Building, hardening, and unbreaking WordPress without losing weekends to plugin updates.
Thousands of hits to wp-admin/admin-ajax.php are almost always your own site: WordPress Heartbeat and plugins, not a DDoS. How to read the action parameter, when it is a real attack, and why blocking the file breaks your site.
What 'Discovered - currently not indexed' and 'Crawled - currently not indexed' actually mean in Google Search Console, why they are usually normal, and why spamming Request Indexing does nothing.
Thousands of ?replytocom= URLs in Search Console come from WordPress comment reply links. Why they are already nofollow and canonicalized, and why blocking them in robots.txt is the one fix that backfires.
Thousands of ?wordfence_lh=1&hid= URLs in Google Search Console come from Wordfence's Live Traffic feature. The setting that stops them, the check to run first, and why robots.txt is the wrong fix.
When the built-in CSV importer is not enough, a WP-CLI command reads a sheet or CSV and creates WooCommerce products through the CRUD. Idempotent by SKU, dry-run by default, so re-running the same file never duplicates.
Run a site-wide or category sale from a sheet of sku, sale_price, start and end dates. A WP-CLI command reads the sheet, sets scheduled sale dates through the WooCommerce CRUD, and lets WooCommerce flip and unflip the price on its own. Dry-run and change-only.
Pull a supplier sheet of SKU, price, and stock into WooCommerce and apply each row through the product CRUD. A WP-CLI command with a service account, change-only writes, and a dry run, plus why writing _price directly is the bug that bites you later.
Maintain SEO titles and meta descriptions in a Google Sheet and have a WP-CLI command write them into Yoast or Rank Math. Pull model, change-only, dry-run by default. No opening each post in the editor.
Keep a directory of thousands of listings in sync with a Google Sheet a non-dev maintains: a WP-CLI pull command that reconciles each listing change-only, parses structured hours, and flips permanently-closed places to a closed status instead of deleting them.
Keep events (title, dates, venue, sold-out flag, ticket URL) in a Google Sheet and have WordPress pull them into an event CPT on a cron. Dates stored as sortable Y-m-d H:i:s, change-only, dry-run by default, so the calendar maintains itself.
Run a fleet of WordPress installs from a single Google Sheet: a website column per row, a small controller that groups the rows by site and pushes each batch to that site's endpoint, and partial-failure handling so one dead site never blocks the rest.
A custom write endpoint accepts changes from the open internet. Harden it step by step: header secret, constant-time compare, HMAC signatures, replay protection, rate limiting, secret out of the repo, and a hidden route.
The pull model: have WordPress read a Google Sheet itself with a service account and apply each row to a custom field. A WP-CLI command, no Apps Script, no button, dry-run and change-only built in.
A bulk custom-field update with no undo is one typo away from wrecking thousands of posts. Here is a safe pattern (and a downloadable WP-CLI command) with a dry run, a backup gate, a change-only changelog, and idempotent writes.
ACF and native post meta both write to the same wp_postmeta table. Here is what register_post_meta gives you, what ACF adds on top, and the read/write rules so a bulk script and a content editor never fight over the same field.
The right way to run a one-off bulk operation across thousands of WordPress posts: a wp eval-file script with caches suspended, queries batched, and the object cache flushed in the loop so memory doesn't blow up.
How to add a custom sitemap to Yoast SEO so rewrite-driven pages with no WordPress post still get indexed: append a <sitemap> to the index with wpseo_sitemap_index, register a named sitemap, and generate its <url> entries.
How to add a custom rewrite rule in WordPress with add_rewrite_rule: the regex, the index.php query target, registering the query var so it actually populates, loading a template, and flushing once without flushing on every request.
Intercept requests that would 404 in WordPress on template_redirect, then resolve them to real content with status_header(200), 301 to the right URL with wp_safe_redirect(), or let them fall through. A fallback router for dynamic and legacy slugs you cannot enumerate.
How to build a custom product URL structure in WooCommerce: change or remove the /product/ and /shop/ bases from Settings > Permalinks, do it in code with a permalink filter plus add_rewrite_rule, and avoid the 404 collisions that come from a base-less product slug.
How to add a custom WordPress REST API endpoint with register_rest_route: the namespace convention, methods, the required permission_callback, args validation and sanitization, and returning WP_REST_Response or WP_Error.
