Cheatsheet

<?php
// ===== 1) Hooks — the WordPress idiom =====
// Actions DO something; Filters TRANSFORM something.
add_action('init', function () { /* called early in every request */ });
add_filter('the_content', fn ($html) => $html . '<p>thanks for reading</p>');

remove_action('hook_name', 'callback_name', $priority);
remove_filter('hook_name', 'callback_name', $priority);

// Common actions
// init, wp, template_redirect, wp_enqueue_scripts, admin_init, save_post

// Common filters
// the_title, the_content, the_excerpt, wp_mail, body_class

// ===== 2) Custom post type + REST + taxonomy =====
add_action('init', function () {
    register_post_type('case_study', [
        'labels' => ['name' => 'Case Studies'],
        'public' => true, 'show_in_rest' => true,
        'supports' => ['title', 'editor', 'thumbnail'],
        'rewrite' => ['slug' => 'case-studies'],
    ]);
    register_taxonomy('industry', 'case_study', [
        'show_in_rest' => true, 'hierarchical' => true,
        'rewrite' => ['slug' => 'industry'],
    ]);
});

// ===== 3) Enqueue assets — the right way =====
add_action('wp_enqueue_scripts', function () {
    wp_enqueue_style('shop-app',
        get_stylesheet_directory_uri() . '/assets/app.css',
        [], filemtime(get_stylesheet_directory() . '/assets/app.css'));
    wp_enqueue_script('shop-app',
        get_stylesheet_directory_uri() . '/assets/app.js',
        [], filemtime(get_stylesheet_directory() . '/assets/app.js'),
        true);                                             // in footer
});

// ===== 4) REST endpoint with permission check =====
add_action('rest_api_init', function () {
    register_rest_route('shop/v1', '/orders', [
        'methods'             => 'GET',
        'callback'            => function (WP_REST_Request $req) {
            return new WP_REST_Response(['ok' => true], 200);
        },
        'permission_callback' => fn () => current_user_can('edit_orders'),
        'args' => [
            'status' => ['type' => 'string', 'enum' => ['new','paid','shipped','cancelled']],
        ],
    ]);
});

// ===== 5) Always escape + sanitise =====
// OUTPUT
echo esc_html($value);                 // for text content
echo esc_attr($value);                 // for HTML attributes
echo esc_url($url);                    // for href / src
echo wp_kses_post($html);              // limited safe HTML
echo esc_js($value);                   // for inline JS strings (legacy)

// INPUT
$clean = sanitize_text_field($_POST['name']);
$id    = absint($_GET['id']);
$url   = esc_url_raw($_POST['url']);
$email = sanitize_email($_POST['email']);

// Nonces on every form / state-changing AJAX
wp_nonce_field('save_thing', 'thing_nonce');
if (!wp_verify_nonce($_POST['thing_nonce'], 'save_thing')) abort(403);

// ===== 6) Database via $wpdb (PARAMETERISE always) =====
global $wpdb;
$rows = $wpdb->get_results($wpdb->prepare(
    "SELECT * FROM {$wpdb->prefix}orders WHERE status = %s LIMIT %d",
    $status, $limit
));

// Insert / update via $wpdb->insert / $wpdb->update is parameterised by default.

// ===== 7) Transients for caching =====
$result = get_transient('ticker_BTC');
if ($result === false) {
    $result = fetch_btc_price();
    set_transient('ticker_BTC', $result, 60);
}

// ===== 8) WP-CLI — the workshop =====
// wp plugin list --format=table
// wp plugin install yoast-seo --activate
// wp user list --role=administrator
// wp post list --post_type=case_study --field=ID
// wp db export backup-$(date +%F).sql
// wp option get siteurl
// wp eval "echo wp_get_current_user()->ID;"

// ===== 9) Theme + plugin layout =====
// wp-content/
// ├── themes/your-theme/
// │   ├── style.css        # Theme metadata header
// │   ├── functions.php
// │   ├── index.php / template-parts/
// │   └── theme.json       # Block themes only
// └── plugins/your-plugin/
//     ├── your-plugin.php  # Plugin metadata header
//     ├── includes/
//     └── readme.txt

// ===== 10) Hardening =====
// wp-config.php
// define('DISALLOW_FILE_EDIT', true);
// define('DISALLOW_FILE_MODS', true);
// define('FORCE_SSL_ADMIN', true);
// chmod wp-config.php 600
// install Limit Login Attempts Reloaded + Two Factor
// CDN/WAF in front (Cloudflare / BunkerWeb)
// Regular core + plugin + theme updates (automate when possible)

// ===== 11) Performance =====
// Page cache: WP Super Cache / WP Rocket / nginx FastCGI
// Object cache: Redis (Object Cache Pro on a busy store)
// Image: native loading='lazy' + WebP via a plugin
// PHP 8.3+ with OPcache enabled
// Disable XML-RPC if unused

// ===== 12) Pitfalls =====
// - Hardcoding URLs in queries; use get_site_url() / home_url() / esc_url(home_url('/...'))
// - Forgetting nonces on AJAX state changes
// - Echoing user input without esc_html
// - Direct table access without $wpdb->prepare
// - Storing 1MB blobs in wp_options autoloaded
// - Installing 60 plugins; each adds load to every request

// the_post() the_title() the_content() get_post_meta() add_action() add_filter() wp_enqueue_script()