Blog
Actionable tips and updates to help you ship plugins, themes, and client sites faster
7 min readWordPress permalinks: what changing the structure actually breaks
Change your permalink structure and most old URLs will not 404, because core guesses the new one with a prefix match on post_name. That guess can land readers on the wrong post, and pages get no redirect at all.
6 min readThe WordPress .htaccess file: what core actually writes, and when it silently does not
WordPress manages exactly one block of your .htaccess, decides whether to write it from a string match on SERVER_SOFTWARE, and throws away the result when the write fails. Here is the mechanism, read from core.
8 min readWordPress revisions store three columns, not a snapshot of your page
A revision saves post_title, post_content and post_excerpt. Custom fields, taxonomy terms, the featured image and the page template are not in there, so Restore This Revision does not bring them back. Here is what core actually writes, and what the official doc gets wrong.
7 min readWordPress XML-RPC: the one-line disable does not disable it
add_filter('xmlrpc_enabled', '__return_false') leaves pingbacks running, keeps advertising xmlrpc.php in your head tag, and still sends the X-Pingback header. Core's own docblock says so. Here is what each method of turning it off actually stops.
7 min readWordPress salts: what they actually sign, and what breaks when you change them
Salts do not hash your users' passwords, and half of them may not be in wp-config.php at all. Here is what the eight constants sign, what a rotation silently breaks, and how to rehearse it.
7 min readWordPress application passwords: why the section is missing, and what they do not protect you from
The Application Passwords box disappears when PHP cannot see TLS, not when your site lacks it. Here is the core code behind that, plus the scoping and audit limits nobody mentions.
5 min readReset a WordPress password: what each method leaves behind
The fastest way to reset a WordPress password depends on what access you still have. None of the methods log out whoever else is already in, and the reset link can no longer be read out of the database.
6 min readHow to export a WordPress site (and what the XML file leaves behind)
Tools > Export gives you a WXR file of your posts, pages and menus. It contains no media files, no plugins, no theme and no settings. Here is exactly what is in it, what is not, and what to use instead.
6 min readWordPress file permissions: why 755 and 644 are not enough
Use 755 for folders and 644 for files, but WordPress decides whether it can write by checking who owns the files, not their mode. Here is the check core runs, and how to fix the FTP prompt for good.