Tag Info

Hot answers tagged

43

Use Actions and Filters If you think people would like to add or alter some data: provide apply_filters() before returning. P.S. One thing I find a bit disappointing and that your question addresses is the percentage of plugins that are designed only for end-users, i.e. that have no hooks of their own. Imagine if WordPress were designed like most ...


39

Load Scripts/CSS with wp_enqueue_script and wp_enqueue_style Plugins should not load / attempt to load duplicate versions of JS / CSS files, especially jQuery and other JS files included in WP Core. Plugins should always use wp_enqueue_script and wp_enqueue_style when linking JS and CSS files and never directly via <script> tags. Related Re-Use ...


38

Short answer: yes The answer to this question is an unequivocal yes, and to say otherwise is completely irresponsible. Long answer: a real-world example Allow me to provide a very real example, from my very real server, where moving wp-config.php outside the web root specifically prevented its contents from being captured. The bug: Take a look at this ...


37

I18n support All output strings should be linked to an appropriate text domain to allow for internationalization by interested parties, even if the developer has no interest in translating their own plug-in. Note that it is very important to load the language files during the init action so the user can hook into the action. See the Codex: I18n for ...


37

That’s a very good question. It goes down to the dark heart of the plugin API and best programming practices. For the following answer I created a simple plugin to illustrate the problem with easy to read code. <?php # -*- coding: utf-8 -*- /* Plugin Name: Anonymous OOP Action */ if ( ! class_exists( 'Anonymous_Object' ) ) { /** * Add some ...


34

First Use Existing Functions in WordPress Core If you can: use existing functions included in WordPress core instead of writing your own. Only develop custom PHP functions when there is not an appropriate pre-existing function in WordPress core. One benefit is you can use "log deprecated notices" to easily monitor functions that should be replaced. Another ...


33

Ensure Plugins Generate No Errors with WP_DEBUG Always test your plugins with WP_DEBUG turned on and ideally have it turned on throughout your development process. A plugin should not throw ANY errors with WP_DEBUG on. This includes deprecated notices and unchecked indexes. To turn debugging on, edit your wp-config.php file so that the WP_DEBUG constant ...


33

Hi @Geo: As a huge proponent of using WordPress for content management use-cases that surprise the many people who believe WordPress is only a blog, I've had many opportunities to defend it's use which has also allowed me to recognize where it is not useful. Here are the main areas where I've come to believe WordPress is in-fact not the best solution: Non ...


27

Uninstalling should remove all of a plugin's data Upon being removed from a WordPress installation, a plugin should delete all files, folders, database entries, and tables which it created as well as the option values it created. Plugins may offer an option to export/import settings, so that settings can be saved outside of WordPress prior to deletion. ...


26

Prevent SQL Injection with Input Data A plugin should sanitize all user input retrieved directly or indirectly (e.g. via $_POST or $_GET) before using input values to query the MySQL database. See: Formatting SQL statements.


25

Use a class and object orientated PHP5 code There's no reason not to write clean, object-orientated PHP5 code. PHP4 support will phase out after the next release (WP 3.1). Of course, you can prefix all your function names to end up with endlessly_long_function_names_with_lots_of_underscores, but it's much easier to just write a simple class and bundle ...


24

Prefix All Global Namespace Items A plugin should properly prefix ALL global namespace items (constants, functions, classes, variables, even things like custom taxonomies, post types, widgets, etc.). For example, do not create a function called init(); instead, name it something like jpb_init(). Its common should use a three or four letter prefix in front ...


22

Deactivation should not provoke Data-Loss A plugin should not delete any of its data upon deactivation. Related Uninstall should remove all plugin's data


22

Only include files that you need... If you're in the front end, don't include code that relates to the admin area.


21

Bare bone themes are great, personally I prefer them over frameworks. I have noticed that 'liking' one over another comes down to how it feels, so I would suggest trying several out until you find one. For instance a lot people like WordPress boilerplate but I could not get the hang of it. My current favorite is Handcrafted WP, since it very similar to my ...


19

The biggest thing is the wp-config.php contains some sensitive information: your database username/password, etc. So the idea: move it outside the document root, and you don't have to worry about anything. An attacker will never be able to access that file from an external source. Here's the rub, however: wp-config.php never actually prints anything to the ...