Keep API keys, database credentials, and SMTP secrets out of wp-config.php and out of git by loading them from a .env file with vlucas/phpdotenv, fed into define() where WordPress expects constants.
Embed a Google map in WordPress without tanking your load time: the free Maps Embed API iframe with loading="lazy", a te_map shortcode that escapes its output, an HTTP-referrer-locked API key, and a click-to-load consent pattern.
How to build three-level /make/model/year/ URLs in WordPress with add_rewrite_rule, custom query vars, and a vehicle CPT, plus the static-prefix collision that breaks the naive rule. Works the same on a catalog of brand/series/model or category/sub/sku.
How to override Rank Math's SEO title and meta description in PHP using the rank_math/frontend/title and rank_math/frontend/description filters, plus the canonical and Open Graph filters, with conditional per-context overrides for rewrite-driven pages.
Hooking pre_get_document_title does nothing once Yoast or Rank Math is active: the plugin owns the title and meta description tags. Here is which filter to hook for Yoast, Rank Math, and core, plus a portable helper that detects the active plugin.
Override Yoast SEO's title, meta description, canonical, and Open Graph/Twitter tags in PHP using the wpseo_title and wpseo_metadesc filters, with per-context conditionals for dynamic and rewrite-driven pages Yoast cannot edit in its UI.
Read your own GA4 metrics server-side from WordPress: a Google Cloud service account, the google/analytics-data PHP client, a te_ga4_run_report() wrapper around runReport, plus caching and credential hygiene.
A diagnostic checklist for WordPress rewrite rules that won't fire: forgetting to flush, an unregistered query var, rule order, regex anchors, and how to inspect reality with wp rewrite list and parse_request.
Route WordPress email through SendGrid's SMTP relay with the phpmailer_init hook, keep the API key in wp-config.php, and stop transactional mail landing in spam.
How to build /service/city/ landing page URLs in WordPress with add_rewrite_rule and a custom template, plus the honest E-E-A-T warning about when this crosses into doorway pages Google penalizes.
On a WordPress site with hundreds of thousands of URLs, building the sitemap on every request is expensive. Generate static sitemap files with a WP-CLI command instead: chunked to 50,000 URLs, written to disk, and regenerated on a schedule.
How to dequeue the wp-block-library CSS in WordPress, and the one big caveat: do it only on a site whose front end uses no block markup, or you break your layout.
What WordPress prints in wp_head by default, which tags and scripts are safe to remove, and one must-use plugin that strips the emoji, shortlink, feed, oEmbed, and version bloat in one place.
How to disable Dashicons on the WordPress front end: dequeue the dashicons stylesheet for logged-out visitors only, so the admin icon font stops loading on pages that never use it.
How to disable WordPress oEmbed: stop the discovery links, the wp-embed.js script, the oEmbed REST route, and the /embed/ URLs, while keeping the YouTube-style embeds you paste in posts working.
How to remove WordPress feed links from the head with remove_action, plus the deeper step most guides skip: killing the /feed/ rewrite rules and redirecting the URLs so they stop getting crawled.
How to remove the WordPress rel=shortlink: a small remove_action snippet that strips the <link rel='shortlink'> from the head and the matching Link: HTTP header.
How to disable WordPress emojis: a small functions.php snippet that strips the wp-emoji-release.min.js script, the inline detection JS, and the emoji styles from every page.
Rank Math's free tier covers roughly what Yoast Premium does, schema support is broader, and the plugin is lighter on resources. Yoast still has brand recognition and a more guided editor flow. The honest agency comparison, by feature, performance, schema, pricing, and migration cost.
Bluehost has the WordPress.org recommendation and the lowest entry-tier price in mainstream hosting. The honest take on where Bluehost legitimately fits in 2026, the real operational ceiling, and the migration path for sites that outgrow it.
Kinsta is the premium managed WordPress host most agencies eventually consider. The honest take: where the value justifies the price, where it does not, the agency partner program math, and the alternatives at each tier.
WP Engine is the most-recognized managed WordPress host and the default pick for many agencies. The honest take on performance, support, the agency partner program, the recent ACF acquisition implications, and where WP Engine wins or loses against alternatives.
