiz_oauth_google_tokens', json_encode([$access_token, $id_token]), time()+(2 * DAY_IN_SECONDS), '/', defined(COOKIE_DOMAIN) ? COOKIE_DOMAIN : '');
+                                    setcookie('rundiz_oauth_google_tokens', wp_json_encode([$access_token, $id_token]), time()+(2 * DAY_IN_SECONDS), '/', defined(COOKIE_DOMAIN) ? COOKIE_DOMAIN : '');
                                     $output['access_token'] = $access_token;
                                     $output['id_token'] = $id_token;
                                     $output['email'] = $result['data']->email;
diff --git a/App/Libraries/RundizOauth.php b/App/Libraries/RundizOauth.php
index 9535d34..dff25d8 100644
--- a/App/Libraries/RundizOauth.php
+++ b/App/Libraries/RundizOauth.php
@@ -120,7 +120,7 @@ public function loggedinRedirect($user)
                 $redirect_to = admin_url();
             }
 
-            $requested_redirect_to = (isset($_SESSION['okv-oauth_redirect_to']) ? $_SESSION['okv-oauth_redirect_to'] : '');
+            $requested_redirect_to = (isset($_SESSION['okv-oauth_redirect_to']) ? sanitize_url($_SESSION['okv-oauth_redirect_to']) : '');
             $redirect_to = apply_filters('login_redirect', $redirect_to, $requested_redirect_to, $user);
             unset($requested_redirect_to);
 
diff --git a/App/config/settings_rdoauth.php b/App/config/settings_rdoauth.php
index 67d1da3..0811905 100644
--- a/App/config/settings_rdoauth.php
+++ b/App/config/settings_rdoauth.php
@@ -152,7 +152,7 @@
 
 
 return [
-    'tab_style' => 'vertical',// vertical or horizontal
+    'tab_style' => 'vertical', // vertical or horizontal
     'setting_tabs' => [
         [
             'icon' => 'fa fa-sign-in fa-fw',
@@ -181,7 +181,7 @@
                     'type' => 'select',
                 ],
             ],
-        ],// end login settings tab.
+        ], // end login settings tab.
         [
             'icon' => 'fa fa-google fa-fw',
             'title' => __('Google login', 'okv-oauth'),
@@ -251,7 +251,7 @@
                     'type' => 'html_full',
                 ],
             ],
-        ],// end google login settings tab.
+        ], // end google login settings tab.
         [
             'icon' => 'fa fa-facebook fa-fw',
             'title' => __('Facebook login', 'okv-oauth'),
@@ -287,7 +287,7 @@
                     'type' => 'html_full',
                 ],
             ],
-        ],// end facebook login settings tab.
+        ], // end facebook login settings tab.
         [
             'icon' => 'fa fa-paint-brush fa-fw',
             'title' => __('Design pages', 'okv-oauth'),
@@ -298,6 +298,6 @@
                     'type' => 'html_full',
                 ],
             ],
-        ],// end design help tab.
+        ], // end design help tab.
     ],
 ];
\ No newline at end of file
diff --git a/blocks-src/loginlinks/render.php b/blocks-src/loginlinks/render.php
index 8c9e8a4..8591763 100644
--- a/blocks-src/loginlinks/render.php
+++ b/blocks-src/loginlinks/render.php
@@ -6,14 +6,16 @@
  */
 
 
-$currentUrl = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+$currentUrl = ( is_ssl() ? 'https://' : 'http://' ) . 
+    (isset($_SERVER['HTTP_HOST']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_HOST'])) : '') . 
+    (isset($_SERVER['REQUEST_URI']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'])) : '');
 $isUserLoggedIn = is_user_logged_in();
 $classes = ($isUserLoggedIn ? 'logged-in' : 'logged-out');
 $contents = '';
 
 if (!$isUserLoggedIn && get_option('users_can_register')) {
     $contents .= '<li><a href="' . esc_url( wp_registration_url() ) . '">' . __( 'Register' ) . '</a></li>' . PHP_EOL;
-} elseif ($isUserLoggedIn && isset($attributes) && is_array($attributes) && array_key_exists('displayLinkToAdmin', $attributes) && $attributes['displayLinkToAdmin'] === true) {
+} elseif ($isUserLoggedIn && isset($attributes) && is_array($attributes) && array_key_exists('displayLinkToAdmin', $attributes) && true === $attributes['displayLinkToAdmin']) {
     $contents .= '<li><a href="' . admin_url() . '">' . __( 'Site Admin' ) . '</a></li>' . PHP_EOL;
 }
 unset($isUserLoggedIn);
diff --git a/blocks/loginlinks/render.php b/blocks/loginlinks/render.php
index 8c9e8a4..8591763 100644
--- a/blocks/loginlinks/render.php
+++ b/blocks/loginlinks/render.php
@@ -6,14 +6,16 @@
  */
 
 
-$currentUrl = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+$currentUrl = ( is_ssl() ? 'https://' : 'http://' ) . 
+    (isset($_SERVER['HTTP_HOST']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_HOST'])) : '') . 
+    (isset($_SERVER['REQUEST_URI']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'])) : '');
 $isUserLoggedIn = is_user_logged_in();
 $classes = ($isUserLoggedIn ? 'logged-in' : 'logged-out');
 $contents = '';
 
 if (!$isUserLoggedIn && get_option('users_can_register')) {
     $contents .= '<li><a href="' . esc_url( wp_registration_url() ) . '">' . __( 'Register' ) . '</a></li>' . PHP_EOL;
-} elseif ($isUserLoggedIn && isset($attributes) && is_array($attributes) && array_key_exists('displayLinkToAdmin', $attributes) && $attributes['displayLinkToAdmin'] === true) {
+} elseif ($isUserLoggedIn && isset($attributes) && is_array($attributes) && array_key_exists('displayLinkToAdmin', $attributes) && true === $attributes['displayLinkToAdmin']) {
     $contents .= '<li><a href="' . admin_url() . '">' . __( 'Site Admin' ) . '</a></li>' . PHP_EOL;
 }
 unset($isUserLoggedIn);