Building, hardening, and unbreaking WordPress without losing weekends to plugin updates.
A WordPress sandbox that boots a real site in your browser, runs the snippet you paste, and links every core function and hook in it to a reference page. No install, nothing uploaded.
Enriching thousands of WordPress posts with AI one request at a time burns money and time. Here is the true batch API flow, 50% cheaper, with a WP-CLI and PHP example that reads your content, batches it, and writes the results back.
Error establishing a database connection means WordPress cannot reach its database. Read the MySQL error code to find the real cause (wrong credentials, a stopped server, a connection limit, corrupted tables, or a cloud firewall) and fix that one thing.
Your database recovered but visitors still see the error page. A cache stored it because the error returned HTTP 200. Make db-error.php return 503 with no-store and standard caches (WP Super Cache, Varnish, nginx, Cloudflare) stop storing it.
Thousands of hits to wp-admin/admin-ajax.php are almost always your own site: WordPress Heartbeat and plugins, not a DDoS. How to read the action parameter, when it is a real attack, and why blocking the file breaks your site.
What 'Discovered - currently not indexed' and 'Crawled - currently not indexed' actually mean in Google Search Console, why they are usually normal, and why spamming Request Indexing does nothing.
Thousands of ?replytocom= URLs in Search Console come from WordPress comment reply links. Why they are already nofollow and canonicalized, and why blocking them in robots.txt is the one fix that backfires.
Thousands of ?wordfence_lh=1&hid= URLs in Google Search Console come from Wordfence's Live Traffic feature. The setting that stops them, the check to run first, and why robots.txt is the wrong fix.
Let the kitchen edit a Google Sheet (prices, sections, daily specials, an 86'd flag) and have WordPress reconcile a menu_item post type to it on a schedule. A WP-CLI pull command, change-only, dry-run, and a sold-out flag that hides instead of deletes.
When the built-in CSV importer is not enough, a WP-CLI command reads a sheet or CSV and creates WooCommerce products through the CRUD. Idempotent by SKU, dry-run by default, so re-running the same file never duplicates.
Validate SKU-based product changes from a Google Sheet, preview them, create private backups, and update WooCommerce prices, inventory and scheduled sales.
Maintain SEO titles and meta descriptions in a Google Sheet and have a WP-CLI command write them into Yoast or Rank Math. Pull model, change-only, dry-run by default. No opening each post in the editor.
Reconcile existing WordPress listings from a Google Sheet with strict hours parsing, unique IDs, a dry run, checked database backup, and verified writes.
Keep events (title, dates, venue, sold-out flag, ticket URL) in a Google Sheet and have WordPress pull them into an event CPT on a cron. Dates stored as sortable Y-m-d H:i:s, change-only, dry-run by default, so the calendar maintains itself.
A sheet of post_id and image_url, a WP-CLI command that sideloads each URL into the media library and sets it as the post's featured image. Change-only, dry-run by default, and it skips posts that already have a thumbnail so re-running never duplicates.
Run a fleet of WordPress installs from a single Google Sheet: a website column per row, a small controller that groups the rows by site and pushes each batch to that site's endpoint, and partial-failure handling so one dead site never blocks the rest.
Keep a Google Sheet and WordPress in step in both directions: WordPress writes its current state back into the sheet, and edits in the sheet flow back to WordPress. The plumbing is easy. The hard part is deciding which side wins, and this is how to decide it on purpose instead of by accident.
Fire a WordPress update the moment a cell changes: an installable onEdit Apps Script trigger that pushes the edited row to a REST endpoint, filters hard on the column, and paints the status cell red on failure.
Two ways to read a Google Sheet from PHP: publish-to-web CSV (trivial, but public to anyone with the URL) or the Sheets API with a service account (private, scoped). The security trade-off, shown.
The pull model: have WordPress read a Google Sheet itself with a service account and apply each row to a custom field. A WP-CLI command, no Apps Script, no button, dry-run and change-only built in.
