There are three ways to extend coding rules:

1. Adding XPath rules directly in the Sonar web interface,
2. Extending an existing Sonar plugin. For example Checkstyle and PMD plugins accept definition of custom checks.
3. Embedding and executing a code analyzer. For example the Checkstyle plugin configures and executes the library Checkstyle. 

Solution #1: Adding XPath Rules

It is possible to define XPath rules directly from UI. Search for the rule XPath rule template in a quality profile and copy it to create a new rule:

Solution #2: Extending Sonar Plugins

The following plugins can be extended with new rules:

• Checkstyle (Java)
• PMD (Java)
• Codesniffer and phpmd (PHP)
• C, freeware plugin provided by SonarSource
• Cobol, commercial plugin provided by SonarSource
• FxCop (C#)
• Gendarme (C#)

Checkstyle (Java)

Checkstyle provides extension mechanisms to develop your own coding rules. Tutorials to write such custom rules are available online. You can for instance define your own naming conventions, forbid access to a given API or anything else that is relevant in your context.

Once written, the Checkstyle rules must be listed and packaged in a Sonar plugin.

See the Sonar Project Examples for more information.

PMD (Java)

The PMD coding rules must be packaged in a Sonar plugin.

See the Sonar Project Examples for more information.

PHP

Read the plugin documentation.

C

Read the plugin documentation.

Cobol

Read the plugin documentation.

C# FxCop and Gendarme plugins

Read the plugin documentation.

Solution #3: Executing a Code Analyzer

A code analyzer plugin executes the following steps :

1. Register definitions of coding rules, when the server is started.
2. Optionally define some templates of quality profiles, when the server is started.
3. Analyze source code and inject results in database 

1. Registering coding rules

This step relates to the extension point org.sonar.api.rules.RuleRepository. A RuleRepository defines a set of coding rules. It usually loads data from a XML file :

The XML file is available in the plugin classloader and looks like :

2. Defining quality profiles

This step relates to the extension point org.sonar.api.profiles.ProfileDefinition. Profiles provided by plugins are registered at server startup  and can't be edited by users :

3. Analyzing source code

This step relates to the extension point org.sonar.api.batch.Sensor.