The nuances of commercial development on WordPress. How long will it take the YouDo performer to complete the task?

Even a little scary, isn't it? After working with this code for a few minutes, I sent the topic author an email with a link to the coding standards manual page.

How to Avoid Function Name Conflicts

Name conflicts occur when a function has the same name as a function that has already been defined previously. For example, if you have a get_the_post_terms() function in your theme, and you install a plugin that contains a function with the same name, you'll get something like:

Fatal error: Cannot redeclare get_the_post_terms() (previously declared in....

Unfortunately, this happens much more often than it should. But such conflicts are easy to avoid.

For this we have the following options:

1. Function prefixes

For example, if your plugin is called "WordPress Cool Plugin", you can use the wcc_ prefix for all its functions.

So in the example above, the name of our function would be wcc_get_the_post_terms() .

2. Wrap functions in a class

Perhaps your plugin is so simple that it doesn't even require a class, but you can still create one to organize elements. I particularly like using the singleton design pattern, but take a look at the example below of a simple class with a static method:

class Wcc_Mailer ( static function send($post_ID) ( $friends = " [email protected]"; mail($friends,"New post!", "Check my new post in " . get_permalink($post_ID)); return $post_ID; ) ) add_action("publish_post", array("Wcc_Mailer", "send") );

As you can see, in this example I just used a prefix for the class name, but my function is called "send". This method name is protected from changes through the global namespace; the method itself cannot be called directly. To call it I would need to do the following:

Wcc_Mailer::send($post_id);

Comment code

Code comments are a developer's best friend. You may not want to comment on every function or variable you create, but trust me, as your code grows—especially as it incorporates components of other developers' code—it becomes very difficult to determine what exactly a piece of code does.

Also, as I said, WordPress is a public-facing CMS. Many developers will be working with your code, and leaving hints for them will greatly help them figure out what's what.

Personally, I use PHPDoc syntax for commenting functions, using Sublime + Docblockr this is very easy.

Let's see how the WordPress guys comment the wp_mail() function located in the wp-includes/pluggable.php file:

/** * Sends email messages similar to PHP mail * * Returning true does not automatically mean that the user received * the email. This only means that the method used completed * the request without errors. * * Using the calls "wp_mail_from" and "wp_mail_from_name" allows you to * set the sender's address in the following format "Name" ", * if both hits are specified. If only the "wp_mail_from" hit is used, * the sender address will only indicate email. * * The default content type is "text/plain", which does not allow HTML. * However, you can specify email content type using * the "wp_mail_content_type" filter * * The default encoding corresponds to the encoding used in the blog. Another * encoding can be set using the "wp_mail_charset" filter * * @uses PHPMailer * * @. param string|array $to An array or comma-separated list of email addresses for sending letters. * @param string $subject Subject of the message * @param string $message Message text * @param string|array $headers Optional. param string|array $attachments Optional. Attached files. * @return bool Always when the content of the message was sent successfully */ function wp_mail($to, $subject, $message, $headers = "", $attachments = array() ) ( [....] // Sent! try ( return $phpmailer->Send(); ) catch (phpmailerException $e) ( return false; ) )

As you can see, they describe what the function does, what parameters it needs, and what it returns.
Quite informative, isn't it?

Comments are not intended to be used only with PHP. In HTML, for example, I like to useat the end of large blocks of code, so it's much easier for me to navigate the code later.

In CSS, I use comments to divide the code into different sections.

For example:

/********************* GENERAL STYLES *********************/ body ( font- family: Arial; color: #333 ) /*********************************** ************************* STYLES H1, H2, H3, H4, H5 ************* **************************************** ***/ h1, .h1 ( font-size: 2.5em; line-height: 1em; font-family: $vag-bold; ) /***************** **** NAVIGATION MENU STYLES *********************/ nav ( color:red ) [...]

Safety must be taken very seriously! If your plugin or theme becomes popular, trust me, you don't want thousands of sites to be hacked because of you.

If you think I'm exaggerating, look at Checkmarx research their 2013 ranking of the top 50 WordPress plugins.

Now let's look at some WordPress development security tips:

XSS vulnerabilities

To prevent XSS we must do two things. Check the security of incoming data And check the security of outgoing data.

There are several methods for checking security depending on the data and the context in which it is used. As a general rule, you should not trust any input, and you should not trust any output.

For data input, you can use, for example, sanitize_text_field() , which checks for invalid UTF-8 text, converts single characters into an object<, убирает все теги, удаляет разрывы строк, отступы и лишние пробелы, а также убирает октеты. В зависимости от контекста, существуют разные функции, которые помогут вам обезопасить данные.