18

Announce Data-Loss on Plugin Uninstallation Upon uninstallation a plugin should prompt a user that it will be deleting it's data and receive a confirmation that the user is okay with deleting the data before doing so and a plugin should also allow the user the option to keep the data upon uninstallation. (This idea from @EAMann.) Related Uninstall should ...


17

Use WordPress (built in) Error handling Don't just return; if some user input was wrong. Deliver them some information about was was done wrong. function some_example_fn( $args = array() ) { // If value was not set, build an error message if ( ! isset( $args['some_value'] ) ) $error = new WP_Error( 'some_value', sprintf( __( 'You have ...


17

These are 3 snippet for better performance, regarding Yahoo! rules: Disable Etags: Header unset ETag FileETag None Add expire headers: <FilesMatch "\.(ico|jpg|jpeg|png|gif|js|css|swf)$"> Header set Expires "Tue, 16 Jun 2020 20:00:00 GMT" </FilesMatch> Or ExpiresActive On ExpiresByType text/html "access plus 1 day" ExpiresByType image/gif ...


17

I think Max's is a knowledgeable answer, and that's one side of the story. The WordPress Codex has more advise: Also, make sure that only you (and the web server) can read this file (it generally means a 400 or 440 permission). If you use a server with .htaccess, you can put this in that file (at the very top) to deny access to anyone surfing ...


16

Minimize Names Added to the Global Namespace A plugin should reduce it's impact as much as possible by minimizing the number of names it adds to the global namespace. This can be done by encapsulating the plugin's functions into a class or by using the PHP namespaces feature. Prefixing everything can help as well but is not that flexible. Next to ...


16

Let plugin's folder name be changed /plugins/pluginname/{various} The "pluginname" used for the folder should always be changeable. This is normally handled by defining constants and consistantly using them throughout the plugin. Needless to say many popular plugins are sinners. Related: plugins_url() for easy linking to resources, included with ...


15

As a rule of thumb, you should use a POST request for most actions, to make sure they are not executed by accident. But it is also a good practice to redirect to a normal page after a POST request, to prevent duplicate execution when the user refreshes the page. So the flow is like this: Your plugin page with a POST form, which submits to A page that ...


14

Use the Settings API before add_option Instead of adding options to the DB via the add_option function, you should store them as an array with using the Settings API that takes care of everything for you. Use the Theme Modifications API before add_option The Modifications API is a pretty simple construct and a safe way that allows adding and retrieving ...


14

Host Plugins on WordPress.org Use the SVN repository provided on WordPress.org for hosting plugins. It makes for an easier update user-experience and if you've never used SVN before, it gets you to actually understand by using it in a context that justifies it.


14

Protect Plugin Users Privacy (Previously: Anonymous API Communication) If a plug-in communicates with an external system or API (e.g. some Webservice), it should do so anonymously or provide the user with an anonymous option that ensures that no data related to the user of the plugin leaks to a second party uncontrolled.


14

The API you offer in a plugin or a theme depends on the logic of that specific code. There is probably no guide that applies to all situations. I am a contributor for multiple plugins with APIs, and what I have learned so far is: Do not offer an API until you really know how people use your code. Release the first two or three versions without any API. ...


14

This is not recommended in any WordPress style guide, and I think it is a bad coding style. Beginners are using this style, maybe because it feels more like HTML … Unfortunately, the default themes are using this style way too often, so some beginners might think it is part of a code style. One disadvantage of this style is comment handling. Look closely ...


14

TL;DR; Enqueue Using external stylesheet PRO: All your styles are in one spot. PRO: Reduces web page coding. PRO: Easier to maintain the plugin. PRO: Can use hooks to alter location of the file. PRO: Can use hooks to unqueue the file. PRO: Can use minify styles automatically. CON: Might add extra HTTP request (can be overcome). Using inline styles ...


13

Definitely YES. When you move wp-config.php outside public directory you protect it from reading using browser when php handler gets maliciously (or accidentally!) changed. Reading your DB login/password is possible when server is hardly infected through a fault of lame administrator. Charge the administrator a fine and get a better-tended and more ...



Only top voted, non community-wiki answers of a minimum length are eligible