Where Older Books and Tutorials Are Outdated

WordPress.org Plugins: Two Factor

Tutorials: 7.0 brings AI features to every site

7.0 added the AI Client and Settings > Connectors, but no provider is bundled; provider plugins are separate, and the Secrets API for stored credentials is planned for 7.2

7.0

AI Client and Connectors

Make WordPress Core: Introducing the AI Client in WordPress 7.0

Installation and hosting

Older claim Current state Since Covered in Official source

Older claim	Current state	Since	Covered in	Official source
All-in-One: `wp-config.php` ends with a closing `?>` tag	The shipped sample has no closing tag, the PHP convention for code-only files; a stray byte after `?>` causes "headers already sent" errors	Always	Installation	Advanced Administration Handbook: wp-config.php
All-in-One: check PHP Safe Mode when uploads or installs fail	Safe Mode was removed from PHP itself in 5.4 (2012); no supported PHP version has it	PHP 5.4	Requirements and Hosting	PHP: PHP 5.4.0 Release Announcement
Pro WordPress: change `ABSPATH` when moving `wp-config.php` one level up	`wp-load.php` finds the file one level above the WordPress directory on its own; `ABSPATH` must not be edited, and the security benefit of the move is disputed	Always	wp-config.php Reference	Advanced Administration Handbook: Hardening WordPress
All-in-One, Ultimate Handbook: protect files with `Order`, `Allow` and `Deny`	Apache 2.4 uses `Require all denied`; the 2.2 directives need `mod_access_compat`, and mixing both styles is discouraged	Apache 2.4	Web Servers: Apache and nginx	Apache HTTP Server 2.4: Upgrading to 2.4 from 2.2
Tutorials: pretty permalinks require `mod_rewrite`	Only on Apache; nginx needs one `try_files` line and no `.htaccess`, and the rules stay in PHP	Always	Rewrite API and Permalinks	Advanced Administration Handbook: nginx
All-in-One: a desktop install is a "local staging" site	Staging runs on the production stack; a laptop differs in web server, PHP build, cache and permissions. Mark each environment with `WP_ENVIRONMENT_TYPE`	5.5	Local Development Environments	Make WordPress Core: New wp_get_environment_type() function in WordPress 5.5
Tutorials: run the local site with `wp-now`	`@wp-now/wp-now` is deprecated; the Playground CLI (`@wp-playground/cli`) has an equivalent for every option	2026	Playground and Blueprints	Playground documentation: Playground CLI
Tutorials: Docker Compose files with `version:`, `links:`, `mysql:5.7` and unpinned `wordpress:latest`	Current Compose ignores `version` and resolves service names without `links`; MySQL 5.7 is end-of-life; pin a WordPress version tag and a supported database image	2023	Containers, Docker and Kubernetes	Docker Hub: wordpress
Tutorials: back up the database with `mysqldump`	On MariaDB 11 the tool is `mariadb-dump` (`mysqldump` is a deprecated alias missing from the container image); `wp db export` uses whichever exists	MariaDB 11	Backups and Disaster Recovery	MariaDB Documentation: mariadb-dump

All-in-One: wp-config.php ends with a closing ?> tag

The shipped sample has no closing tag, the PHP convention for code-only files; a stray byte after ?> causes "headers already sent" errors

Always

Installation

Advanced Administration Handbook: wp-config.php

All-in-One: check PHP Safe Mode when uploads or installs fail

Safe Mode was removed from PHP itself in 5.4 (2012); no supported PHP version has it

PHP 5.4

Requirements and Hosting

PHP: PHP 5.4.0 Release Announcement

Pro WordPress: change ABSPATH when moving wp-config.php one level up

wp-load.php finds the file one level above the WordPress directory on its own; ABSPATH must not be edited, and the security benefit of the move is disputed

Always

Advanced Administration Handbook: Hardening WordPress

All-in-One, Ultimate Handbook: protect files with Order, Allow and Deny

Apache 2.4 uses Require all denied; the 2.2 directives need mod_access_compat, and mixing both styles is discouraged

