On a single site WP-CLI knows which site it is. On multisite it does not, so every command runs against the network’s main site unless told otherwise —…
The Heartbeat API keeps post locks and autosave working by posting to admin-ajax.php on a timer — every fifteen seconds in the editor, every sixty elsewhere in the…
Sending a webhook or writing an analytics row after the page has rendered still holds the connection open, because PHP does not close it until the script ends.…
WooCommerce maintains its own session handler backed by a database table and a cookie, entirely separate from $_SESSION. Code that starts a PHP session to store something cart-related…
Every request to admin-ajax.php loads the full admin bootstrap before reaching your handler — a measurable amount of work for an endpoint that returns three fields, and it…
get_option() returns false when the option does not exist, and also when it exists and holds false. Any setting that can legitimately be off is therefore indistinguishable from…
Omitting permission_callback registers a route that anyone can call. It works, there is no error, and this year there is not even a warning — the notice that…