The same thing happens when you output data. Take a look at the following example of how a link is rendered:

">

• esc_url rejects invalid URLs, eliminates invalid characters, and removes dangerous characters;
• esc_html encodes & "' when outputting HTML.

Again, depending on the data you have, there are various functions that can help you. For JavaScript you can use esc_js.

In addition to checking the data itself, do not forget to check the date.

Preventing direct access to files

Most hosts provide direct access to files. For your plugin, this means that there will likely be some PHP errors occurring, and these errors will become valuable information for attackers.

To prevent this you can place very simple code at the top of your script:

// Exit if direct access is granted if (! defined("ABSPATH")) exit;

This will generally prevent the script from executing if it is not accessed through WordPress.

Remove all warnings and notifications

It's not just PHP errors that attackers can take advantage of - notices and warnings also include a lot of valuable information for them. Each plugin must be coded using DEBUG mode.

This will also prevent attackers from figuring out outdated functions in your plugin. To enable DEBUG mode simply find this line in your wp-config.php file and set it to TRUE:

define(WP_DEBUG, true);

Use Nonce values

Nonce is an abbreviation for numbers used once, they are used to protect against cross-site cross-site request false requests, or CSRF.

In other words, these are unauthorized or duplicate requests that can result in permanent unwanted or even irreversible changes to the website, particularly the database. This can happen due to the fault of attackers or due to mistakes of trusted users.

Depending on where you need to apply the Nonce value, you can create it in different ways.

For links use wp_nonce_url() :

$complete_url = wp_nonce_url($bare_url, "trash-post", "my_nonce");

For forms - wp_nonce_field() :

wp_nonce_field("trash-post", "my_nonce");

Elsewhere - wp_create_nonce() :

wp_localize_script("my-script", "my-var-name", array("nonce" => wp_create_nonce("trash-post", "my_nonce"));

If you look at the example above you can see how I use wp_localize_script ( which will be discussed in the next article) to include a nonce in a block of JavaScript code. I'm doing this because I plan to later use JQuery to make an AJAX request, and you should always include a nonce in AJAX calls too.

After that, in the script, just to check the nonce, use the following code:

if(! wp_verify_nonce("trash_post" , "my_nonce")) ( die("Busted!"); )

Use WordPress Features and Libraries

Always check if you can do what you need with the core WordPress features and libraries. This way, your scripts will be less vulnerable, and if they contain unsafe parts, WordPress developers will know about it and notify users.

In this article you will learn how to create a website using WordPress. With the help of a step-by-step guide, you will create a high-quality and functional resource suitable for attracting and converting traffic.

Why WordPress – what it is and 5 reasons to use it for a website or blog

WordPress is the most popular content management system (CMS). According to Web Technology Surveys, as of November 2018, this engine powers 32.3% of the total number of existing sites, as well as 59.5% of sites using a CMS. In 2015, WordPress used only 24% of CMS resources. Listed below are the main reasons for the popularity of WordPress.

The free CMS engine WordPress is distributed under an open license agreement (GNU GPL). You are free to use this product for any purpose, including commercial purposes. Almost unlimited possibilities Using WordPress you can create an online store, personal blog, corporate website, information portal, industry resource, multimedia gallery. Flexible customization of appearance and functionality WordPress website owners have access to paid and free templates that can be used to customize the appearance. And with the help of plugins you can solve technical problems and provide the necessary functionality of the site. Ease of administration You don't need any special knowledge to work with WordPress. The principles of working with the engine are clear on an intuitive level. The ability to create a website and publish the first content within 5 minutes Of course, you will have to spend much more time to turn a template product into something new and interesting. But spend no more than 5 minutes on your first publication.

Well, have you decided to make a website on WordPress? Then proceed to the step-by-step guide.

Step No. 1: how to choose hosting and register a domain

If you have a non-profit project, choose free hosting. For example, you can share photos of cats with the world or keep a diary of a young bodybuilder on the WordPress platform. The site address will look like this: primer.wordpress.com. If you are implementing a commercial project, for example, creating a thematic blog, corporate website, or planning to make money using a resource in any way, choose paid hosting.

To choose a reliable hosting provider, . If you don’t have time for this, use the services of one of the companies listed below:

The choice of domain zone does not affect the technical characteristics of the resource or position in search results. However, theoretically, this parameter can influence audience trust. All other things being equal, users are more willing to trust sites with the address vasya-pupkin.ru or vasya-pupkin.com than resources like vasya-pupkin.wordpress.com or vasya-pupkin.blogspot.com. Therefore, for commercial projects, try to choose top-level domains, for example, .com, .info, .org, .net, .ru, .ua, .by, etc. Pay attention to the recently appeared first-level domains, for example, .club, .guru, .ninja, .expert and others.