Apache 2.4

Web Servers: Apache and nginx

Apache HTTP Server 2.4: Upgrading to 2.4 from 2.2

Tutorials: pretty permalinks require mod_rewrite

Only on Apache; nginx needs one try_files line and no .htaccess, and the rules stay in PHP

Always

Rewrite API and Permalinks

Advanced Administration Handbook: nginx

All-in-One: a desktop install is a "local staging" site

Staging runs on the production stack; a laptop differs in web server, PHP build, cache and permissions. Mark each environment with WP_ENVIRONMENT_TYPE

5.5

Local Development Environments

Make WordPress Core: New wp_get_environment_type() function in WordPress 5.5

Tutorials: run the local site with wp-now

@wp-now/wp-now is deprecated; the Playground CLI (@wp-playground/cli) has an equivalent for every option

2026

Playground and Blueprints

Playground documentation: Playground CLI

Tutorials: Docker Compose files with version:, links:, mysql:5.7 and unpinned wordpress:latest

Current Compose ignores version and resolves service names without links; MySQL 5.7 is end-of-life; pin a WordPress version tag and a supported database image

2023

Containers, Docker and Kubernetes

Docker Hub: wordpress

Tutorials: back up the database with mysqldump

On MariaDB 11 the tool is mariadb-dump (mysqldump is a deprecated alias missing from the container image); wp db export uses whichever exists

