Professional WordPress Plugin Development

About the authors Brad Williams is CEO and cofounder of WebDevStudios, a WordPress design and development firm. He is coauthor of Professional WordPress Design and Development. Justin Tadlock is a plugin and theme developer with over a decade of professional experience. He currently writes for WP Tavern. John James Jacoby has authored dozens of popular WordPress plugins and leads the development of bbPress and BuddyPress. He has contributed to every major WordPress version since 2008.

• Introduction xxxiChapter 1: An Introduction to Plugins 1What is a Plugin? 1How Plugins Interact with WordPress 2When are Plugins Loaded? 3Available Plugins 4Official Plugin Directory 4Popular Plugin Examples 4Popular Plugin Tags 5Advantages of Plugins 5Not Modifying Core 5Why Reinvent the Wheel? 5Separating Plugins and Themes 6Easy Updates 7Easier to Share and Reuse 7Plugin Sandbox 7Plugin Community 7Installing and Managing Plugins 8Installing a Plugin 8Managing Plugins 9Editing Plugins 9Plugin Directories 9Types of Plugins 10Summary 11Chapter 2: Plugin Framework 13Requirements for Plugins 13Naming Your Plugin 14Using a Folder 14Best Practices 14Namespace Everything 14File Organization 15Folder Structure 16Plugin Header 17Creating the Header 17Plugin License 18Determining Paths 19Plugin Paths 19Local Paths 19URL Paths 20Activate/Deactivate Functions 22Plugin Activation Function 22Plugin Deactivation Function 23Deactivate is Not Uninstall 23Uninstall Methods 24Why Uninstall is Necessary 24Uninstall.php 24Uninstall Hook 25Coding Standards 25Document Your Code 26Naming Variables and Functions 27Naming Classes and Methods 27Naming Files 28Single and Double Quotes 28Indentation 28Brace Style 29Space Usage 29Shorthand PHP 30SQL Statements 30Summary 30Chapter 3: Dashboard And Settings 31Adding Menus and Submenus 31Creating a Top-Level Menu 32Adding a Submenu 33Adding a Menu Item to an Existing Menu 34Plugin Settings 36The Options API 36Saving Options 36Saving an Array of Options 37Updating Options 37Retrieving Options 38Loading an Array of Options 39Deleting Options 40The Autoload Parameter 40Segregating Plugin Options 41Toggling the Autoload Parameter 42The Settings API 42Benefits of the Settings API 42Settings API Functions 43Creating the Plugin Administration Page 43Registering New Settings 44Defining Sections and Settings 44Validating User Input 46Rendering the Form 47All Done! 48Wrapping It Up: A Complete Plugin Management Page 48Improving Feedback on Validation Errors 51Expanding with Additional Field Types 52Adding Fields to an Existing Page 59How It Works 59Adding a Section to an Existing Page 59Adding Only Fields 60WordPress’ Sections and Setting Fields 61User Interface Concerns 62Removing Settings 62Keeping It Consistent 63Using the WordPress UI 64Headings 64Dashicons 64Messages 65Buttons 66Form Fields 67Tables 68Pagination 69Summary 70Chapter 4: Security And Performance 71Security Overview 72What Securing Your Plugin is 72What Securing Your Plugin is Not 72User Permissions 72How to Check current_user_can() 73Do Not Check Too Early 73Nonces 74Authority vs. Intention 74What is a Nonce? 75How to Create and Verify Nonces 75Creating a Nonce URL 76Creating a Nonce Field 76Creating and Verifying a Nonce in a Plugin 77Data Validation and Sanitization 78The Need for Data Validation and Sanitization 78Good Practice: Identifying Potentially Tainted Data 80Validating or Sanitizing Input? 81Validating and Sanitizing Cookbook 81Integers 81Arbitrary Text Strings 82Key and Identifier Strings 83Email Strings 84URLs 84HTML 86JavaScript 88Environment and Server Variables 88Arrays of Data 89Database Queries 89Formatting SQL Statements 90The $wpdb Object 90Why wpdb Methods are Superior 91All-in-One Methods 91$wpdb->update() 92$wpdb->insert() 92Common Methods 93Select a Variable 93Select a Row 94Select a Column 94Select Generic Results 95Generic Queries 96Protecting Queries against SQL Injections 96Security Good Habits 97Performance Overview 97Caching 98Saving Cached Data 98Loading and Using Cached Data 99Deleting Cached Data 99Caching Data within a Plugin 100Transients 101Saving an Expiring Option 102Retrieving an Expiring Option 102Deleting an Expiring Option 102A Practical Example Using Transients 102Technical Details 103Transient Ideas 103Summary 104Chapter 5: Hooks 105Understanding Hooks 105Actions 106What is an Action? 