Skip to content
System nominalUTC --:--:--Articles 041

Complete article index

41 articles, newest first, grouped by publication month. Use the topic map if you would rather browse by discipline, or the search page to query titles, descriptions and tags directly.

2026 / OCTOBER

02 articles
Building Order Tracking in WooCommerce Without a Tracking Subscription Most post-purchase support tickets are "where is my order". Here is the plugin architecture that answers them without shipping customer data to a tracking service. WOO 06 OCT 2026 · 7M Tracking Pages That Work When JavaScript Does Not Run A tracking page should answer the question before any script runs. That means a real form, a stable URL and a server-rendered result, with JavaScript added on top. FE 01 OCT 2026 · 8M

2026 / SEPTEMBER

06 articles
WP-Cron Fires When a Visitor Arrives, Not When the Clock Says So WP-Cron is a request-triggered scheduler. What wp-cron.php does on a quiet site versus a busy one, and where the pattern stops being enough. WP 29 SEP 2026 · 8M Idempotency Keys for a POST Endpoint That Must Survive Retries A client that times out cannot know whether the write committed, so it retries. A unique key and a stored response are what make that retry harmless. API 24 SEP 2026 · 8M The wp_options Autoload Flag, and the Rows That Tax Every Request Autoloaded options are read on every uncached request, not only on admin screens. Here is the query that finds the expensive rows and what to do with each kind. PERF 18 SEP 2026 · 7M The Capability Checks People Forget at Three Entry Points REST routes, admin-ajax handlers and admin-post actions each need their own guard. Here is the check each one requires and why the admin menu is not protection. SEC 15 SEP 2026 · 7M The LCP Element on a Product Page Is Usually the Wrong Image What LCP measures on a product page, why the hero image usually loses to the product title, and which shifts you can actually fix. PERF 11 SEP 2026 · 8M What PHPStan Catches in a WordPress Plugin, and What It Misses PHPStan finds undefined variables and wrong argument counts in plugin code. It cannot see a wrong capability name, a filter arity bug or a SQL injection. TOOL 04 SEP 2026 · 8M

2026 / AUGUST

06 articles
What Actually Changes When WooCommerce Orders Leave Postmeta On a store that has moved to HPOS, get_post_meta returns nothing and a direct wp_postmeta query returns stale rows. Here is what to replace both with. WOO 31 AUG 2026 · 8M Why One update_post_meta() Call Empties Your Query Cache WP_Query caches its results, then a single metadata write clears the whole group. How to read that behaviour with SAVEQUERIES and what to turn off. WP 24 AUG 2026 · 7M Live Regions for Order Status, Announced Once and Not Twice A live region for order status fails in both directions. It either interrupts on every poll or never speaks at all, and the fix starts before the first update. FE 17 AUG 2026 · 7M Webhook Retries, and Why They Must Not Create a Second Order Senders retry because they cannot tell a slow receiver from a dead one. Here is the receiver that survives the fifth delivery of the same event. API 10 AUG 2026 · 8M Redis or Memcached: What the WordPress Object Cache Needs Both backends store the same WordPress keys. What decides the choice is eviction, restarts, shared servers and what wp_cache_flush really clears. INFRA 07 AUG 2026 · 8M A Nonce Proves Intent, and Never Permission to Act WordPress nonces are short-lived CSRF tokens, not permission checks. Where they fail, why the failure looks like a logout, and what to pair them with. SEC 03 AUG 2026 · 9M

2026 / JULY

04 articles
The Checkout That Forgets the Cart, and the Five Things That Cause It WooCommerce keeps the cart in a table row that a cookie points at. Here is the order to check when a customer's session disappears at checkout. WOO 23 JUL 2026 · 8M When wp_postmeta Stops Being the Right Place for Plugin Data Postmeta is correct for sparse per-object keys and wrong for range queries and aggregation. How to tell which one you have before the table outgrows the store. WP 16 JUL 2026 · 8M Building a Plugin Zip You Can Trust on Release Day A release script turns a working tree into a zip you can verify. The build order, the checks worth automating, and the property that makes them mean anything. TOOL 09 JUL 2026 · 8M Where $wpdb->prepare() Protects You, and Where It Cannot prepare() escapes each value and splices it into a query string. Here is what that contract covers, and the identifiers, wildcards and shapes it never touches. SEC 02 JUL 2026 · 9M

2026 / JUNE

04 articles
Versioning a Plugin REST API Without Breaking Other People's Code A version bump tells clients something changed but not what. How to tell additive changes from breaking ones, and how to retire a route on a schedule you publish. API 27 JUN 2026 · 7M The Thundering Herd When a Flash Sale Cache Entry Expires When one popular cache entry expires under load, every request recomputes the same value. Here is how to spread that work, and where a lock makes it worse. PERF 18 JUN 2026 · 7M Where Block Themes Break a Plugin's Front-End Output A block theme generates the CSS your plugin output sits inside. Here are the three collisions, the tokens to inherit, and what you cannot design for. FE 11 JUN 2026 · 7M From WP-Cron to a Job Queue With Claims, Retries and Dead Letters WP-Cron runs when traffic arrives. System cron fixes the trigger; a queue with an atomic claim, backoff retries and a dead-letter state fixes the work. INFRA 04 JUN 2026 · 8M

