Why I Chose HMAC Signing Over Application Passwords for Site-to-Hub Reporting

I’m building an agency dashboard for my monitoring plugin. The shape is simple to describe: the free plugin runs on however many client sites, and each of those sites pushes its health reports to a central hub — a separate premium plugin the agency installs on a WordPress site of their own. Which means N … Read more

The Math That Says Don’t Buy Ads for a $34.99 Plugin

I priced my plugin’s Pro tier at $34.99 a year. That felt right — it’s in line with what comparable WordPress plugins charge, it’s low enough not to require a purchase decision, and it’s a number I’d pay without thinking about it. Then I sat down to plan customer acquisition and worked out what it … Read more

I Found Three Vulnerabilities in My Own Plugin Before Shipping It

Every AJAX handler in my plugin had a nonce check. Every one of them also verified manage_options. I’d been deliberate about that from the start, and when I sat down to do a security pass before submitting to WordPress.org, I expected it to be a formality. It wasn’t. I found two high-severity issues and one … Read more

Six Rejections: What It Actually Takes to Get a Plugin Into the WordPress.org Directory

I built a plugin to solve a problem I kept hitting on client sites. It detects database errors, plugin mass-deactivations, 404 floods, and PHP errors, and it reports them in plain English instead of stack traces. I tested it, I wrote the readme, I packaged it up, and I submitted it to the WordPress.org plugin … Read more

Shipping a Freemius Plugin on WordPress.org Without Getting Rejected

If you landed here from a rejection email that says plugin_updater_detected, skip to the second section. You don’t need to gut your SDK and you don’t need to build a second plugin. If you’re earlier than that — considering Freemius for a plugin you intend to list on WordPress.org — read the whole thing first. … Read more

Your Site Is Returning 200 OK and It Is Completely Broken

Traditional uptime monitoring answers one narrow question: Did the server respond? Most basic uptime checks request a URL—often the homepage—at regular intervals. If the server returns a successful HTTP status such as 200 OK, the dashboard stays green. If it times out or returns a server error, you receive an alert. That model is useful. … Read more

WordPress Plugin Keeps Deactivating After an Update? Check the Database

WordPress Plugins Keep Deactivating at 3 AM? Check the Database There is a specific kind of WordPress problem that can waste an entire afternoon. A plugin deactivates after an update. You reactivate it. Everything looks fine. Then it deactivates again. There may be no fatal error on screen. The site still loads normally for visitors. … Read more

Debug Log

Quick answer: The WordPress debug log records PHP errors, warnings and notices to a file. Turning it on takes three lines in wp-config.php. Reading it usefully means knowing which severity levels matter, which are safe to ignore, and never leaving errors displayed on a live site. The debug log is the closest thing WordPress has … Read more