Step #2: How to Install WordPress Do-It-Yourself

After purchasing hosting and registering a domain name, install WordPress. Please note that some hosting providers offer plans with a pre-installed CMS. If you choose one of them, skip straight to the third step of the guide. If you purchased hosting without an installed engine, follow the instructions:

Go to the WordPress website and download the distribution.

Unpack the archive.

How to Russify a WordPress Theme

It is convenient to Russify a theme using the free program Poedit. Download and install it on your computer. Then download the language files of the selected template to your computer. This will require FTP access. It can be obtained using an FTP client, such as FileZilla, and also using plugins, such as File Manager. If you have installed this plugin, follow the algorithm described below.

In the console, select the FileManager – Configuration menu. Set up the configurations as shown in the illustration.

In the FileManager – FileManager menu, select the wp-content – ​​themes folder.

Select the theme folder you want to Russify. In it, open the languages ​​folder.

Download the en.mo and en.po files to your computer. If there are no such files, download the file with the .pot extension to your computer.

Open Poedit and select the “Create new translation” option.

Open the translation file and specify the language code.

Start translating. In the "Source text" field the program displays the text in English. In the “Translation” field you need to add text in Russian.

Save the translation. The program will download two files to your PC’s hard drive: ru_Ru.mo and ru_RU.po. Use the Upload files function to upload files to the languges folder of your template.

You have Russified the template.

Instead of the Poedit PC program, you can use the Loco Translate plugin. After installing and activating the add-on, the template translation interface appears directly in the site admin panel.

Step No. 5: Solving Practical Problems Using WordPress Plugins

Plugins are one of the problems for novice WordPress website owners. Having barely registered a resource, newly minted webmasters search Yandex for articles like “100 best plugins for WordPress”. They install dozens of extensions. This negatively affects the development of the resource. It's not a matter of slowing down your site, although too many plugins can cause that problem.

The question is the concentration of attention and effort of the site owner. Instead of creating and publishing quality content, he spends hours searching for plugins, installing them and configuring them. Such a webmaster does not see the forest for the trees: he forgets that plugins are needed to solve specific practical problems.

To successfully develop your site, use plugins with caution. Install extensions only when you want to solve a specific problem. Using plugins you can do the following:

• Ensure site security.
• Fight spam.
• Optimize the resource to meet the requirements of search engines.
• Increase functionality and improve usability.

How to Use Plugins to Secure a WordPress Site

The site is exposed to two global threats. The first is yourself. The desire for perfection and innovation can force a webmaster to take risky experiments with code and programs that can lead to the loss of information. You can protect yourself from this by using plugins that create backup copies of your site.

The second threat is unauthorized access to the resource. Attackers may try to gain access to your site in order to install malicious code on it or simply steal it.

To regularly back up your site, use one of the following plugins:

To install the selected plugin, go to the “Plugins – Add New” menu. Enter the name of the extension in the search field in the upper right corner and press Enter. You can also download the plugin from the developer's website and install it using the "Download Plugin" function at the top of the admin panel screen.

Click the "Install" button. After installation, activate the plugin. Now configure your backup settings. Select the "Tools - WP DB BackUp" menu. Click Create New Database BackUp. You have created an on-demand backup.

Set up regular scheduled backups. Go to the Sheduler tab, enable automatic creation of backups, select the frequency of creating archives.

On the Destination tab, enable automatic saving of the archive to Google Drive or sending by email.

To protect your site from unauthorized access, use the Loginizer Security plugin. The add-on reliably protects the site from brute-force or brute-forcing hacking.

How to fight spam on a WordPress site

Anti-spam plugins are relevant if you use the default WordPress commenting system. Third-party commenting systems, such as Disqus, protect themselves from spam.

You can protect yourself from spam using plugins, for example, Akismet or Antispam Bee. After installing Antispam Bee, the plugin runs in the background. Usually the default settings are suitable, but if you need to change something, go to the admin menu “Settings – Antispam Bee”.

How to ensure website SEO on WordPress

WordPress is an SEO-friendly CMS by default. But there are tasks without which a site cannot be considered fully compliant with the requirements of search engines. Here they are:

• Creating and updating a site map.
• URL canonicalization.
• Optimization of title pages.
• Automatic generation of page metadata.
• Blocking indexing of duplicate content.
• Creating micro-page markup.