Why a WP_Query over thousands of posts balloons on memory and queries, and the exact knobs (fields => ids, no_found_rows, cache priming, batching, flush-in-loop) that fix it, each one measured before and after.
Update native WordPress text meta with a dry run, checked private snapshot, full attempt journal, and restore command. Includes a downloadable WP-CLI plugin.
ACF and native post meta both write to the same wp_postmeta table. Here is what register_post_meta gives you, what ACF adds on top, and the read/write rules so a bulk script and a content editor never fight over the same field.
The right way to run a one-off bulk operation across thousands of WordPress posts: a wp eval-file script with caches suspended, queries batched, and the object cache flushed in the loop so memory doesn't blow up.
Edit posts in a Google Sheet, press a button, and have the changes land in WordPress. A one-file MU-plugin REST endpoint plus a small Apps Script, with the auth done properly.
How to put a WordPress project under Git: what to track vs ignore, a ready .gitignore, version-controlling just your theme or plugin, and deploy options.
How to add a custom sitemap to Yoast SEO so rewrite-driven pages with no WordPress post still get indexed: append a <sitemap> to the index with wpseo_sitemap_index, register a named sitemap, and generate its <url> entries.
Build WordPress routes with fixed prefixes, validated query variables and deliberate status codes. Includes a complete virtual page and one-time flush checks.
Intercept requests that would 404 in WordPress on template_redirect, then resolve them to real content with status_header(200), 301 to the right URL with wp_safe_redirect(), or let them fall through. A fallback router for dynamic and legacy slugs you cannot enumerate.
The modern way to register a custom Gutenberg block: a block.json metadata file, register_block_type( __DIR__ . '/build/callout' ) on the init hook, and a @wordpress/scripts build step. One source of truth for PHP and JS.
How to build a custom product URL structure in WooCommerce: change or remove the /product/ and /shop/ bases from Settings > Permalinks, do it in code with a permalink filter plus add_rewrite_rule, and avoid the 404 collisions that come from a base-less product slug.
Register a custom WordPress REST route with object-level permissions, Application Passwords, validated writes and an optional HMAC client with replay protection.
How to register a custom WP-CLI command: guard it with defined('WP_CLI'), wire it up with WP_CLI::add_command(), turn class methods into subcommands, document args with @synopsis, and show progress with make_progress_bar().
How to build a dynamic Gutenberg block: render the front-end markup in PHP at request time with render_callback (or the block.json render property), return null from save, and preview it in the editor with ServerSideRender.
Keep API keys, database credentials, and SMTP secrets out of wp-config.php and out of git by loading them from a .env file with vlucas/phpdotenv, fed into define() where WordPress expects constants.
Render every call-to-action through one helper whose phone, label, URL, and visibility are all WordPress filters, so you change a CTA per context from a must-use plugin without touching the theme.
Install Google Tag Manager on WordPress with no plugin: the script in wp_head, the noscript iframe in wp_body_open (WP 5.2+), and the container ID stored once. The body snippet is the part people get wrong.
Embed a Google map in WordPress without tanking your load time: the free Maps Embed API iframe with loading="lazy", a te_map shortcode that escapes its output, an HTTP-referrer-locked API key, and a click-to-load consent pattern.
How to build three-level /make/model/year/ URLs in WordPress with add_rewrite_rule, custom query vars, and a vehicle CPT, plus the static-prefix collision that breaks the naive rule. Works the same on a catalog of brand/series/model or category/sub/sku.
WordPress only loads top-level PHP files in mu-plugins, with no activation hooks. Use a one-file loader that requires a Composer-autoloaded, PSR-4 namespaced plugin from a subdirectory.
How to override Rank Math's SEO title and meta description in PHP using the rank_math/frontend/title and rank_math/frontend/description filters, plus the canonical and Open Graph filters, with conditional per-context overrides for rewrite-driven pages.
