https://wpsifero.com/ Text courses and technical writing on Python, JavaScript and TypeScript, PHP, SQL, Go, WordPress and WooCommerce. No video: lessons you read, run and keep, from a first script to a service running in production. en Fri, 16 Oct 2026 20:57:27 +0000 https://wpsifero.com/blog/delivery-tracking-without-a-saas-subscription/ https://wpsifero.com/blog/delivery-tracking-without-a-saas-subscription/ Tue, 06 Oct 2026 09:00:00 +0000 WooCommerce & Storefront Ana Ferreiro Most post-purchase support tickets are "where is my order". Here is the plugin architecture that answers them without shipping customer data to a tracking service. https://wpsifero.com/blog/tracking-pages-without-javascript/ https://wpsifero.com/blog/tracking-pages-without-javascript/ Thu, 01 Oct 2026 09:00:00 +0000 Frontend & Accessibility Priya Raghunathan A tracking page should answer the question before any script runs. That means a real form, a stable URL and a server-rendered result, with JavaScript added on top. https://wpsifero.com/blog/wp-cron-dispatch-under-real-traffic/ https://wpsifero.com/blog/wp-cron-dispatch-under-real-traffic/ Tue, 29 Sep 2026 09:00:00 +0000 WordPress Internals Martin Kiel WP-Cron is a request-triggered scheduler. What wp-cron.php does on a quiet site versus a busy one, and where the pattern stops being enough. https://wpsifero.com/blog/idempotency-keys-for-rest-endpoints/ https://wpsifero.com/blog/idempotency-keys-for-rest-endpoints/ Thu, 24 Sep 2026 09:00:00 +0000 APIs & Integrations Devon Parker A client that times out cannot know whether the write committed, so it retries. A unique key and a stored response are what make that retry harmless. https://wpsifero.com/blog/wp-options-autoload-table-bloat/ https://wpsifero.com/blog/wp-options-autoload-table-bloat/ Fri, 18 Sep 2026 09:00:00 +0000 Performance Martin Kiel Autoloaded options are read on every uncached request, not only on admin screens. Here is the query that finds the expensive rows and what to do with each kind. https://wpsifero.com/blog/capability-checks-people-forget/ https://wpsifero.com/blog/capability-checks-people-forget/ Tue, 15 Sep 2026 09:00:00 +0000 Security & Hardening Tomas Lindqvist REST routes, admin-ajax handlers and admin-post actions each need their own guard. Here is the check each one requires and why the admin menu is not protection. https://wpsifero.com/blog/core-web-vitals-on-product-pages/ https://wpsifero.com/blog/core-web-vitals-on-product-pages/ Fri, 11 Sep 2026 09:00:00 +0000 Performance Priya Raghunathan What LCP measures on a product page, why the hero image usually loses to the product title, and which shifts you can actually fix. https://wpsifero.com/blog/static-analysis-for-wordpress-plugins/ https://wpsifero.com/blog/static-analysis-for-wordpress-plugins/ Fri, 04 Sep 2026 09:00:00 +0000 Tooling & Workflow Tomas Lindqvist PHPStan finds undefined variables and wrong argument counts in plugin code. It cannot see a wrong capability name, a filter arity bug or a SQL injection. https://wpsifero.com/blog/woocommerce-hpos-migration-notes/ https://wpsifero.com/blog/woocommerce-hpos-migration-notes/ Mon, 31 Aug 2026 09:00:00 +0000 WooCommerce & Storefront Ana Ferreiro On a store that has moved to HPOS, get_post_meta returns nothing and a direct wp_postmeta query returns stale rows. Here is what to replace both with. https://wpsifero.com/blog/wp-query-object-cache-misses/ https://wpsifero.com/blog/wp-query-object-cache-misses/ Mon, 24 Aug 2026 09:00:00 +0000 WordPress Internals Martin Kiel WP_Query caches its results, then a single metadata write clears the whole group. How to read that behaviour with SAVEQUERIES and what to turn off. https://wpsifero.com/blog/accessible-live-regions-for-order-status/ https://wpsifero.com/blog/accessible-live-regions-for-order-status/ Mon, 17 Aug 2026 09:00:00 +0000 Frontend & Accessibility Priya Raghunathan A live region for order status fails in both directions. It either interrupts on every poll or never speaks at all, and the fix starts before the first update. https://wpsifero.com/blog/webhook-retries-that-do-not-duplicate-orders/ https://wpsifero.com/blog/webhook-retries-that-do-not-duplicate-orders/ Mon, 10 Aug 2026 09:00:00 +0000 APIs & Integrations Devon Parker Senders retry because they cannot tell a slow receiver from a dead one. Here is the receiver that survives the fifth delivery of the same event. https://wpsifero.com/blog/redis-and-memcached-as-object-caches/ https://wpsifero.com/blog/redis-and-memcached-as-object-caches/ Fri, 07 Aug 2026 09:00:00 +0000 Hosting & Infrastructure Tomas Lindqvist Both backends store the same WordPress keys. What decides the choice is eviction, restarts, shared servers and what wp_cache_flush really clears. https://wpsifero.com/blog/nonces-are-not-authorisation/ https://wpsifero.com/blog/nonces-are-not-authorisation/ Mon, 03 Aug 2026 09:00:00 +0000 Security & Hardening Tomas Lindqvist WordPress nonces are short-lived CSRF tokens, not permission checks. Where they fail, why the failure looks like a logout, and what to pair them with. https://wpsifero.com/blog/woocommerce-checkout-session-loss/ https://wpsifero.com/blog/woocommerce-checkout-session-loss/ Thu, 23 Jul 2026 09:00:00 +0000 WooCommerce & Storefront Ana Ferreiro WooCommerce keeps the cart