To solve these problems, you will install one SEO plugin from three groups: programs for creating a sitemap, programs for technical optimization of a resource, and programs for creating micro markup. To create a sitemap, use one of the following plugins:

• Google XML Sitemaps.
• Simple WP Sitemap.
• Google Sitemap.

Google XML Sitemap. To configure the plugin, go to the “Settings – XML-Sitemap” menu.

Beginner webmasters should leave the default settings. After activation, the plugin created a sitemap, added its address to the robots.txt file, and prepared to notify search engines about resource updates.

If you consider yourself an experienced webmaster, you can change the plugin settings. In the Additional Pages section, you can manually include URLs in your sitemap that were not automatically included in your sitemap. In the Article Priority section, determine how content indexing priority is calculated. In the “Change Frequencies” and “Priorities” sections, you can recommend to search robots the types of content that you think are the highest priority.

To technically optimize your resource, use one of the following plugins:

• All in One SEO Pack.
• WordPress SEO by Yoast.
• Platinum SEO Pack.

Install and activate your chosen plugin, for example, All in One SEO Pack. Use the default settings if you are just getting started with WordPress. If you consider yourself an advanced webmaster, you can change some settings of the SEO module. To do this, select the All in One SEO menu in the engine console.

Please note the settings listed below.

In the “Basic Settings” section, uncheck the box next to Use Schema.org Markup. It is better to mark up the page using a separate plugin.

If you use the posts page as the main page, in the “Home Page Settings” section, specify the title, description and keywords. If a static page is used as the main page, check the “Enable” box.

In the “Settings for webmaster” section, enter the resource verification code in the Google webmaster account. To do this, add a new resource to “Webmaster Tools” and select alternative verification methods. Copy the portion of the HTML code shown in the illustration.

Paste it into the “Google Webmaster Tools” field on the plugin setup page.

Save the plugin settings. In the webmasters account, click the “Confirm” button.

To mark up pages, use one of the following plugins:

A combination of WPSSO and WPSSO JSON The first plugin is basic, and the second is an extension. Using the basic solution, you can add Open Graph markup to your site. The second implements Schema.org markup using JSON-LD. WP SEO Structured Data Schema With this plugin, you can add several types of Schema.org markup to your site, including Article, BlogPosting, and Review. The markup is implemented using JSON-LD. Schema App Plugin Using this program, you can add different types of Schema.org markup to your site. It is implemented via JSON-LD. The free version supports basic markup types. You can also implement the markup using the online generator Schema.org JSON-LD Generator.

Install and activate the WPSSO and WPSSO JSON plugins. In the console, on the plugin settings page, in the Essential Settings section, specify information about the site, as well as information for the Open Graph markup. Do not change other settings.

Go to the Schema Markup section. In the Organization Logo Image URL and Organization Banner URL fields, specify the URL of the site logo and banner. These images can be used on the search results page.

Use the drop-down menu to select the base layout type for your blog post page, Static Home Page. You need the following types: Blog and Website respectively.

Select the layout type for publication pages, static pages, and media pages. Article and BlogPosting markup types are suitable for post pages. The choice depends on the format of blog posts.

The BlogPosting markup type is a derivative of Article. In addition to BlogPosting, the Article section includes the News Article or “News” markup type. That is, BlogPosting contains all the semantic data of the Article markup.

Use the BlogPosting type if you publish short notes, personal observations and impressions. Use the Article type if you publish reviews, analytical articles, or guides. Here’s an example: for publications on the Texterra blog, the Article markup type is suitable, and for Ekaterina Bezymyannaya’s diary in LiveJournal, the BlogPosting type is suitable. For static and media pages, set the markup type to WebPage.

After saving the settings, the plugin will automatically add the selected type of markup to the site pages. Including semantic data will appear on existing pages. You can verify this using Google's structured data inspection tool.

What to do if you publish different types of materials: longreads, short notes and news? In this case, it is better to choose the appropriate markup for each publication. Instead of the WPSSO JSON add-on, use the WP SEO Structured Data Schema plugin.

After installing and activating the plugin, an additional section will appear on the post editing page. With it, you can select the type of markup and specify structured data.

The disadvantage of the plugin is the need to mark each publication manually. And the benefits include support for additional markup types, for example, Review, Product and Aggregate Ratings. The free version of WPSSO JSON does not support these types.

How to improve the functionality and usability of a resource

You can and should constantly improve functionality and usability. As noted above, some WordPress site owners are so passionate about this process that they install dozens or even hundreds of plugins. To avoid this mistake, start increasing functionality and improving usability not with plugins, but with identifying the problems and tasks you want to solve.