Hooking pre_get_document_title does nothing once Yoast or Rank Math is active: the plugin owns the title and meta description tags. Here is which filter to hook for Yoast, Rank Math, and core, plus a portable helper that detects the active plugin.
Override Yoast SEO's title, meta description, canonical, and Open Graph/Twitter tags in PHP using the wpseo_title and wpseo_metadesc filters, with per-context conditionals for dynamic and rewrite-driven pages Yoast cannot edit in its UI.
How to make one fixed WordPress URL serve the content of a different page or post with no 301 redirect, so the address never changes. Uses add_rewrite_rule (or the request filter) plus the canonical handling you must not skip.
Read your own GA4 metrics server-side from WordPress: a Google Cloud service account, the google/analytics-data PHP client, a te_ga4_run_report() wrapper around runReport, plus caching and credential hygiene.
Drop the /docs/ section slug and serve a custom post type from the site root: the post_type_link filter to render the short URL, the add_rewrite_rule that resolves it, a 301 for old paths, and the collision caveat nobody warns you about.
How add_rewrite_endpoint() bolts a /reviews/ segment onto the end of an existing WordPress permalink, what the EP_* masks scope it to, and how to read the value without tripping the empty-string gotcha.
A diagnostic checklist for WordPress rewrite rules that won't fire: forgetting to flush, an unregistered query var, rule order, regex anchors, and how to inspect reality with wp rewrite list and parse_request.
Route WordPress email through SendGrid's SMTP relay with the phpmailer_init hook, keep the API key in wp-config.php, and stop transactional mail landing in spam.
How to build /service/city/ landing page URLs in WordPress with add_rewrite_rule and a custom template, plus the honest E-E-A-T warning about when this crosses into doorway pages Google penalizes.
Serve geographic URLs like /california/ and /california/los-angeles/ from the WordPress root: a location CPT, a state/city taxonomy, two add_rewrite_rule patterns mapping path segments to query vars, and pre_get_posts to load the right listings without thin pages.
On a WordPress site with hundreds of thousands of URLs, building the sitemap on every request is expensive. Generate static sitemap files with a WP-CLI command instead: chunked to 50,000 URLs, written to disk, and regenerated on a schedule.
Generate a WordPress table of contents from your post headings with no plugin: a the_content filter that injects heading ids, builds a nav of anchor links, scrolls smoothly with CSS, and caches the result in a transient.
How to schedule a recurring task in WordPress with wp_schedule_event(), add a custom interval via the cron_schedules filter, guard it with wp_next_scheduled(), and when to ditch WP-Cron for a real system cron.
How to disable jQuery Migrate in WordPress: remove the jquery-migrate dependency on the front end so the compatibility shim stops loading, plus the testing step that tells you whether it is safe.
Two ways to inline CSS in WordPress: attach it to an enqueued handle with wp_add_inline_style, or echo a minified <style> block on wp_head. When inlining critical CSS helps, and when it just bloats every page.
How to dequeue the wp-block-library CSS in WordPress, and the one big caveat: do it only on a site whose front end uses no block markup, or you break your layout.
Editing a taxonomy term does not refresh the posts that cache term-derived data. Hook saved_term, re-save the attached posts, and bust the stale output, carefully and at scale.
Remove unused WordPress head output with a configurable plugin. Keep feeds and consumed embeds working, preserve cache-busting, and test each change.
How to disable Dashicons on the WordPress front end: dequeue the dashicons stylesheet for logged-out visitors only, so the admin icon font stops loading on pages that never use it.
WordPress stuck on "Briefly unavailable for scheduled maintenance" means a .maintenance file got left behind by an interrupted update. Delete it and the site comes back.
Rank Math's free tier covers roughly what Yoast Premium does, schema support is broader, and the plugin is lighter on resources. Yoast still has brand recognition and a more guided editor flow. The honest agency comparison, by feature, performance, schema, pricing, and migration cost.
