WordPress Plugin Development
A complete course in building WordPress 7.0 plugins: the plugin model, hooks and data, admin screens, REST routes, blocks in PHP, security and shipping.
- Modules
- 02
- Lessons
- 06
- Reading time
- 2H 45M
- Words
- 11,999
What you will be able to do
- Build a plugin from an empty directory to a signed-off release.
- Use actions and filters correctly, including priorities and removal.
- Store settings and custom data without bloating the options table.
- Build admin screens with the Settings API, correct capabilities and nonces.
- Register REST routes and PHP-only blocks that the editor can use.
- Sanitise, escape and verify everything a request can carry.
Before you start
Working knowledge of PHP and some familiarity with using WordPress as a site owner. PHP 8.3 or newer and a local WordPress 7.0 install.
Still being written
2 of 6 modules are finished and readable now. The remaining 4 are in progress and will appear here as they are published. Nothing already written is removed, and the lessons below will not change underneath you.
WordPress runs a large fraction of the web, which means plugin code written badly runs on a large fraction of the web. The platform gives you an enormous amount of power and almost no guardrails: it will let you write a plugin that destroys a site's performance, opens a privilege escalation, or breaks on the next core update, and it will not warn you about any of it.
This course is written against WordPress 7.0, including the parts that changed recently: server-side block registration without JavaScript, the Abilities API, and the modernised admin. It starts from an empty directory and ends with a plugin you could submit to the directory, covering the request lifecycle first because almost every performance and security mistake is a misunderstanding of when your code runs.
The security module is not an appendix. Capability checks, nonces, sanitisation and escaping are taught as part of writing each feature, then consolidated, because the only reliable protection is knowing which of the four applies at each point in the request.
Curriculum
2 modules, 6 lessons
The plugin model
File structure, plugin headers, activation and deactivation, and the request lifecycle your code runs inside.
3 lessons · 1H 25M
Hooks and the data layer
Actions, filters, priorities, options, transients, custom tables and the $wpdb API.
3 lessons · 1H 20M
Go deeper