WordPress plugin development

Register custom oEmbed providers and embed handlers Paste a YouTube or Vimeo link into a post and WordPress shows a player instead of the link. Behind it is oEmbed: WordPress asks the service’s oEmbed endpoint for the embed HTML of that URL. A list of trusted providers is built into core. Links from other services,…

Add a custom panel to the Document sidebar with PluginDocumentSettingPanel The Document tab of the block editor holds the post settings: status, permalink, categories, featured image. Since WordPress 5.3, plugins can add their own collapsible panel there with PluginDocumentSettingPanel. For a field that belongs to the whole post, like a release year or a “featured”…

Control plugin and theme auto-updates with auto_update_plugin WordPress 5.5 added “Enable auto-updates” links to the Plugins and Themes screens: an administrator can switch automatic updates on per plugin or theme, and WordPress installs new versions in the background twice a day. The filters behind it, auto_update_plugin and auto_update_theme, have existed since WordPress 3.7, and they…

Block transforms: convert between your block and core blocks The “Transform” button in the block toolbar turns a paragraph into a heading, a list into a quote, several images into a gallery, without retyping anything. Custom blocks get the same convenience by declaring transforms in their registration: from lists what can become your block, to…

wp_localize_script() or wp_add_inline_script(): passing data to JavaScript Scripts often need values from PHP: the AJAX URL, a nonce, translated messages, settings of the current page. WordPress has two functions for printing such data next to an enqueued script. wp_localize_script() turns a PHP array into a global JavaScript object. wp_add_inline_script() (WordPress 4.5+) adds any JavaScript code…

Add your plugin’s data to the WordPress privacy export and erase tools Since WordPress 4.9.6 (May 2018) the admin has two GDPR tools: Tools → Export Personal Data creates a ZIP with everything the site stores about an email address, and Tools → Erase Personal Data deletes or anonymises it. Core covers user profiles, comments…

Send WordPress email over SMTP without a plugin By default WordPress sends email with PHP’s mail() function, which hands the message to the mail program of the server. On many hosts these messages land in spam or never arrive: the server is not allowed to send for your domain (no SPF or DKIM record for…

Plugin activation, deactivation and uninstall hooks A plugin has a life cycle: it is activated, runs while active, is deactivated and finally deleted. WordPress has a hook for each of these moments, and each one has its own job. Activation sets things up, deactivation removes temporary side effects but keeps the data, and uninstall removes…

Custom URL structures with add_rewrite_rule() and query variables Post types, taxonomies and endpoints produce their URLs automatically. When you need a structure that none of them gives, for example /docs/installation/requirements/ where the first part is a section and the second a document, you write the rule yourself: a regular expression for the path and the…