Türker Yıldırım

wordpress

  • Managing WordPress entirely through Composer

    Deep dive15 min read

    turkerdev/wp-composer, and an install where nothing is committed except a lock file. Core, themes and plugins as dependencies.

  • The REST route that needed a permission callback and had one

    Note2 min read

    A route with a permission callback that returned true for any logged-in user, on an endpoint that returned other people’s orders. The absence of a permission callback produces…

  • 6.8, and bcrypt for new password hashes

    Note2 min read

    WordPress changes its password hashing in April, and the migration completes only as fast as users log in. A rehash-on-login migration has no completion date, which is the…

  • The integration that compared password hashes directly

    Note2 min read

    A single sign-on bridge that read the stored hash and compared it, which stopped working when the algorithm changed. The comparison had never worked and the fallback path…

  • Speculative loading, and turning it off for one route

    Note2 min read

    6.8 prefetches links on hover by default, which is free performance except where a link has a side effect. A GET request that changes state is the anti-pattern…

  • An autoloaded option that grew back

    Note1 min read

    A 400 KB autoloaded option fixed in 2023, and a different plugin doing the same thing in 2025. The same shape as 2023 with a different plugin, which…

  • 6.8, and the passwords that were rehashed

    Deep dive10 min read

    WordPress changes its password hashing in April, and a migration that completes only as fast as users come back.

  • A block that stopped needing its own script

    Note2 min read

    An accordion block converted to directives a year ago, revisited to see whether the conversion held. The runtime being loaded by somebody else’s plugin changes the calculation for…

  • A theme.json regenerated from tokens, still

    Note1 min read

    A generated theme.json, three years after the pipeline was built, and the check that has kept it honest. Two commands, and they have fired four times in three…

  • A WP-CLI command with a –format=json output nobody asked for

    Note1 min read

    A custom command built with a table output, and a pipeline that needed to parse it. format_items gives table, CSV, JSON, YAML and count from one call, which…