2026 / MAY

04 articles
Deciding What Invalidates What Before the Cache Bugs Arrive An object cache with no invalidation plan serves stale data either on a timer or forever. How to choose between counter bumps, key deletes and versioned keys. INFRA 27 MAY 2026 · 8M Hook Priority Is a Coordination Mechanism, Not a Tuning Knob Priority decides who runs when, and two plugins at 10 are arguing without knowing it. How WP_Hook orders callbacks and how to read the argument from your own site. WP 20 MAY 2026 · 9M Forms That Survive a Slow Network and an Impatient Tap A form loses work in ordinary ways: the double submit, the response that never arrives, the validation error that clears the fields, the back button. FE 13 MAY 2026 · 8M Why WooCommerce Order Email Lands in Spam, and What Actually Fixes It WordPress sets the From header and leaves the envelope sender to the host. That mismatch is why SPF fails and DMARC buries the receipt. WOO 07 MAY 2026 · 8M

2026 / APRIL

03 articles
Threat Modelling a WooCommerce Plugin in Ninety Minutes Four questions, seven trust boundaries and a table you can fill in as a team. What a ninety-minute threat model finds, and the class of bug it will never find. SEC 28 APR 2026 · 9M Build a WordPress Benchmark You Can Trust Before You Change Anything A benchmark you cannot repeat is not evidence. Fix the dataset, fix the cache state, and report median and p95 server time instead of how the page felt. PERF 15 APR 2026 · 7M Closing the Gap Between a Bug That Will Not Reproduce and Production PHP version, extensions, object cache, database engine and WP_DEBUG explain most bugs that happen on the server and not on your laptop. Matching six is enough. TOOL 08 APR 2026 · 8M

2026 / MARCH

03 articles
CSS Architecture for Admin Screens Your Plugin Does Not Own Your admin stylesheet lands in a page that already holds core CSS, other plugins' CSS and a theme's admin CSS. Scoping and specificity are what you control. FE 26 MAR 2026 · 7M Multisite Option Storage, and What Multiplies by the Number of Sites Option storage splits across three tables on a network. Where each write lands, what a one-site audit misses, and why custom tables are a one-way door. WP 12 MAR 2026 · 8M Authenticating a Machine Client Against the WordPress REST API Cookie auth and X-WP-Nonce assume a browser session. What to use for server-to-server clients, how to store the credential, and why revocation needs a row. API 05 MAR 2026 · 9M

2026 / FEBRUARY

03 articles
What to Log on a Store, and What Has to Stay Out of the Log Logs, metrics and traces answer different questions. What a WooCommerce store should record, what must never reach a file, and which alerts earn a page. INFRA 26 FEB 2026 · 8M Custom WooCommerce Order Statuses That Survive REST and WP-CLI A custom order status needs three registrations, not one. Get the hook timing wrong and orders quietly fall back to pending payment. WOO 19 FEB 2026 · 7M Handling File Uploads in a Plugin Without Creating an Incident The type field in $_FILES is whatever the browser sent. Upload handling starts with an allowlist, a content check and a filename the client never chooses. SEC 05 FEB 2026 · 8M

2026 / JANUARY

03 articles
Serving Product Images at the Size the Browser Actually Needs A wrong sizes attribute makes the browser download the largest candidate it can find. How to size, format and lazy-load a catalogue of twenty thousand products. PERF 21 JAN 2026 · 8M The Code Review Checklist That Actually Works on WordPress Diffs Generic review advice fails on WordPress code, because the framework hands you escape hatches. What to check on a PR, in the order that pays for itself. TOOL 14 JAN 2026 · 8M Database Migration Safety When the Store Cannot Go Offline A plugin schema change runs inside a web request, on a database you do not control, with no rollback. The rules that keep it survivable. TOOL 07 JAN 2026 · 8M

2025 / DECEMBER

02 articles
Debugging a Live Store When You Cannot Attach a Debugger WP_DEBUG leaks paths, SAVEQUERIES eats memory, and a step debugger blocks the request. How to find the cause with logs and targeted instrumentation instead. TOOL 15 DEC 2025 · 8M Designing the JSON Your Integration Sends Out A webhook payload is an API contract with the same obligations as a REST response. What belongs in the envelope, and what a fat payload quietly freezes. API 03 DEC 2025 · 8M

2025 / NOVEMBER

01 articles
EXPLAIN as a Design Tool for WooCommerce Order Queries The orders screen sorts by date and filters by status. Read the EXPLAIN output first, because the write path pays for every index you add. INFRA 20 NOV 2025 · 8M