diff --git a/includes/admin/class-wc-admin-permalink-settings.php b/includes/admin/class-wc-admin-permalink-settings.php
index 08594b93939..42bcdf87b12 100644
--- a/includes/admin/class-wc-admin-permalink-settings.php
+++ b/includes/admin/class-wc-admin-permalink-settings.php
@@ -13,7 +13,9 @@ if ( ! defined( 'ABSPATH' ) ) {
 	exit;
 }
 
-if ( ! class_exists( 'WC_Admin_Permalink_Settings', false ) ) :
+if ( class_exists( 'WC_Admin_Permalink_Settings', false ) ) {
+	return new WC_Admin_Permalink_Settings();
+}
 
 /**
  * WC_Admin_Permalink_Settings Class.
@@ -39,30 +41,28 @@ class WC_Admin_Permalink_Settings {
 	 * Init our settings.
 	 */
 	public function settings_init() {
-		// Add a section to the permalinks page
 		add_settings_section( 'woocommerce-permalink', __( 'Product permalinks', 'woocommerce' ), array( $this, 'settings' ), 'permalink' );
 
-		// Add our settings
 		add_settings_field(
-			'woocommerce_product_category_slug',            // id
-			__( 'Product category base', 'woocommerce' ),   // setting title
-			array( $this, 'product_category_slug_input' ),  // display callback
-			'permalink',                                    // settings page
-			'optional'                                      // settings section
+			'woocommerce_product_category_slug',
+			__( 'Product category base', 'woocommerce' ),
+			array( $this, 'product_category_slug_input' ),
+			'permalink',
+			'optional'
 		);
 		add_settings_field(
-			'woocommerce_product_tag_slug',                 // id
-			__( 'Product tag base', 'woocommerce' ),        // setting title
-			array( $this, 'product_tag_slug_input' ),       // display callback
-			'permalink',                                    // settings page
-			'optional'                                      // settings section
+			'woocommerce_product_tag_slug',
+			__( 'Product tag base', 'woocommerce' ),
+			array( $this, 'product_tag_slug_input' ),
+			'permalink',
+			'optional'
 		);
 		add_settings_field(
-			'woocommerce_product_attribute_slug',           // id
-			__( 'Product attribute base', 'woocommerce' ),  // setting title
-			array( $this, 'product_attribute_slug_input' ), // display callback
-			'permalink',                                    // settings page
-			'optional'                                      // settings section
+			'woocommerce_product_attribute_slug',
+			__( 'Product attribute base', 'woocommerce' ),
+			array( $this, 'product_attribute_slug_input' ),
+			'permalink',
+			'optional'
 		);
 
 		$this->permalinks = wc_get_permalink_structure();
@@ -99,9 +99,9 @@ class WC_Admin_Permalink_Settings {
 	 * Show the settings.
 	 */
 	public function settings() {
-		echo wpautop( __( 'These settings control the permalinks used specifically for products.', 'woocommerce' ) );
+		/* translators: %s: Home URL */
+		echo wp_kses_post( wpautop( sprintf( __( 'If you like, you may enter custom structures for your product URLs here. For example, using <code>shop</code> would make your product links like <code>%sshop/sample-product/</code>. This setting affects product URLs only, not things such as product categories.', 'woocommerce' ), esc_url( home_url( '/' ) ) ) ) );
 
