Security Practical
Closing user enumeration: what REST hands out by default
/wp-json/wp/v2/users opens without login, and the slug it carries is usually the username. That leaves an attacker with only the password to find.
Technote
WordPress know-how, from real work Technotes worth picking
282 articles
SEO Practical
The fortnight after launch: what to watch
A few unsettled days after launch are normal. A decline that persists for two weeks is not. Here is what to watch across indexing, speed and conversion.
Servers & infrastructure Practical
Page caching belongs on the server layer
The layer that stores finished HTML only pays off in front of PHP. Stack a plugin cache on top of a server cache and you now have two…
Working with AI Advanced
Competitor analysis with AI — open the page and verify
Summarising structure across several articles and spotting coverage gaps is genuinely useful work for AI. Every factual claim about a competitor, though, must be checked by opening the…
Development workflow Advanced
Adding your own WP-CLI command to a plugin
Registration is three lines and your docblock becomes the help text. What deserves thought is choosing between log, warning and error — because error stops the run.
Themes & plugins Practical
Secondary queries in templates, and what forgetting the reset does
You add a related-posts list and everything below it starts pointing at the wrong post. It looks like a template bug; it is one missing line.
Development workflow Practical
Removing someone else’s hook: name, priority and timing must match
remove_action says nothing when it fails, and a wrong name, a wrong priority and running too early all look identical. Checking the return value is half the fix.
Working with AI Practical
AI-written content and search: authorship is not the problem
Search engines rank helpfulness, not authorship. Mass-produced thin content fails because it is thin — not because a machine wrote it.
Development workflow Practical
Three deploy strategies: rsync, git on the server, built artefacts
What separates the three is not speed but the rollback story. Decide how you undo a deploy before you decide how you make one.
Security Practical
Lead data is an asset and a liability at once
A contact list is a marketing asset and personal data at the same time. Collect the minimum, set a retention period, and actually delete when it expires.
Security Practical
Analytics and privacy: collecting the minimum, honestly disclosed
Showing a banner is not the same as obtaining consent. You should be able to explain what you collect and why — and a retention period ought to…
SEO Practical
Every field on your form has to earn its place
Fewer fields generally convert better. But the honest question is not "how much will we gain" — it is "what does this field do to earn its place".
Cited
Technotes worth reading next
Topics outside WordPress are collected on Dongji Communication Tech Insights, run by the same team. The summaries below are quoted from the originals; the titles link to them.
-
Working with AI
Writing a CLAUDE.md — teaching an AI coding assistant your project
AI coding tools such as Claude Code, Cursor and Copilot do better work the more precisely they know your project. Here is a structure and a set of principles that hold up.
-
Working with AI
Prompting an AI for UI design — drafting with Claude and GPT
Asking an AI to "make a nice button" gets you a disappointing button. Structured prompts that carry constraints, references and a defined role get you the design you meant.
-
Themes & plugins
SCSS from the ground up — variables through module structure
The core syntax of SCSS (Sass) and what it solves that plain CSS cannot: variables, nesting, mixins, @use and module structure — organised around patterns you can use immediately.
-
Themes & plugins
Design tokens and theme colour systems — brand identity in SCSS variables
How to turn a colour palette from a pile of hex codes into a system that means something — semantic token structure and SCSS variable patterns, from a real project.
-
Performance optimization
Designing a responsive typography system — the science of readability
Hard-coded pixel font sizes are over. Type scales, fluid sizing with clamp(), Korean webfont optimisation and line-height ratios — building typography that reads well on any screen.
-
Development workflow
From Figma to SCSS — a designer-developer handoff guide
Minimising what gets lost between a Figma file and the code: extracting tokens, naming components, keeping the spacing system in sync — the whole workflow, step by step.