admin-ajax.php Response Fails When Called from Domain Alias

I’m writing a WordPress plugin that uses AJAX and I had everything setup and working fine for awhile. I came back to the code a few hours later and all of the sudden I was getting a failed response, even though the code hadn’t changed. I got the correct JSON response when I loaded the […]

Continue reading...

Determining WordPress Paths and URLs

I often need to include a directory or URL path when writing a theme or plugin, but I can never find all of the different options in one place, so I’m pulling it together from various Codex pages and xref. Constants ABSPATH – /var/www/vhosts/example.com/httpdocs/ WP_CONTENT_DIR – /var/www/vhosts/example.com/httpdocs/wp-content WP_CONTENT_URL – http://www.example.com/wp-content WP_PLUGIN_DIR – /var/www/vhosts/example.com/httpdocs/wp-content/plugins WP_PLUGIN_URL – http://www.example.com/wp-content/plugins TEMPLATEPATH – /var/www/vhosts/example.com/httpdocs/wp-content/themes/parent-theme STYLESHEETPATH – /var/www/vhosts/example.com/httpdocs/wp-content/themes/child-theme […]

Continue reading...

Using Chained Properties Inside $wpdb->prepare()

If you’re using $wpdb->prepare() to query a custom table, you can’t pass the table name in as an argument because it will be single-quoted, which would be a MySQL syntax error. Instead, you need to insert the variable directly into the double-quoted query string and let PHP parse it out. That creates a new problem, […]

Continue reading...

Capturing WordPress Plugin Activation Errors

If you’re developing a plugin and there are any PHP errors/warnings you’ll get a message like this when you activate it: The plugin generated [x] characters of unexpected output during activation. If you notice “headers already sent” messages, problems with syndication feeds or other issues, try deactivating or removing this plugin. You don’t actually see […]

Continue reading...

Directory Permissions for WordPress under Plesk/Linux

Jason Diehl describes the right way to setup directory permissions on a Linux box running Plesk so that WordPress can automatically create the directories it uses to store uploads. Basically, you need to make sure that PHP’s safe mode is turned off and that wp-content is owned by apache, in the apache group, and chmod’d to 777.

WordPress Plugin and Theme Security

Mark Jaquith recently gave a good presentation on writing secure WordPress themes and plugins at Wordcamp Phoenix 2011. The notes are also available. The main points are: Protect against SQL Injection by using the API whenever possible (because it automatically handles data sanitization). If the API can’t do what you need, use $wpdb->prepare(). Protect against […]

Continue reading...

Comprehensive WordPress Multisite Migrations

Warning: This hasn’t been updated since 2011. It should still be somewhat useful, but you’ll likely need to do additional research and testing on changes since then. Migrating multiple standalone installations of WordPress into Multisite can be relatively easy if you don’t need it to be perfect. The Codex has a basic guide and Stephanie […]

Continue reading...

Home page posts missing when using Pretty Permalinks for WordPress on IIS

I’ve been working on a problem recently with the Pretty Permalinks solution for WordPress on IIS. I was migrating a working WordPress blog from one server to another and once it was on the new server the front page would come up w/ the theme, but instead of the default posts it would say “Sorry, […]

Continue reading...

Protecting Contact Forms From Spam

I’ve had several clients complain about getting spam through their contact forms. Initially, I tried checking the referrers to make sure the comments were being submitted from a browser rather than just a bot, but that didn’t help enough. Luckily, many people have created libraries for Akismet, the anti-spam service that WordPress uses. I setup […]

Continue reading...