Security Practical
Closing user enumeration: what REST hands out by default
/wp-json/wp/v2/users opens without login, and the slug it carries is usually the username. That leaves an attacker with only the password to find.
Technote
WordPress know-how, from real work Technotes worth picking
5 articles· Security · Developers
Security Practical
Receiving webhooks: a nonce check fails every time
An external server has no cookie and no nonce. Verify by signature or shared key, compare with hash_equals, and always sign the raw body.
Security Practical
Escaping on output: which function for which context
Escape at output, not at input. The same stored value can end up in body text, an attribute or a URL, and each context defines safety differently.
Security Practical
Choosing authentication: cookies, application passwords, tokens
These three differ in threat model, not convenience. Whether the caller is a browser, your own server, or a third party decides the answer for you.
Security Practical
wp-config and secrets: keeping per-environment values out of the repo
A committed secret is a leaked secret. Rewriting history does not take it back, and the only remaining fix is rotation.
Cited
Technotes worth reading next
Topics outside WordPress are collected on Dongji Communication Tech Insights, run by the same team. The summaries below are quoted from the originals; the titles link to them.
-
Working with AI
Writing a CLAUDE.md — teaching an AI coding assistant your project
AI coding tools such as Claude Code, Cursor and Copilot do better work the more precisely they know your project. Here is a structure and a set of principles that hold up.
-
Working with AI
Prompting an AI for UI design — drafting with Claude and GPT
Asking an AI to "make a nice button" gets you a disappointing button. Structured prompts that carry constraints, references and a defined role get you the design you meant.
-
Themes & plugins
SCSS from the ground up — variables through module structure
The core syntax of SCSS (Sass) and what it solves that plain CSS cannot: variables, nesting, mixins, @use and module structure — organised around patterns you can use immediately.
-
Themes & plugins
Design tokens and theme colour systems — brand identity in SCSS variables
How to turn a colour palette from a pile of hex codes into a system that means something — semantic token structure and SCSS variable patterns, from a real project.
-
Performance optimization
Designing a responsive typography system — the science of readability
Hard-coded pixel font sizes are over. Type scales, fluid sizing with clamp(), Korean webfont optimisation and line-height ratios — building typography that reads well on any screen.
-
Development workflow
From Figma to SCSS — a designer-developer handoff guide
Minimising what gets lost between a Figma file and the code: extracting tokens, naming components, keeping the spacing system in sync — the whole workflow, step by step.