in a table row that a cookie points at. Here is the order to check when a customer's session disappears at checkout. https://wpsifero.com/blog/wp-post-meta-vs-custom-tables/ https://wpsifero.com/blog/wp-post-meta-vs-custom-tables/ Thu, 16 Jul 2026 09:00:00 +0000 WordPress Internals Martin Kiel Postmeta is correct for sparse per-object keys and wrong for range queries and aggregation. How to tell which one you have before the table outgrows the store. https://wpsifero.com/blog/shipping-a-plugin-release-reliably/ https://wpsifero.com/blog/shipping-a-plugin-release-reliably/ Thu, 09 Jul 2026 09:00:00 +0000 Tooling & Workflow Devon Parker A release script turns a working tree into a zip you can verify. The build order, the checks worth automating, and the property that makes them mean anything. https://wpsifero.com/blog/wpdb-prepared-statements-and-their-gaps/ https://wpsifero.com/blog/wpdb-prepared-statements-and-their-gaps/ Thu, 02 Jul 2026 09:00:00 +0000 Security & Hardening Tomas Lindqvist prepare() escapes each value and splices it into a query string. Here is what that contract covers, and the identifiers, wildcards and shapes it never touches. https://wpsifero.com/blog/versioning-a-plugin-rest-api/ https://wpsifero.com/blog/versioning-a-plugin-rest-api/ Sat, 27 Jun 2026 09:00:00 +0000 APIs & Integrations Devon Parker A version bump tells clients something changed but not what. How to tell additive changes from breaking ones, and how to retire a route on a schedule you publish. https://wpsifero.com/blog/cache-stampedes-on-sale-day/ https://wpsifero.com/blog/cache-stampedes-on-sale-day/ Thu, 18 Jun 2026 09:00:00 +0000 Performance Tomas Lindqvist When one popular cache entry expires under load, every request recomputes the same value. Here is how to spread that work, and where a lock makes it worse. https://wpsifero.com/blog/block-themes-and-plugin-ui/ https://wpsifero.com/blog/block-themes-and-plugin-ui/ Thu, 11 Jun 2026 09:00:00 +0000 Frontend & Accessibility Priya Raghunathan A block theme generates the CSS your plugin output sits inside. Here are the three collisions, the tokens to inherit, and what you cannot design for. https://wpsifero.com/blog/real-scheduling-with-system-cron/ https://wpsifero.com/blog/real-scheduling-with-system-cron/ Thu, 04 Jun 2026 09:00:00 +0000 Hosting & Infrastructure Tomas Lindqvist WP-Cron runs when traffic arrives. System cron fixes the trigger; a queue with an atomic claim, backoff retries and a dead-letter state fixes the work. https://wpsifero.com/blog/object-cache-invalidation-strategy/ https://wpsifero.com/blog/object-cache-invalidation-strategy/ Wed, 27 May 2026 09:00:00 +0000 Hosting & Infrastructure Tomas Lindqvist An object cache with no invalidation plan serves stale data either on a timer or forever. How to choose between counter bumps, key deletes and versioned keys. https://wpsifero.com/blog/hook-priority-and-ordering/ https://wpsifero.com/blog/hook-priority-and-ordering/ Wed, 20 May 2026 09:00:00 +0000 WordPress Internals Martin Kiel Priority decides who runs when, and two plugins at 10 are arguing without knowing it. How WP_Hook orders callbacks and how to read the argument from your own site. https://wpsifero.com/blog/forms-that-survive-a-slow-network/ https://wpsifero.com/blog/forms-that-survive-a-slow-network/ Wed, 13 May 2026 09:00:00 +0000 Frontend & Accessibility Priya Raghunathan A form loses work in ordinary ways: the double submit, the response that never arrives, the validation error that clears the fields, the back button. https://wpsifero.com/blog/woocommerce-transactional-email-deliverability/ https://wpsifero.com/blog/woocommerce-transactional-email-deliverability/ Thu, 07 May 2026 09:00:00 +0000 WooCommerce & Storefront Ana Ferreiro WordPress sets the From header and leaves the envelope sender to the host. That mismatch is why SPF fails and DMARC buries the receipt. https://wpsifero.com/blog/threat-modelling-a-wordpress-plugin/ https://wpsifero.com/blog/threat-modelling-a-wordpress-plugin/ Tue, 28 Apr 2026 09:00:00 +0000 Security & Hardening Tomas Lindqvist Four questions, seven trust boundaries and a table you can fill in as a team. What a ninety-minute threat model finds, and the class of bug it will never find. https://wpsifero.com/blog/measuring-wordpress-before-optimising/ https://wpsifero.com/blog/measuring-wordpress-before-optimising/ Wed, 15 Apr 2026 09:00:00 +0000 Performance Martin Kiel A benchmark you cannot repeat is not evidence. Fix the dataset, fix the cache state, and report median and p95 server time instead of how the page felt. https://wpsifero.com/blog/local-environment-that-matches-production/ https://wpsifero.com/blog/local-environment-that-matches-production/ Wed, 08 Apr 2026 09:00:00 +0000 Tooling & Workflow Devon Parker PHP version, extensions, object cache, database engine and WP_DEBUG explain most bugs that happen on the server and not on your laptop. Matching six is enough. https://wpsifero.com/blog/css-architecture-for-plugin-screens/ https://wpsifero.com/blog/css-architecture-for-plugin-screens/ Thu, 26 Mar 2026 09:00:00 +0000 Frontend & Accessibility Priya Raghunathan Your admin stylesheet lands in a page that already holds core CSS, other plugins' CSS and a theme's admin CSS. Scoping and specificity are what you control.