Practical guides on WordPress security, WooCommerce, Core Web Vitals, development and monitoring, checked against primary documentation before publishing.
Try· press / to search · typos are fine
71 articles
Performance8 min read
WordPress PHP workers: size them, spot saturation and use fewer
WordPress PHP workers are PHP-FPM child processes that execute uncached PHP requests, and pm.max_children caps how many a pool can serve at once. Size the pool from measured worker memory and available RAM, then confirm saturation with the PHP-FPM status page and logs before adding workers.
Development7 min read
End-to-end WordPress Playwright testing for editor, admin and checkout
WordPress Playwright testing lets a browser verify the editor, wp-admin, and checkout paths that a release depends on. Run those flows against wp-env, reuse a saved admin session, keep test data fixed, and save traces and screenshots when CI fails.
Development5 min read
WordPress plugin database migrations with dbDelta, done safely
WordPress plugin database migrations should compare a stored schema version with the version your plugin expects, then run only the missing steps. Use dbDelta() for table creation and supported schema changes, and use explicit, guarded migrations for destructive or unsupported changes.
Security8 min read
WordPress plugin supply chain security: when the update itself is the attack
WordPress plugin supply chain security treats the update channel itself as something you must verify, not just a way to receive fixes. Use trusted sources, inspect unusual releases, verify installed files, and stage updates so one bad package does not reach every site at once.
Development7 min read
WordPress plugin unit testing with wp-env and PHPUnit
WordPress plugin unit testing stays repeatable when pure PHP tests stay small and WordPress integration tests run in a wp-env environment. Set up wp-env, bootstrap the WordPress PHPUnit files through WP_TESTS_DIR, write tests with WP_UnitTestCase, then run the same command in GitHub Actions.
Monitoring8 min read
WordPress plugin vulnerability monitoring: from alert to fix
WordPress vulnerability monitoring works when you keep a current inventory of installed plugins and themes. Compare exact versions with trusted vulnerability data, then record what you did with each match.
Performance8 min read
WordPress REST API performance: find slow endpoints and make them fast
WordPress REST API performance improves when you measure the request first, reduce the work each endpoint does, and cache only responses that are safe to share. Start with time to first byte, then trace database queries, remote HTTP calls, response building, authentication and cache behavior before changing code.
Development7 min read
WordPress Script Modules: load ES modules the WordPress way
WordPress Script Modules are the core API for registering and loading front-end ES modules with named dependencies. Since WordPress 6.5, you can let WordPress build the import map, preload static module dependencies, and print the module entry point in the right order.
Security9 min read
WordPress security headers: what to set and how to test them
Add WordPress security headers at the web server or CDN when you can, then test them before enforcing a strict policy. HSTS and CSP can cause outages if you apply them blindly, so start conservatively, use CSP Report-Only first, and verify cached as well as uncached responses.