A plugin that fetches a feed URL entered by a user is a server-side request forgery waiting to happen: the URL can be http://127.0.0.1:11211/, or the private address…
Every other file in a child theme replaces its parent equivalent: drop in single.php and the parent’s is not loaded. functions.php is the exception — both are included,…
update_option() returns false for two entirely different situations: the write failed, and the write was unnecessary. It compares the new value against the current one with === and…
save_post fires for autosaves, revisions, quick edit, bulk edit and XML-RPC as well as for someone pressing Update. None of those requests contain the fields from your meta…
Without a persistent object cache, a transient is two rows in wp_options — the value and a timeout — and expiry is checked nowhere except inside get_transient(), which…
WP_Query covers a lot and stops short of a few things: ordering by a joined table, a GROUP BY you chose, an index hint, a comparison meta_query cannot…
A new custom post type has a working single view and an archive that 404s, and it starts working the moment somebody opens Settings → Permalinks. The rewrite…
woocommerce_thankyou reads like a completion event and is a page-render hook. The order-received page has an ordinary URL with the order key in it, so it is bookmarked,…