WordPress plugin development

WP-Cron in depth: reliable scheduled tasks in WordPress WP-Cron is a pseudo-cron: there is no daemon. On page loads WordPress checks the list of scheduled events (the cron option), and if one is due, it sends a non-blocking request to wp-cron.php, which runs the events in the background. On a site with constant traffic this…

Upgrade old WordPress plugin code automatically with Rector A plugin written in 2017 for PHP 5.6 still runs, but it is full of array(), missing type declarations, isset( $x ) ? $x : null and string functions that receive null and produce deprecation notices in PHP 8.1. Rector rewrites such code automatically: it parses the…

Add static analysis with PHPStan to WordPress plugin development PHPStan reads PHP code and finds bugs without running it: calling a method on something that can be null or a WP_Error, passing the wrong type to a function, using an undefined variable, a missing array key. It infers types from native declarations, docblocks and function…

WordPress 6.4 for developers: Block Hooks, admin notices and options WordPress 6.4 (November 2023) is a release that looks small for users: a new default theme Twenty Twenty-Four, a lightbox for images, pattern categories. For developers it brought a few APIs that replace old workarounds: Block Hooks to insert a block into themes, two functions…

A JSON column for flexible data in a WordPress plugin table Some data has no fixed shape. The answers to a quiz depend on the questions: a choice here, a free text there, a rating somewhere else. Stored as post meta, one response becomes 50 rows in wp_postmeta. A custom table with a JSON column…

Implement TOTP two-factor authentication in WordPress without a plugin Time-based one-time passwords (TOTP, RFC 6238) are what authenticator apps (Google Authenticator, Authy, 1Password) generate: a 6-digit code computed from a shared secret and the current time in 30-second steps. The server runs the same algorithm, so no third-party service is involved. A stolen or reused…

Foreign keys in custom WordPress plugin tables WordPress itself uses no foreign keys: the relation between a post and its meta rows exists only in PHP code. A plugin with its own tables can do better and let the database keep the data consistent, for example delete the items of an order together with the…

PHP 8.1 enums, readonly properties and intersection types in a WordPress plugin PHP 8.1 brought three features that make plugin code stricter with little effort. Enums replace groups of string constants, so an invalid status is a type error instead of a silent bug. Readonly properties make value objects that cannot change after construction. Intersection…

Cache expensive operations with the WordPress Transients API The Transients API stores cached data with an expiration time. The same set_transient() and get_transient() calls use the wp_options table on a default install and memory (Redis, Memcached) when a persistent object cache is active, without any code changes. Good candidates are remote API responses, heavy WP_Query…