Bluehost has the WordPress.org recommendation and the lowest entry-tier price in mainstream hosting. The honest take on where Bluehost legitimately fits in 2026, the real operational ceiling, and the migration path for sites that outgrow it.
Cloudways is the agency host that gives you VPS flexibility with managed-WordPress simplicity, at a per-site price closer to shared hosting. The honest take on what that hybrid actually means in practice, plus the DigitalOcean acquisition implications.
Kinsta is the premium managed WordPress host most agencies eventually consider. The honest take: where the value justifies the price, where it does not, the agency partner program math, and the alternatives at each tier.
Rocket.net is the newer managed WordPress entrant that has gained agency mindshare for performance and Cloudflare Enterprise inclusion. The honest take on speed, pricing, the developer experience, and where Rocket.net wins or loses against the established hosts.
WP Engine is the most-recognized managed WordPress host and the default pick for many agencies. The honest take on performance, support, the agency partner program, the recent ACF acquisition implications, and where WP Engine wins or loses against alternatives.
Hosting is one of the most leveraged decisions an agency makes for margin. The honest math: hosting markup as recurring revenue, operational time as hidden cost, the per-client profit comparison across the four hosting tiers.
Managed WordPress hosting buys you operational simplicity at a per-site price premium. VPS buys you flexibility and lower per-resource cost at the price of in-house sysadmin time. The honest comparison and the agency-side break-even math.
Self-hosting WordPress as an agency is one of the most consequential operational decisions you can make. The four conditions under which self-hosting is the right call, the four under which it is a mistake, and the honest math on the long-term cost.
Hosting choices for WordPress agency clients are operational decisions, not pricing decisions. The decision tree by traffic tier and workload type: shared, managed WordPress, managed VPS, self-managed VPS. Plus the agency-side implications of each.
A few naming conventions for ACF field groups, field names, and field keys keep a multi-year codebase navigable: snake_case names, hierarchy-encoded keys, post-type prefixes, sub-field consistency. The cost is zero; the benefit compounds.
Register ACF Options Pages, organize child screens, read and update values, choose permissions, and diagnose missing pages without confusing storage and menus.
Diagnose ACF editor and frontend slowness with measured query, memory and rendering checks. Improve repeaters and field architecture without invented limits.
ACF Select fields have a Default Value setting in the field group editor that handles the simple case. For dynamic defaults (computed from another field, role-based, or per-post-type), the acf/load_value filter is the right tool.
Gravity Forms does not natively submit Repeater-shaped data, but three patterns handle the common cases: append-per-submission, single submission with grouped sections, and a custom JSON-encoded field. Here is each with code.
Gravity Forms can create WordPress posts on submission, but mapping form fields to ACF fields requires a hook. The canonical pattern uses gform_after_submission to call update_field. Plus the dedicated Gravity Forms + ACF plugin path.
Divi's Dynamic Content lets editors bind ACF field values to module properties without leaving the visual builder. The setup, the patterns that work for Text and Image fields, the limits for Repeater and Flexible Content, and the custom-shortcode escape hatch.
Elementor Pro's Dynamic Tags integration with ACF is the mature reference for binding custom field values to widget properties. Coverage for every field type, including Repeater via the Loop widget, and the Theme Builder integration for archive templates.
Build an ACF Flexible Content dispatcher with template parts, nested repeater fields, escaped output and programmatic values. Fix blank output and loop errors.
An editor-curated related posts system on ACF Relationship is three pieces: a field group, a render partial, and an optional fallback to algorithmic related posts when the editor hasn't picked any. Here is the working template.
ACF Relationship fields preserve order in the editor and in the stored array, but lose it when you pass the IDs to WP_Query. The fix: post__in plus orderby=post__in, every time. Plus when ACF returns objects vs IDs.