-		// Get shop page
 		$shop_page_id   = wc_get_page_id( 'shop' );
 		$base_slug      = urldecode( ( $shop_page_id > 0 && get_post( $shop_page_id ) ) ? get_page_uri( $shop_page_id ) : _x( 'shop', 'default-slug', 'woocommerce' ) );
 		$product_base   = _x( 'product', 'default-slug', 'woocommerce' );
@@ -115,28 +115,29 @@ class WC_Admin_Permalink_Settings {
 		<table class="form-table wc-permalink-structure">
 			<tbody>
 				<tr>
-					<th><label><input name="product_permalink" type="radio" value="<?php echo esc_attr( $structures[0] ); ?>" class="wctog" <?php checked( $structures[0], $this->permalinks['product_base'] ); ?> /> <?php _e( 'Default', 'woocommerce' ); ?></label></th>
+					<th><label><input name="product_permalink" type="radio" value="<?php echo esc_attr( $structures[0] ); ?>" class="wctog" <?php checked( $structures[0], $this->permalinks['product_base'] ); ?> /> <?php esc_html_e( 'Default', 'woocommerce' ); ?></label></th>
 					<td><code class="default-example"><?php echo esc_html( home_url() ); ?>/?product=sample-product</code> <code class="non-default-example"><?php echo esc_html( home_url() ); ?>/<?php echo esc_html( $product_base ); ?>/sample-product/</code></td>
 				</tr>
 				<?php if ( $shop_page_id ) : ?>
 					<tr>
-						<th><label><input name="product_permalink" type="radio" value="<?php echo esc_attr( $structures[1] ); ?>" class="wctog" <?php checked( $structures[1], $this->permalinks['product_base'] ); ?> /> <?php _e( 'Shop base', 'woocommerce' ); ?></label></th>
+						<th><label><input name="product_permalink" type="radio" value="<?php echo esc_attr( $structures[1] ); ?>" class="wctog" <?php checked( $structures[1], $this->permalinks['product_base'] ); ?> /> <?php esc_html_e( 'Shop base', 'woocommerce' ); ?></label></th>
 						<td><code><?php echo esc_html( home_url() ); ?>/<?php echo esc_html( $base_slug ); ?>/sample-product/</code></td>
 					</tr>
 					<tr>
-						<th><label><input name="product_permalink" type="radio" value="<?php echo esc_attr( $structures[2] ); ?>" class="wctog" <?php checked( $structures[2], $this->permalinks['product_base'] ); ?> /> <?php _e( 'Shop base with category', 'woocommerce' ); ?></label></th>
+						<th><label><input name="product_permalink" type="radio" value="<?php echo esc_attr( $structures[2] ); ?>" class="wctog" <?php checked( $structures[2], $this->permalinks['product_base'] ); ?> /> <?php esc_html_e( 'Shop base with category', 'woocommerce' ); ?></label></th>
 						<td><code><?php echo esc_html( home_url() ); ?>/<?php echo esc_html( $base_slug ); ?>/product-category/sample-product/</code></td>
 					</tr>
 				<?php endif; ?>
 				<tr>
-					<th><label><input name="product_permalink" id="woocommerce_custom_selection" type="radio" value="custom" class="tog" <?php checked( in_array( $this->permalinks['product_base'], $structures ), false ); ?> />
-						<?php _e( 'Custom base', 'woocommerce' ); ?></label></th>
+					<th><label><input name="product_permalink" id="woocommerce_custom_selection" type="radio" value="custom" class="tog" <?php checked( in_array( $this->permalinks['product_base'], $structures, true ), false ); ?> />
+						<?php esc_html_e( 'Custom base', 'woocommerce' ); ?></label></th>
 					<td>
-						<input name="product_permalink_structure" id="woocommerce_permalink_structure" type="text" value="<?php echo esc_attr( $this->permalinks['product_base'] ? trailingslashit( $this->permalinks['product_base'] ) : '' ); ?>" class="regular-text code"> <span class="description"><?php _e( 'Enter a custom base to use. A base <strong>must</strong> be set or WordPress will use default instead.', 'woocommerce' ); ?></span>
+						<input name="product_permalink_structure" id="woocommerce_permalink_structure" type="text" value="<?php echo esc_attr( $this->permalinks['product_base'] ? trailingslashit( $this->permalinks['product_base'] ) : '' ); ?>" class="regular-text code"> <span class="description"><?php esc_html_e( 'Enter a custom base to use. A base must be set or WordPress will use default instead.', 'woocommerce' ); ?></span>
 					</td>
 				</tr>
 			</tbody>
 		</table>
+		<?php wp_nonce_field( 'wc-permalinks', 'wc-permalinks-nonce' ); ?>
 		<script type="text/javascript">
 			jQuery( function() {
 				jQuery('input.wctog').change(function() {
@@ -171,20 +172,20 @@ class WC_Admin_Permalink_Settings {
 		}
 
 		// We need to save the options ourselves; settings api does not trigger save for the permalinks page.
-		if ( isset( $_POST['permalink_structure'] ) ) {
+		if ( isset( $_POST['permalink_structure'], $_POST['wc-permalinks-nonce'], $_POST['woocommerce_product_category_slug'], $_POST['woocommerce_product_tag_slug'], $_POST['woocommerce_product_attribute_slug'] ) && wp_verify_nonce( wp_unslash( $_POST['wc-permalinks-nonce'] ), 'wc-permalinks' ) ) { // WPCS: input var ok, sanitization ok.
 			wc_switch_to_site_locale();
 
