WordPress plugin development

A Gutenberg block with InnerBlocks and a template Some content has a fixed shape: a feature card is always an icon, a heading, a paragraph and a button. A custom block with InnerBlocks gives editors exactly that shape, filled with core blocks they already know, and the theme styles one predictable structure instead of whatever…

A WooCommerce payment gateway plugin from scratch When a regional payment provider has no WooCommerce plugin, you write one. The gateway class extends WC_Payment_Gateway: settings for the API keys and a test mode, process_payment() to start the payment, and a webhook that confirms it. The common case today is a redirect gateway: the customer pays…

Prevent SQL injection and XSS in WordPress plugins SQL injection and cross-site scripting (XSS) are the two most common vulnerability types in WordPress plugins. SQL injection happens when input becomes part of an SQL query; XSS when input (or stored data) is printed into HTML unescaped. WordPress has the tools for both: $wpdb->prepare() for queries,…

Add custom user roles and capabilities to WordPress programmatically A WordPress role is a named set of capabilities, stored in the wp_user_roles option. A user can have several roles, and code checks the capabilities, not the roles: current_user_can( 'edit_posts' ). Custom roles and capabilities let you give exactly the rights a job needs, instead of…

Write unit tests for WordPress plugins with PHPUnit and WP-CLI scaffolding WordPress unit tests run against a real WordPress loaded with a separate test database. Every test runs inside a database transaction that is rolled back afterwards, so each test starts from a clean state. WP-CLI generates the whole setup, and the base class WP_UnitTestCase…

Register custom REST API endpoints with authentication and schema validation register_rest_route() adds your own endpoints to the WordPress REST API. A route has a namespace (by convention myplugin/v1), a path (with optional regex parameters) and one or more handlers, each with HTTP methods, a callback, a permission callback and a description of the parameters. The…

Migrate WooCommerce orders to High-Performance Order Storage (HPOS) High-Performance Order Storage moves WooCommerce orders out of wp_posts and wp_postmeta into their own tables: wc_orders, wc_order_addresses, wc_order_operational_data and wc_orders_meta. It appeared as an opt-in feature in WooCommerce 7.1, and with WooCommerce 8.2 (October 2023) it becomes the default for new stores. The reason is performance: in…

Build a custom Gutenberg block with dynamic server-side rendering A custom block gives full control over the editor experience and the front-end output, without shortcodes. There are two kinds. A static block saves its HTML into the post content with a save function. A dynamic block saves only its attributes, and PHP builds the HTML…

Run custom SQL queries in WordPress with $wpdb->prepare() and get_results() WP_Query covers most needs, but some queries it cannot express or makes inefficient: aggregations with GROUP BY, joins across several tables, bulk updates. For those, WordPress gives the $wpdb object, a direct connection to the database, with $wpdb->prepare() for safe parameters.