WordPress for Developers
Nonces Are Not Authentication: What They Actually Protect
WordPress nonces protect against CSRF, not authentication or authorization. See how capability checks, sanitization, Ajax, and REST security fit together.
Ebuhu articles
Blog
Practical programming and artificial intelligence guides for developers and coding learners.
WordPress for Developers
Sanitize, Escape, Validate: Which One, Where, and Why Order Matters
Validate input, sanitize before storage, and escape at output. Understand where each step belongs in WordPress and PHP and why the order matters for…
WordPress for Developers
Why Editing functions.php Keeps Destroying Your Site
One typo in functions.php takes down the front end and the admin together. How to get back in, why it happens, and the change…
WordPress for Developers
Your First Real Plugin: Headers, Structure and Not Using functions.php
Build your first real WordPress plugin with proper headers, structure, naming, activation hooks, and site-specific code that survives theme changes.
WordPress for Developers
The init Hook Is Too Late: Choosing the Right Hook for the Job
There are hundreds of hooks and you need one. Choose by what must already exist when your code runs, not by what the last…
WordPress for Developers
Hook Priority: Why Your Callback Fires Too Early
Priority decides order inside one hook, not across hooks. Why 999 is not a fix, what happens on a tie, and how to find…
WordPress for Developers
Actions and Filters: The Difference That Trips Everyone Up
A filter is asked for a value and an action is not. Why returning something from an action does nothing, why forgetting to return…
Reading the Error
Building a Minimal Reproduction Before You Ask Anyone
Learn how to build a minimal reproduction by isolating code, data, dependencies, and configuration so you can find bugs faster and report them clearly.
WordPress for Developers
How to Convert a WordPress Single Site to a Directory-Based Multisite
Learn how to convert a live WordPress single site into a directory-based Multisite using WP-CLI, with backups, rewrite rules, database checks, and testing.
WordPress for Developers
WordPress Execution Order: What Runs, and When
The request lifecycle from the front controller to wp_footer, which hook is available at each stage, and why the right code on the wrong…
Reading the Error
No Error, Wrong Answer: Debugging Silent Failure in PHP
Nothing crashed and the output is still wrong. How to find a silent failure by locating the first point where the data stops matching…
Reading the Error
The Error Line Is Not Where the Bug Is
An error line tells you where the failure surfaced, not always where the bug began. Learn how to trace PHP and WordPress errors back…
Reading the Error
WP_DEBUG_LOG Without Displaying Errors to Visitors
Learn how to use WP_DEBUG_LOG to capture WordPress errors in debug.log while keeping PHP warnings and error messages hidden from site visitors.
Reading the Error
Reading a WordPress Debug Log and Naming the Guilty Code
How to read a WordPress debug.log, cut a huge file down to the entries that matter, and work out which plugin or theme the…
Reading the Error
CORS Error on Localhost: Fix It From the Right Side
A CORS error names the browser blocking the response, not the server. Here is how to tell whose fault it is and fix it…