Enforce non-empty constraints for Site Title and Network Title across all contexts

[himanshupathak95]

Trac ticket: https://core.trac.wordpress.org/ticket/65718

The site title (blogname) is enforced as required during multisite site creation, but could be cleared to an empty string via admin paths or the REST API after creation. Also resolves a related issue where the Network Title (site_name) could be saved empty.

• Added minLength: 1 and pattern: \S to the title (blogname) schema in register_initial_settings() so that empty submissions via the block editor correctly return a 400 Bad Request validation error rather than silently failing.
• Added a specific guard to WP_REST_Settings_Controller::update_item() to prevent title: null from mapping to delete_option('blogname'), which bypassed option sanitization completely.
• Added empty validation for blogname within sanitize_option() to reject empty values during direct update_option() or CLI calls, registering a standard settings error.
• Added server-side empty validation for the site_name network option before the save loop in wp-admin/network/settings.php, and hardened the payload check against non-scalar inputs.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[Copilot]

Pull request overview

This PR prevents administrators from saving an empty Site Title (blogname) or Network Title (site_name) through the relevant admin screens, aligning edit behavior with creation-time requirements (notably in Multisite).

Changes:

• Add server-side validation in sanitize_option() to reject empty/whitespace-only blogname updates (retaining the stored value and registering a settings error).
• Mark Site Title / Network Title inputs as required in the General Settings and Network Settings forms.
• In Multisite site settings, carry sanitize_option() settings errors across the redirect to display an error notice instead of a success message.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
src/wp-includes/formatting.php	Rejects empty Site Title updates during option sanitization and registers a settings error.
src/wp-admin/options-general.php	Marks “Site Title” as a required field in the General Settings UI.
src/wp-admin/network/site-settings.php	Persists settings errors across redirect and displays error notices when site options aren’t saved.
src/wp-admin/network/settings.php	Prevents saving an empty Network Title, shows an error notice, and marks the field as required.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

src/wp-includes/formatting.php:5003

• This change introduces new behavior for sanitize_option( 'blogname', ... ) (rejecting empty/whitespace-only values and registering a settings error), but there’s no PHPUnit coverage asserting the new validation and the expected get_settings_errors( 'blogname' ) result. Adding a unit test will help prevent regressions in both the returned value (should remain the previously stored option) and the presence/content of the settings error.

				// The site title (blogname) cannot be empty.
				if ( 'blogname' === $option && '' === trim( $value ) ) {
					$error = __( 'The site title cannot be empty. Please enter a title for your site.' );
				}

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (5)

src/wp-includes/formatting.php:5003

• The new blogname empty/whitespace rejection in sanitize_option() is security-/UX-critical behavior and should be covered by PHPUnit tests. There’s already a dedicated sanitize_option() test suite (tests/phpunit/tests/option/sanitizeOption.php) that includes blogname cases; it should be extended with cases like '' and ' ' to assert the stored value is preserved and a settings error is registered.

				// The site title (blogname) cannot be empty.
				if ( 'blogname' === $option && '' === trim( $value ) ) {
					$error = __( 'The site title cannot be empty. Please enter a title for your site.' );
				}

src/wp-admin/network/site-settings.php:98

• This read/delete needs to use the same site-settings-specific transient key as the save path above; otherwise it will continue to clash with the Settings API’s global settings_errors transient and can display unrelated errors.

		$settings_errors = get_transient( 'settings_errors' );
		delete_transient( 'settings_errors' );

src/wp-includes/rest-api/endpoints/class-wp-rest-settings-controller.php:206

• The custom rest_invalid_param error for a null site title doesn’t include params data, so API clients can’t reliably associate the error with the title parameter. Other rest_invalid_param responses (e.g. request arg validation) include a params map; matching that shape improves consistency and client UX.

					return new WP_Error(
						'rest_invalid_param',
						__( 'The site title cannot be empty. Please enter a title for your site.' ),
						array( 'status' => 400 )
					);

src/wp-includes/formatting.php:5003

• This adds an empty-title guard for blogname, but update_network_option() also routes network options through sanitize_option(); site_name (Network Title) can still be set to an empty/whitespace value via programmatic updates (or other admin flows) because it isn’t validated here. To actually enforce “Network Title cannot be empty” across contexts, sanitize_option() should reject empty site_name too (with a dedicated message), similar to blogname.

				// The site title (blogname) cannot be empty.
				if ( 'blogname' === $option && '' === trim( $value ) ) {
					$error = __( 'The site title cannot be empty. Please enter a title for your site.' );
				}

src/wp-admin/network/site-settings.php:74

• Using the generic settings_errors transient here can collide with the Settings API’s own redirect flow (e.g. wp-admin/options.php also writes settings_errors). If another settings save happens in a different tab between redirect and load, this page could show the wrong errors (or none). Consider using a site-settings-specific transient key (optionally including the site ID and user ID) and update the matching get_transient()/delete_transient() calls below.

This issue also appears on line 97 of the same file.

		set_transient( 'settings_errors', $settings_errors, 30 );

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

src/wp-includes/formatting.php:5003

• This change adds a new rejection path for empty/whitespace blogname in sanitize_option(), but there is currently no PHPUnit coverage for this behavior (the existing Tests_Option_SanitizeOption only covers valid blogname cases). Adding tests would help prevent regressions for update_option( 'blogname', '' ) and whitespace-only values.

				// The site title (blogname) cannot be empty.
				if ( 'blogname' === $option && '' === trim( $value ) ) {
					$error = __( 'The site title cannot be empty. Please enter a title for your site.' );
				}

src/wp-includes/rest-api/endpoints/class-wp-rest-settings-controller.php:207

• The new rest_invalid_param WP_Error for blogname null is missing the usual params field (used elsewhere for invalid parameter responses). Adding it makes the error response more consistent and lets clients map the message to the title param.

				if ( 'blogname' === $args['option_name'] ) {
					return new WP_Error(
						'rest_invalid_param',
						__( 'The site title cannot be empty. Please enter a title for your site.' ),
						array( 'status' => 400 )
					);

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props abcd95.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.