 			$permalinks                   = (array) get_option( 'woocommerce_permalinks', array() );
-			$permalinks['category_base']  = wc_sanitize_permalink( trim( $_POST['woocommerce_product_category_slug'] ) );
-			$permalinks['tag_base']       = wc_sanitize_permalink( trim( $_POST['woocommerce_product_tag_slug'] ) );
-			$permalinks['attribute_base'] = wc_sanitize_permalink( trim( $_POST['woocommerce_product_attribute_slug'] ) );
+			$permalinks['category_base']  = wc_sanitize_permalink( wp_unslash( $_POST['woocommerce_product_category_slug'] ) ); // WPCS: input var ok, sanitization ok.
+			$permalinks['tag_base']       = wc_sanitize_permalink( wp_unslash( $_POST['woocommerce_product_tag_slug'] ) ); // WPCS: input var ok, sanitization ok.
+			$permalinks['attribute_base'] = wc_sanitize_permalink( wp_unslash( $_POST['woocommerce_product_attribute_slug'] ) ); // WPCS: input var ok, sanitization ok.
 
 			// Generate product base.
-			$product_base = isset( $_POST['product_permalink'] ) ? wc_clean( $_POST['product_permalink'] ) : '';
+			$product_base = isset( $_POST['product_permalink'] ) ? wc_clean( wp_unslash( $_POST['product_permalink'] ) ) : ''; // WPCS: input var ok, sanitization ok.
 
 			if ( 'custom' === $product_base ) {
-				if ( isset( $_POST['product_permalink_structure'] ) ) {
-					$product_base = preg_replace( '#/+#', '/', '/' . str_replace( '#', '', trim( $_POST['product_permalink_structure'] ) ) );
+				if ( isset( $_POST['product_permalink_structure'] ) ) { // WPCS: input var ok.
+					$product_base = preg_replace( '#/+#', '/', '/' . str_replace( '#', '', trim( wp_unslash( $_POST['product_permalink_structure'] ) ) ) ); // WPCS: input var ok, sanitization ok.
 				} else {
 					$product_base = '/';
 				}
@@ -213,6 +214,4 @@ class WC_Admin_Permalink_Settings {
 	}
 }
 
-endif;
-
 return new WC_Admin_Permalink_Settings();
diff --git a/includes/admin/importers/views/html-product-csv-import-form.php b/includes/admin/importers/views/html-product-csv-import-form.php
index cc20d780c06..ddbb4ed4c7d 100644
--- a/includes/admin/importers/views/html-product-csv-import-form.php
+++ b/includes/admin/importers/views/html-product-csv-import-form.php
@@ -55,7 +55,7 @@ if ( ! defined( 'ABSPATH' ) ) {
 					<td>
 						<input type="hidden" name="update_existing" value="0" />
 						<input type="checkbox" id="woocommerce-importer-update-existing" name="update_existing" value="1" />
-						<label for="woocommerce-importer-update-existing"><?php esc_html_e( 'If a product being imported matches an existing product by ID or SKU, update the existing product rather than creating a new product or skipping the row.', 'woocommerce' ); ?></label>
+						<label for="woocommerce-importer-update-existing"><?php esc_html_e( 'Existing products that match by ID or SKU will be updated. Products that do not exist will be skipped.', 'woocommerce' ); ?></label>
 					</td>
 				</tr>
 				<tr class="woocommerce-importer-advanced hidden">
diff --git a/includes/wc-formatting-functions.php b/includes/wc-formatting-functions.php
index c07a590fa9d..38818efbd00 100644
--- a/includes/wc-formatting-functions.php
+++ b/includes/wc-formatting-functions.php
@@ -80,7 +80,7 @@ function wc_sanitize_permalink( $value ) {
 		$value = '';
 	}
 
-	$value = esc_url_raw( $value );
+	$value = esc_url_raw( trim( $value ) );
 	$value = str_replace( 'http://', '', $value );
 	return untrailingslashit( $value );
 }
diff --git a/phpcs.ruleset.xml b/phpcs.ruleset.xml
index d2216c38577..af9bb065fad 100644
--- a/phpcs.ruleset.xml
+++ b/phpcs.ruleset.xml
@@ -32,7 +32,7 @@
 	</rule>
 	<rule ref="WordPress.VIP.ValidatedSanitizedInput">
 		<properties>
-			<property name="customSanitizingFunctions" type="array" value="wc_clean,wc_sanitize_tooltip,wc_format_decimal,wc_stock_amount" />
+			<property name="customSanitizingFunctions" type="array" value="wc_clean,wc_sanitize_tooltip,wc_format_decimal,wc_stock_amount,wc_sanitize_permalink" />
 		</properties>
 	</rule>
 	<rule ref="WordPress.XSS.EscapeOutput">