A WordPress security checklist for small sites
Most WordPress sites are compromised through the same few gaps. This is the checklist I run on small sites, roughly in order of impact.
Category: WordPress
Custom WordPress themes, Gutenberg blocks, Secure Custom Fields and theme security.
Building an SCF block with block.json, step by step
A complete walkthrough of a Secure Custom Fields block: block.json, a field group, a PHP render template and a preview that matches the front end.
Core Web Vitals for WordPress: fixing LCP, CLS and INP
Most slow WordPress sites fail Core Web Vitals for the same handful of reasons. Here's what each metric measures and the fixes that actually move it.
theme.json in a classic WordPress theme: what it’s good for
You don't need a block theme to benefit from theme.json. In a classic theme it gives you one palette, consistent presets and a tidier editor.
Escaping output in WordPress themes: the short version
Escape late, escape for the context you are printing into. A quick reference for the functions I use every day.
Responsive images in WordPress: srcset, sizes and lazy loading
WordPress generates responsive image markup for you, but the sizes attribute and loading priority still need your attention.
SCF blocks vs React blocks: choosing a Gutenberg approach
Not every custom block needs a React build pipeline. Here is how I decide between Secure Custom Fields blocks and native JavaScript blocks.