107Action Hook Functions 108remove_action() 108remove_all_actions() 109do_action_ref_array 110has_action 111did_action() 112current_action 112register_activation_hook and register_deactivation_hook 113Commonly Used Action Hooks 113plugins_loaded 113init 114admin_menu 115save_post 116wp_head 116Filters 117What is a Filter? 118Filter Hook Functions 119remove_filter 119remove_all_filters 120apply_filters_ref_array 121has_filter 122current_filter 122Quick Return Functions 123Commonly Used Filter Hooks 124the_content 124template_include 125Using Hooks from within a Class 126Using Hooks with Anonymous Functions 127Creating Custom Hooks 128Benefits of Creating Custom Hooks 128Custom Action Hook Example 128Custom Filter Hook Example 129Finding Hooks 129Searching for Hooks in the Core Code 130Variable Hooks 130Hook Reference Lists 130Summary 131Chapter 6: Javascript 133Registering Scripts 134Enqueueing Scripts 135Limiting Scope 136Localizing Scripts 136Inline Scripts 137Overview of Bundled Scripts 139jQuery UI and Other Scripts 139The WP Global 140a11y Speak 140Escaping 140i18n 140Heartbeat 141Polyfills 141Your Custom Scripts 141jQuery 142Benefits of Using jQuery 142jQuery Crash Course 142The jQuery Object 143Syntax and Chaining 143No-Conflict Mode in WordPress 144Launching Code on Document Ready 144Ajax 145Backbone/Underscore 146React 146Summary 147Chapter 7: Blocks And Gutenberg 149What is Gutenberg? 149Touring Gutenberg 151Practical Examples 155WooCommerce 156The Events Calendar 157Post Type Switcher 158Technology Stack of Gutenberg 159JavaScript 160PHP 161Node.js 162webpack 163Babel 163React 163JSX 163ES6 163“Hello World!” Block 164PHP 164JavaScript 164webpack 165Command Line 166Activation 167Wrap-Up 167WP-CLI Scaffolding 168Plugin 168Blocks 169Includes 169Activation 169Wrap-Up 169create-guten-block Toolkit 170Installation 171Activation 171Wrap-Up 173Block Directory 173Summary 174Chapter 8: Content 175Creating Custom Post Types 176Post Type Possibilities 176Registering a Post Type 177register_post_type 177Registering the Book Collection Post Type 177Setting Post Type Labels 179Using Custom Capabilities 180Attaching Existing Taxonomies 182Post Metadata 183Registering Post Metadata 183Adding Post Metadata 184Retrieving Post Metadata 185Updating Post Metadata 186Deleting Post Metadata 186Meta Boxes 187What is a Meta Box? 187Adding a Custom Meta Box 188Saving Meta Box Data 190Creating Custom Taxonomies 191Understanding Taxonomies 192Registering a Custom Taxonomy 192register_taxonomy 193Registering the Genre Taxonomy 193Assigning a Taxonomy to a Post Type 194Using Custom Taxonomies 195Retrieving a Taxonomy 196Using a Taxonomy with Posts 196Taxonomy Conditional Tags 197taxonomy_exists 197is_taxonomy_hierarchical 198is_tax 198A Post Type, Post Metadata, and Taxonomy Plugin 199Summary 204Chapter 9: Users And User Data 205Working with Users 206User Functions 206is_user_logged_in() 206get_users() 207count_users 207Creating, Updating, and Deleting Users 208Creating a New User 209Updating an Existing User 211Deleting an Existing User 212User Data 213Getting a User Object and Data 213Getting the Current User Object 215Getting User Post Counts 215User Metadata 217Adding User Metadata 218Retrieving User Metadata 218Updating User Metadata 219Deleting User Metadata 220Creating a Plugin with User Metadata 220Roles and Capabilities 223What are Roles and Capabilities? 223Default Roles 224Custom Roles 224Limiting Access 225Checking User Permissions 225Is the User an Admin? 227Customizing Roles 228Creating a Role 228Deleting a Role 230Adding Capabilities to a Role 230Removing Capabilities from a Role 231A Custom Role and Capability Plugin 231Summary 233Chapter 10: Scheduled Tasks 235What is Cron? 235How is Cron Executed? 236Scheduling Cron Events 236Scheduling a Recurring Event 236Scheduling a Single Event 238Unscheduling an Event 240Specifying Your Own Cron Intervals 241Viewing Scheduled Cron Events 242True Cron 247Practical Use 247The Blog Pester Plugin 247Deleting Post Revisions Weekly 250The Delete Comments Plugin 253Summary 258Chapter 11: Internationalization 259Internationalization and Localization 260Why Internationalize? 