Managed WordPress hosting buys you operational simplicity at a per-site price premium. VPS buys you flexibility and lower per-resource cost at the price of in-house sysadmin time. The honest comparison and the agency-side break-even math.
Hosting choices for WordPress agency clients are operational decisions, not pricing decisions. The decision tree by traffic tier and workload type: shared, managed WordPress, managed VPS, self-managed VPS. Plus the agency-side implications of each.
ACF Flexible Content plus template parts plus a shared component library is effectively a lightweight component system for WordPress. The patterns: one component per layout, props via sub-fields, composition over inheritance, and how it compares to React-based alternatives.
A few naming conventions for ACF field groups, field names, and field keys keep a multi-year codebase navigable: snake_case names, hierarchy-encoded keys, post-type prefixes, sub-field consistency. The cost is zero; the benefit compounds.
ACF performance problems at scale almost always trace to one of six things: missing object cache, oversized Repeaters, deeply nested Flexible Content, meta_query usage on ACF fields, too many fields per post type, or the field-key reference overhead. Here is what to look for and fix in each.
ACF Select fields have a Default Value setting in the field group editor that handles the simple case. For dynamic defaults (computed from another field, role-based, or per-post-type), the acf/load_value filter is the right tool.
Elementor Pro's Dynamic Tags integration with ACF is the mature reference for binding custom field values to widget properties. Coverage for every field type, including Repeater via the Loop widget, and the Theme Builder integration for archive templates.
The template-parts pattern for ACF Flexible Content: one PHP partial per layout, one dispatcher loop, zero switch statements. The directory structure, the loop, the data-passing, and the agency-scale benefits.
get_row_layout() returns the current layout's name inside an ACF Flexible Content loop. Plus the canonical dispatch pattern using template parts, the switch-based pattern, and what to do when get_row_layout returns nothing.
ACF Relationship fields preserve order in the editor and in the stored array, but lose it when you pass the IDs to WP_Query. The fix: post__in plus orderby=post__in, every time. Plus when ACF returns objects vs IDs.
Large ACF Repeaters (100+ rows) slow down WordPress because each sub-field is a separate wp_postmeta row. The fixes: persistent object cache, fewer reads, direct-meta count, or moving the data out of Repeater into a custom table or separate post type.
Counting ACF Repeater rows is three short patterns: count() on the raw field, get_field_count() inside a loop, and a faster meta-only count that skips loading the rows. Each has its right use case.
ACF True/False fields store 1 or 0 in the database but appear as booleans in PHP. Loose-comparison bugs, empty-row defaults, conditional logic visibility, and meta_query gotchas are the four causes of unexpected behavior. Here is the fix for each.
ACF Checkbox fields return arrays because they support multiple selections. The shape varies by Return Format. Here's what each option returns, the patterns for rendering and querying, and when to switch to a Select or Radio field instead.
Getting alt text from an ACF Image field depends on the field's Return Format. Image Array gives you the alt directly. ID and URL formats need a wp_get_attachment helper. Plus the cleanest pattern for always-correct alt output.
The cleanest pattern for responsive images from an ACF Image field: ID return format plus wp_get_attachment_image, which produces a complete srcset and sizes attribute from registered image sizes. Plus the manual srcset pattern when you need control.
acf/save_post is the hook that fires after ACF saves a post's custom fields. Useful patterns: derived field computation, taxonomy sync, search-index refresh, ACF-to-meta mirroring, validation, audit logging. Plus the gotchas.
update_field() is the canonical way to write ACF data programmatically: the function signature, how to write to Repeater and Flexible Content fields, when to use field keys instead of names, options pages and user meta, and the gotchas that bite.
ACF Flexible Content loops fail silently in five predictable ways: missing have_rows, wrong context, missing the_row inside the loop, post ID confusion, and nested loops. Here's the fix for each.
ACF's get_field() returning empty or false has eight common causes. The diagnostic order: field name typo, post context, location rules, field group not assigned, sub-field confusion, get vs the, caching, permissions.
ACF Image fields can return an array, a URL string, or just the attachment ID. The return format is a per-field setting. Here's what each option returns, when to pick which, and the cleanest pattern for responsive images.
An ACF Options Page that does not appear in wp-admin almost always traces to one of four things: missing acf_add_options_page() call, ACF Pro vs free version, location rules, or current_user_can capability mismatch.
