COURSES + FIELD NOTES 11 courses · 8 disciplines EST. 2024

From a first script to a service in production.

WPSifero publishes courses and technical writing about programming. Five language courses — Python, JavaScript and TypeScript, PHP, SQL and Go — run from your first program to the parts you only meet under real traffic. Five more go deep into WordPress and WooCommerce, because that is where the two hardest things in this trade meet: a codebase you did not write, and a database under load.

Every course is text. No video, nothing to scrub through, nothing to re-watch at half speed. You read a lesson, type the code yourself, and finish with something that runs.

Browse the courses Read the articles

Curriculum status

$ wpsifero --curriculum

[ OK ]Go 1.24+18/18

[ OK ]Node 22 LTS+18/18

[ OK ]PHP 8.3+18/18

[ OK ]Python 3.12+18/18

[ OK ]MySQL · PostgreSQL · SQLite18/18

[ OK ]WordPress 7.0 · WooCommerce 11.218/18

[ OK ]WooCommerce 11.218/18

[ OK ]WordPress 7.018/18

[ OK ]WordPress 7.0 · Redis18/18

[ OK ]WordPress 7.018/18

[ OK ]WordPress 7.0 · PHP 8.3+18/18

$ _

Courses: 11
Lessons: 198
Articles: 045
Reading time: 115H 54M

01 Sector map

What you will find here

Three shelves: the languages, the platform, and the disciplines that apply to all of it.

LANG

The languages

Five courses, each running from your first program to the parts that only show up in production. Text, with a lab and a worked solution in every lesson.

Open the language courses

WP

WordPress and WooCommerce

The platform that runs a large share of the web, written against WordPress 7.0 and WooCommerce 11.2 rather than against tutorials from three versions ago.

Open the WordPress courses

DISC

The disciplines

The subjects that do not care which language you write: query budgets, cache invalidation, REST contracts, capability checks, accessibility, tooling.

Browse the articles

01 Lead transmission

This month's deep dive

Long-form work where the measurement matters more than the opinion.

Topic: WOO
Section: WooCommerce & Storefront
Published: 06 OCT 2026
Reading time: 7 MIN
Words: 1977W

Building Order Tracking in WooCommerce Without a Tracking Subscription

Most post-purchase support tickets are "where is my order". Here is the plugin architecture that answers them without shipping customer data to a tracking service.

Ana Ferreiro · @aferreiro

WooCommerce engineering

Covers the WooCommerce order lifecycle: checkout, HPOS, session handling, transactional email and the post-purchase layer where most storefront complaints actually originate.

Read the full analysis

02 Curriculum

Courses you read, not watch

11 complete text courses, 198 lessons, no video. Written to be read at your own pace and typed out rather than copied.

DEV05 COURSES

Programming track

Language and platform courses that start at a first script and end at the parts you only meet in production.

Go for Backend Services18 lessons · 10H 30M
JavaScript and TypeScript, from Script to Application18 lessons · 10H 15M
Modern PHP, from Syntax to Services18 lessons · 9H 21M
Python from First Script to Service18 lessons · 9H 25M
SQL and Relational Database Design18 lessons · 11H 10M

WP06 COURSES

WordPress track

Courses built against WordPress 7.0 and WooCommerce 11.2, covering plugin and block development through to performance and security.

Building the Sifero Courier Timeline Plugin18 lessons · 8H 50M
WooCommerce Extension Development18 lessons · 10H 35M
WordPress Block Themes and Full Site Editing18 lessons · 10H 00M
WordPress Performance and Scaling18 lessons · 10H 25M
WordPress Plugin Development18 lessons · 8H 45M
WordPress Security and Hardening18 lessons · 10H 45M

Open the course catalogue How this material is written

02 Transmission log

Latest articles

Newest first. Every entry is tagged by discipline and carries an estimated reading time.

001 Blocks That Break After an Update, and Why save() Is the Reason A save() function whose output changes without a matching deprecated entry makes the editor call the block invalid. Here is the reproduction and the fix. WP Devon Parker 16 OCT 2026 · 8M 002 Your Security Headers Are Not Being Sent, and WordPress Is Why Core emits frame, referrer and nosniff headers only on admin and login routes. Here is what each route actually sends, measured on WordPress 7.0.7. SEC Tomas Lindqvist 15 OCT 2026 · 8M 003 401 or 403? What the WordPress REST API Is Telling You The two codes mean different things and the difference is the debugging path. Real responses for nonces, cookies, app passwords and permission callbacks. API Devon Parker 12 OCT 2026 · 7M 004 Uploads That 403, and the Permission Advice That Causes It The 755/644 advice is right in the abstract and wrong on most hosts. Here is the ownership model that decides whether uploads work in WordPress 7.0.7. INFRA Martin Kiel 09 OCT 2026 · 8M 005 Tracking Pages That Work When JavaScript Does Not Run A tracking page should answer the question before any script runs. That means a real form, a stable URL and a server-rendered result, with JavaScript added on top. FE Priya Raghunathan 01 OCT 2026 · 8M 006 WP-Cron Fires When a Visitor Arrives, Not When the Clock Says So WP-Cron is a request-triggered scheduler. What wp-cron.php does on a quiet site versus a busy one, and where the pattern stops being enough. WP Martin Kiel 29 SEP 2026 · 8M 007 Idempotency Keys for a POST Endpoint That Must Survive Retries A client that times out cannot know whether the write committed, so it retries. A unique key and a stored response are what make that retry harmless. API Devon Parker 24 SEP 2026 · 8M 008 The wp_options Autoload Flag, and the Rows That Tax Every Request Autoloaded options are read on every uncached request, not only on admin screens. Here is the query that finds the expensive rows and what to do with each kind. PERF Martin Kiel 18 SEP 2026 · 7M 009 The Capability Checks People Forget at Three Entry Points REST routes, admin-ajax handlers and admin-post actions each need their own guard. Here is the check each one requires and why the admin menu is not protection. SEC Tomas Lindqvist 15 SEP 2026 · 7M

Open the complete index (45 articles)

04 Sector map

Topics

Eight disciplines, each with its own archive and its own set of recurring failure modes.

WP06

WordPress Internals

Hooks, the database layer, cron, and the parts of core that decide how your plugin behaves under load.

WOO05

WooCommerce & Storefront

Order lifecycle, checkout, HPOS, sessions and the post-purchase communication layer.

PERF05

Performance

Query budgets, object caching, Core Web Vitals and measuring before you optimise.

API06

APIs & Integrations

REST design, webhooks, authentication, idempotency and talking to couriers and ERPs.

SEC06

Security & Hardening

Capability checks, nonces, sanitisation, SQL safety and threat modelling for plugins.

FE05

Frontend & Accessibility

Block themes, progressive enhancement, ARIA, and interfaces that work without JavaScript.

TOOL06

Tooling & Workflow

Local environments, static analysis, CI, release packaging and debugging technique.

INFRA06

Hosting & Infrastructure

Server configuration, caching layers, queues, observability and deployment practice.

05 Operating principle

What we publish, and what we refuse to

This section exists so readers and reviewers can hold us to a stated standard.

Every claim is reproducible

Performance numbers come from a stated environment. We publish the query count, the cache state and the sample size, because a benchmark without its conditions is an advertisement rather than a measurement.

Disagreement is documented

Where a recommended pattern has a cost, that cost appears in the same article rather than a follow-up. If an approach fails past a certain order volume, we say at which volume it fails.

No undisclosed interests

WPSifero maintains its own plugins. Whenever an article touches a product we build, the relationship is disclosed inside that article, at the top, in plain language.

Read the full editorial standards