Technote
For developers who work on WordPress as code: hooks and filters, WP-CLI, Git workflow and deployment automation.
53 articles· Developers
Performance optimization Advanced
Dropping unused scripts is possible. But you inherit responsibility for whatever depended on them, so you need a procedure for finding out what actually breaks.
Development workflow Advanced
Code with no extension points gets forked or edited in place. Where you put do_action and apply_filters — and how many — decides how long that code survives.
Servers & infrastructure Advanced
Scheduled posts that publish late are usually a structural problem, not a code one. WordPress cron rides on incoming requests, so on a quiet site nothing runs at…
Development workflow Advanced
CI earns its keep without a full test suite. Syntax, coding standards, a build check and a boot smoke test are a realistic starting point.
Security Practical
/wp-json/wp/v2/users opens without login, and the slug it carries is usually the username. That leaves an attacker with only the password to find.
Servers & infrastructure Practical
The layer that stores finished HTML only pays off in front of PHP. Stack a plugin cache on top of a server cache and you now have two…
Development workflow Advanced
Registration is three lines and your docblock becomes the help text. What deserves thought is choosing between log, warning and error — because error stops the run.
Themes & plugins Practical
You add a related-posts list and everything below it starts pointing at the wrong post. It looks like a template bug; it is one missing line.
Development workflow Practical
remove_action says nothing when it fails, and a wrong name, a wrong priority and running too early all look identical. Checking the return value is half the fix.
Development workflow Practical
What separates the three is not speed but the rollback story. Decide how you undo a deploy before you decide how you make one.
Security Practical
An external server has no cookie and no nonce. Verify by signature or shared key, compare with hash_equals, and always sign the raw body.
Development workflow Practical
A seed script never runs only once. Get the lookup wrong and the check passes, the insert runs, and WordPress quietly appends -2 to the slug.