ACF Relationship fields let editors pick from any post type by default. The Post Type filter in the field group editor restricts the choice list. For dynamic filtering (taxonomy, status, ACF field), the acf/fields/relationship/query filter is the right tool.
Counting ACF Repeater rows is three short patterns: count() on the raw field, get_field_count() inside a loop, and a faster meta-only count that skips loading the rows. Each has its right use case.
ACF True/False fields store 1 or 0 in the database but appear as booleans in PHP. Loose-comparison bugs, empty-row defaults, conditional logic visibility, and meta_query gotchas are the four causes of unexpected behavior. Here is the fix for each.
ACF Checkbox fields return arrays because they support multiple selections. The shape varies by Return Format. Here's what each option returns, the patterns for rendering and querying, and when to switch to a Select or Radio field instead.
acf/save_post is the hook that fires after ACF saves a post's custom fields. Useful patterns: derived field computation, taxonomy sync, search-index refresh, ACF-to-meta mirroring, validation, audit logging. Plus the gotchas.
update_field() is the canonical way to write ACF data programmatically: the function signature, how to write to Repeater and Flexible Content fields, when to use field keys instead of names, options pages and user meta, and the gotchas that bite.
ACF's get_field() returning empty or false has eight common causes. The diagnostic order: field name typo, post context, location rules, field group not assigned, sub-field confusion, get vs the, caching, permissions.
Choose the right ACF Image return format, render responsive images, handle alt text accessibly, and migrate templates without changing stored attachment IDs.
An ACF Repeater where the first row's data looks blank is almost always one of three things: missing the_row(), incorrect sub-field name, or accidental data overwrite via update_field with the wrong field reference.
ACF and Gutenberg are not competing for the same job. The honest agency take: where Gutenberg wins, where ACF Flexible Content still wins, and how to decide for a fresh project in 2026.
I am a custom-development-first engineer. But for most agency client work in 2026, fully custom themes are the wrong economic choice. The honest case for picking reusable systems over from-scratch builds.
Divi and Elementor are both legitimate agency picks. The honest comparison: workflow speed, ecosystem depth, hiring availability, client handoff, performance, lock-in, and which fits which agency shape.
What I'd actually do if I were starting a WordPress agency today: client acquisition, recurring revenue, hosting, maintenance, outsourcing, AI workflows, and the operational mistakes that kill small shops.
If I were starting a small WordPress agency today: the page builders, plugins, hosting, forms, SEO, backups, image optimization, and AI tooling I'd actually choose, with the reasoning behind each pick.
I do not reach for Divi by default, but I have watched small teams ship 40-page sites in a week with it. The operational case for Divi in 2026: speed, ecosystem, hiring, client handoff, and the criticisms that have aged poorly.
ElasticPress is powerful and, for most WordPress sites, unnecessary. Here is a straight checklist: the signals that mean you genuinely need it, the hidden costs, and the cheaper options to try first.
MySQL FULLTEXT search is built in and free of moving parts. ElasticPress adds a real search engine. Here is a practitioner comparison: relevance, typo tolerance, faceting, scale, and the cost each one carries.
ElasticPress officially supports Elasticsearch, not OpenSearch. OpenSearch can be coaxed into basic functionality, but 10up does not recommend it for production. Here is the real status and what to run.
A WooCommerce store slows down for specific, structural reasons. Here is the layered fix: hosting, page caching, object caching, the database, search, and the front end, and why one layer alone is never enough.
Wordfence, Sucuri, and every in-WordPress security plugin can be disabled by malware running with the same privileges. The fix is monitoring at a layer the attacker can't touch: AIDE, maldet, or a custom cron-driven script running as root. With working configurations for each.
wp-config.php is the first PHP file WordPress loads. The defaults from the stock installation are minimal; the hardened defaults take five minutes to apply and close most of the attack surface that lives below the plugin layer. A complete annotated template covering disabled file editing, forced HTTPS, secure salt rotation, debug behavior, and the file permissions that matter.
