A nonce proves the request came from a form your site rendered, recently. It says nothing about whether the person submitting it is allowed to perform the action…
$wpdb->prepare() looks like sprintf() and behaves differently in the one way that matters: %s adds the surrounding quotes itself. Writing them by hand produces a doubly-quoted value and…
The two caching APIs in WordPress look interchangeable and are not. wp_cache_* is per-request by default and lives only for that request unless a persistent backend is installed.…
Changing a price by filtering woocommerce_get_price alters it everywhere at once, including the catalogue and the order confirmation email — and it fires often enough to be a…
Everything that touches post output hangs off the same filter — autoembeds, wpautop, shortcode expansion, and every plugin. Priority decides the order, and getting it wrong is why…
Reordering the checkout form by copying form-billing.php into the theme works and then quietly rots: every WooCommerce release that touches that template leaves your copy behind, and the…
Running a REPLACE() over the database to change a domain looks like it works, until a widget disappears or a theme setting resets. PHP serialised strings encode their…
Registering a custom post type does not create its rewrite rules, so the archive 404s until permalinks are re-saved. The fix that circulates is flush_rewrite_rules() on init, which…