An ACF Repeater where the first row's data looks blank is almost always one of three things: missing the_row(), incorrect sub-field name, or accidental data overwrite via update_field with the wrong field reference.
ACF and Gutenberg are not competing for the same job. The honest agency take: where Gutenberg wins, where ACF Flexible Content still wins, and how to decide for a fresh project in 2026.
I am a custom-development-first engineer. But for most agency client work in 2026, fully custom themes are the wrong economic choice. The honest case for picking reusable systems over from-scratch builds.
What I'd actually do if I were starting a WordPress agency today: client acquisition, recurring revenue, hosting, maintenance, outsourcing, AI workflows, and the operational mistakes that kill small shops.
If I were starting a small WordPress agency today: the page builders, plugins, hosting, forms, SEO, backups, image optimization, and AI tooling I'd actually choose, with the reasoning behind each pick.
ElasticPress officially supports Elasticsearch, not OpenSearch. OpenSearch can be coaxed into basic functionality, but 10up does not recommend it for production. Here is the real status and what to run.
A WooCommerce store slows down for specific, structural reasons. Here is the layered fix: hosting, page caching, object caching, the database, search, and the front end, and why one layer alone is never enough.
Wordfence, Sucuri, and every in-WordPress security plugin can be disabled by malware running with the same privileges. The fix is monitoring at a layer the attacker can't touch: AIDE, maldet, or a custom cron-driven script running as root. With working configurations for each.
A cleanup that doesn't identify the entry point is temporary. The methodical access-log analysis that finds exactly which plugin CVE, credential vector, or upload path got the attacker in, with the grep one-liners, the timestamp correlation against file modification times, and the cases where the entry is in a log other than the access log.
Visitors to your WordPress site see a fake 'Cloudflare verification' page telling them to paste a command into Windows Run or Terminal. That's ClickFix, the social-engineering campaign that first appeared in early 2024 and exploded across compromised WordPress sites by autumn. What it does, where the injection lives in your site, and how to clean it without missing the persistence.
WordPress malware that survives cleanups isn't stronger malware; it's malware with persistence. A complete catalog of where attackers hide the re-infection logic, wp_options autoload, WP-Cron, server crontab, .htaccess auto_prepend, mu-plugins, drop-ins, custom REST endpoints, and modified wp-config, with detection scripts for each.
A step-by-step methodology for finding and removing malware from a compromised WordPress site, written by a Security+ certified engineer who's been cleaning sites since the early WordPress 2.x era. Covers every attack vector: file backdoors, database injections, .htaccess hijacks, wp-config tampering, and recurring reinfection. Originally written in 2016, updated regularly as new patterns emerge.
Four reliable ways to change a WordPress password: admin dashboard, WP-CLI, directly in the database with the correct phpass or bcrypt hash, and the lost-password email reset.
Remove the gsyndication malware (sync.gsyndication.com and async.gsyndication.com) that injects a script into wp-config.php, find the hidden process, cron, and database entries that keep reinfecting it, and clean it for good.
Wire ElasticPress to WP_Query so WordPress queries hit Elasticsearch instead of MySQL. Covers installation, indexable post types, ep_integrate, the wp-cli index command, faceted search with aggregations, and when ES actually beats MySQL FULLTEXT.
How to add AMP support to WordPress custom post types using the official Automattic AMP plugin, with a 2026 reality check on whether AMP is still worth the engineering investment.
How to fix the 'Call to undefined function get_option()' fatal error in WordPress. Covers premature WP function calls, the wp-load.php bootstrap, the modern WP-CLI alternative, and the plugin-developer checklist.
Use the built-in WordPress comment-moderation regex fields and the pre_comment_approved filter to approve, hold, spam, or trash comments based on PCRE patterns.
How to send HTML emails from WordPress with wp_mail and the wp_mail_content_type filter. Covers SMTP setup, deliverability with SPF, DKIM, and DMARC, and modern transactional providers like SendGrid, Postmark, and Resend.
Fix wp_insert_post OOMs during bulk imports: chunk in batches, flush the object cache, defer term/comment counting, suspend cache invalidation, disable revisions, and (where appropriate) bypass the WordPress API with direct $wpdb writes.