260Understanding Internationalization in Professional Work 261Getting Your Plugin Ready for Translation 261Echoing and Returning Strings 262The __() Function 262The _e() Function 263The esc_attr__() Function 263The esc_attr_e() Function 264The esc_html__() Function 264The esc_html_e() Function 264The _x() Function 264The _ex() Function 265The esc_attr_x() Function 266The esc_html_x() Function 266The _n() Function 267The _nx() Function 268The _n_noop() Function 269The _nx_noop() Function 270Using Placeholders 271Internationalizing JavaScript 273Developer Handbook Resource 275Creating Translation Files 275The MO and PO Files 276Translation Tools 276How to Create a POT File 277Command Line 278Where to Store Translation Files 278Summary 278Chapter 12: Rest Api 279What the REST API is 279What You Can Do with the REST API 280Accessing the WordPress REST API 281Default Endpoints 282REST API Clients 283Insomnia 283Postman 283Authentication 284Enhanced Authentication 285Custom Endpoints 286The HTTP API 289What is an HTTP Request? 289HTTP Request Concepts 289Dissecting an HTTP Transaction 289Some Caveats on Checking HTTP Responses 291Possibilities for Crafting HTTP Requests 292How to Make HTTP Requests in PHP 292Using the HTTP Extension 292Using fopen() Streams 293Using a Standard fopen() 293Using fsockopen() 293Using the CURL Extension 294Too Many Ways? 294WordPress’ HTTP Functions 294The wp_remote_ Functions 294wp_remote_* Input Parameters 295wp_remote_* Return Values 297wp_remote_ Companion Functions 302Advanced Configuration and Tips 303Proxy Support 303Filtering Requests and Responses 304Bringing It All Together 307Create 307Update 309Delete 309Resources 313Summary 313Chapter 13: Multisite 315Terminology 316Advantages of Multisite 317Enabling Multisite in WordPress 317Multisite Functions 319The Site ID 319Common Functions 319Switching and Restoring Sites 321Network Content Shortcode Examples 325A Network Content Widget Example 330Creating a New Site 336Site Options 342Network Options 342Site Meta 343Users and Roles 343Super Admin 348Checking the Site Owner 349Network Stats 350Database Schema 350Multisite-Specific Tables 350Site-Specific Tables 351Query Classes 351WP_Site_Query 351WP_Network_Query 352Object Classes 352WP_Site 352WP_Network 352Summary 352Chapter 14: The Kitchen Sink 353Querying and Displaying Posts 353Use Case for Displaying Posts 354WP_Query Overview 354The Loop 355Shortcodes 358What Shortcodes are 358Register Custom Shortcodes 359Building a Simple Shortcode 360Building a Shortcode with Parameters 362Building a Shortcode with Content 364Shortcode Tips 366Think Simplicity for the User 366Remember That Shortcodes are Dynamic 366Look under the Hood 367remove_shortcode() 367remove_all_shortcodes() 367strip_shortcodes() 367do_shortcode() 367Widgets 368Creating a Widget 368Dashboard Widgets 377Creating Dashboard Widgets 378Creating a Dashboard Widget with Options 380Rewrite Rules 384Why Rewrite URLs 384Permalink Principles 384Search Engine Friendly 384User Friendly 385Apache’s mod_rewrite 385URL Rewriting in WordPress 385How WordPress Handles Queries 386Overview of the Query Process 386The Rewrite Object 387The Query Object 388What Plugins Can Do 389Practical Uses 389Rewriting a URL to Create a List of Shops 389Creating a New Permalink Structure and Integrating Non-WordPress Pages 391The Heartbeat API 395What is the Heartbeat API? 395Using the Heartbeat API 395Sending Data 395Receiving and Responding to Data 395Processing the Response 396Full Heartbeat API Plugin 396Summary 398Chapter 15: Debugging 399Compatibility 399Supporting Many WordPress Versions 400Playing Nicely with Other WordPress Plugins 401Keeping Current with WordPress Development 402Deprecation 404Dealing with Obsolete Client Installs 404Debugging 405Enabling Debugging 406Displaying Debug Output 406Understanding Debug Output 407Error Logging 410Enabling Error Logging 410Setting Log File Location 411Understanding the Log File 411Query Monitor 411Summary 414Chapter 16: The Developer Toolbox 415Core as Reference 415PHP Inline Documentation 416JavaScript Inline Documentation 417Finding Functions 417Common Core Files 418formatting.php 418functions.php 418pluggable.php 419plugin.php 419post.php 419user.php 420Plugin Developer Handbook 420Navigating the Handbook 420Code Reference 420Codex 421Searching the Codex 421Function Reference 422Tool Websites 422PHPXref 422Hooks Database 423Community Resources 424Make WordPress 424Support Forums 424WordPress Slack 425WordPress Development Updates 425WordPress Ideas 426Community News Sites 426WordPress News 426WordPress Planet 426Post Status 426Know the Code 426LinkedIn Learning 427Twitter 427Local Events 427Tools 427Browser 427Editor 428NetBeans IDE 428PhpStorm 428Notepad++ 428TextMate 428Sublime Text 428Visual Studio Code 429Deploying Files with FTP, SFTP, and SSH 429phpMyAdmin 429Summary 430Index 431

Select Guide Rating