The backup plugin running inside WordPress is the same WordPress the attacker just compromised. A 3-2-1 backup strategy with restic or borg, stored outside the trust boundary, and verified by monthly test restores. Configuration, retention, and the exact restore sequence after a compromise.
A cleanup that doesn't identify the entry point is temporary. The methodical access-log analysis that finds exactly which plugin CVE, credential vector, or upload path got the attacker in, with the grep one-liners, the timestamp correlation against file modification times, and the cases where the entry is in a log other than the access log.
Fake administrator accounts that appear in wp_users without anyone creating them are one of the most common signs of a WordPress compromise. The detection SQL, the SQL that finds the mechanism that's creating them, and the cleanup that has to happen at both the user level and the persistence level for the account creation to stop.
Visitors to your WordPress site see a fake 'Cloudflare verification' page telling them to paste a command into Windows Run or Terminal. That's ClickFix, the social-engineering campaign that first appeared in early 2024 and exploded across compromised WordPress sites by autumn. What it does, where the injection lives in your site, and how to clean it without missing the persistence.
WordPress malware that survives cleanups isn't stronger malware; it's malware with persistence. A complete catalog of where attackers hide the re-infection logic, wp_options autoload, WP-Cron, server crontab, .htaccess auto_prepend, mu-plugins, drop-ins, custom REST endpoints, and modified wp-config, with detection scripts for each.
WordPress security plugins running inside WordPress can be disabled by anything that runs inside WordPress, including the malware they're supposed to catch. The four mechanisms attackers use to silently turn off Wordfence, Sucuri, Jetpack, WP Activity Log, and similar tools, plus the server-side monitoring layer that doesn't depend on WordPress being trustworthy.
If one site in a shared hosting account gets compromised, every other site under the same Linux user is at risk. Cleaning a single site without addressing the shared file system leaves the door open for reinfection from any sibling site. The structural problem and the realistic fixes, open_basedir, suEXEC, isolated users, and when to move hosts.
A step-by-step methodology for finding and removing malware from a compromised WordPress site, written by a Security+ certified engineer who's been cleaning sites since the early WordPress 2.x era. Covers every attack vector: file backdoors, database injections, .htaccess hijacks, wp-config tampering, and recurring reinfection. Originally written in 2016, updated regularly as new patterns emerge.
Four reliable ways to change a WordPress password: admin dashboard, WP-CLI, directly in the database with the correct phpass or bcrypt hash, and the lost-password email reset.
Remove the gsyndication malware (sync.gsyndication.com and async.gsyndication.com) that injects a script into wp-config.php, find the hidden process, cron, and database entries that keep reinfecting it, and clean it for good.
Wire ElasticPress to WP_Query so WordPress queries hit Elasticsearch instead of MySQL. Covers installation, indexable post types, ep_integrate, the wp-cli index command, faceted search with aggregations, and when ES actually beats MySQL FULLTEXT.
How to add AMP support to WordPress custom post types using the official Automattic AMP plugin, with a 2026 reality check on whether AMP is still worth the engineering investment.
How to fix the 'Call to undefined function get_option()' fatal error in WordPress. Covers premature WP function calls, the wp-load.php bootstrap, the modern WP-CLI alternative, and the plugin-developer checklist.
Use the built-in WordPress comment-moderation regex fields and the pre_comment_approved filter to approve, hold, spam, or trash comments based on PCRE patterns.
How to send HTML emails from WordPress with wp_mail and the wp_mail_content_type filter. Covers SMTP setup, deliverability with SPF, DKIM, and DMARC, and modern transactional providers like SendGrid, Postmark, and Resend.
Fix wp_insert_post OOMs during bulk imports: chunk in batches, flush the object cache, defer term/comment counting, suspend cache invalidation, disable revisions, and (where appropriate) bypass the WordPress API with direct $wpdb writes.