MariaDB 11

Backups and Disaster Recovery

MariaDB Documentation: mariadb-dump

Administration and wp-config.php

Older claim Current state Since Covered in Official source

Older claim	Current state	Since	Covered in	Official source
All-in-One: `DISALLOW_FILE_MODS` turns off updates	It also blocks installing, uploading and deleting plugins and themes, removes the file editors and stops the background updater, security releases included; `DISALLOW_FILE_EDIT` removes only the editors	Always	Updates and Auto-Updates	Advanced Administration Handbook: wp-config.php, Disable Plugin and Theme Update and Installation
Tutorials: only minor core releases install themselves	Sites installed on 5.6 or later also receive major releases unless a VCS checkout or a policy says otherwise; plugins and themes auto-update when opted in (5.5)	5.6	Updates and Auto-Updates	Make WordPress Core: Auto-updates interface for core major versions in 5.6
Tutorials: a failed plugin auto-update leaves the site broken	An active plugin that causes a fatal error after an automatic update is rolled back (this needs working loopback requests); failed manual installs restore the old copy since 6.3	6.6	Choosing and Managing Plugins and Themes	Make WordPress Core: Merge proposal, Rollback Auto-Update
Tutorials: put update filters in `wp-config.php`	Filters belong in a must-use plugin; `wp-config.php` runs before the Plugin API is loaded and conflicts with WP-CLI	Always	Updates and Auto-Updates	Advanced Administration Handbook: Configuring Automatic Background Updates
Ultimate Handbook: a `WP_ADMIN_EMAIL` constant sets the administration address	No such constant exists; the `admin_email` option changes through Settings > General (with e-mail confirmation), the REST API or WP-CLI. Only recovery mode has `RECOVERY_MODE_EMAIL`	Always	Settings Screens	WordPress.org Documentation: Settings General Screen
Ultimate Handbook: `WP_USE_EXT_MYSQL` selects the database driver	PHP 7.0 removed the old `mysql` extension; WordPress connects only through `mysqli`, and the constant has no effect	PHP 7.0	WP_Query and the Database API	PHP Manual: Removed extensions and SAPIs in PHP 7.0
Ultimate Handbook: define `WP_ALLOW_REPAIR` to regain a locked-out account	It only checks, repairs and optimises tables, and exposes `/wp-admin/maint/repair.php` without login while defined	Always	wp-config.php Reference	Advanced Administration Handbook: wp-config.php
Pro WordPress: encrypt the values in `wp-config.php`	PHP must read them in clear text on every request; protect the file with permissions and location, or keep the secrets out of it in environment variables or a secret manager	Always	wp-config.php Reference	Advanced Administration Handbook: Hardening WordPress
All-in-One: the memory defaults for single sites and Multisite	`WP_MEMORY_LIMIT` defaults to `40M` (`64M` on Multisite) and `WP_MAX_MEMORY_LIMIT` to `256M`; they only raise PHP’s limit where the host allows it	Always	wp-config.php Reference	Advanced Administration Handbook: wp-config.php
Tutorials: turn on `WP_DEBUG` to see errors	On its own it prints errors to every visitor (`WP_DEBUG_DISPLAY` defaults to `true`); log with `WP_DEBUG_LOG` outside the web root and keep display off in production	Always	Debugging, Site Health and Troubleshooting	Advanced Administration Handbook: Debugging in WordPress
Tutorials: a fatal error means a white screen and FTP	The fatal error handler shows a critical-error message and e-mails a recovery-mode link when the fault is in a plugin or theme	5.2	Debugging, Site Health and Troubleshooting	Make WordPress Core: Fatal Error Recovery Mode in 5.2
Tutorials: move a site with SQL `REPLACE()` over the database	Breaks serialized data; `wp search-replace` handles it, and the GUID column is left alone	Always	Importing, Exporting and Migrating	WP-CLI Commands: wp search-replace
Pro WordPress: choose the editor in Settings > Writing	Core has no such setting; the Classic Editor plugin adds the choice, and code uses the `use_block_editor_for_post_type` filter	5.0	Block Editor for Authors	WordPress.org Documentation: Settings Writing Screen
All-in-One: Tools offers Press This	Press This left core in 4.9 and is a separate plugin; importers are plugins too	4.9	Dashboard and Admin Screens	WordPress.org Plugins: Press This
Tutorials: "Discourage search engines" adds `Disallow: /` to `robots.txt`	Since 5.3 it prints a `noindex` robots meta tag instead, so crawlers can see the directive	5.3	Settings Screens	Make WordPress Core: Changes to prevent search engines indexing sites
Tutorials: Comment Blacklist and comment whitelist settings	Renamed Disallowed Comment Keys (`disallowed_keys`) and `comment_previously_approved`; blocklisted comments go to the Trash	5.5	Categories, Tags and Comments	Make WordPress Core: Codebase language improvements in 5.5
Tutorials: options are autoloaded `yes` or `no`, and new options autoload by default	The column holds `on`, `off`, `auto`, `auto-on` or `auto-off`; large options are not autoloaded, and `yes`/`no` are deprecated since 6.7	6.6	Options, Transients and Object Cache	Make WordPress Core: Options API, disabling autoload for large options
Tutorials: resize photos before uploading them	WordPress scales images above 2560 px and keeps the original (5.3), converts HEIC to JPEG (6.7) and, since 7.1, resizes in supporting browsers before upload	5.3	Media Library	Make WordPress Core: Handling of big images in WordPress 5.3
All-in-One, Ultimate Handbook: admin screenshots of 6.3 to 6.6	The Modern colour scheme is the default (7.0), the Command Palette works on every screen (6.9), Appearance > Fonts is a standalone page (7.0) and the toolbar stays visible in the editors (7.1)	7.0	Dashboard and Admin Screens	Make WordPress Core: WordPress 7.0 Field Guide

All-in-One: DISALLOW_FILE_MODS turns off updates

It also blocks installing, uploading and deleting plugins and themes, removes the file editors and stops the background updater, security releases included; DISALLOW_FILE_EDIT removes only the editors

Always

Updates and Auto-Updates

Advanced Administration Handbook: wp-config.php, Disable Plugin and Theme Update and Installation

Tutorials: only minor core releases install themselves

Sites installed on 5.6 or later also receive major releases unless a VCS checkout or a policy says otherwise; plugins and themes auto-update when opted in (5.5)

5.6

Updates and Auto-Updates

Make WordPress Core: Auto-updates interface for core major versions in 5.6

Tutorials: a failed plugin auto-update leaves the site broken

An active plugin that causes a fatal error after an automatic update is rolled back (this needs working loopback requests); failed manual installs restore the old copy since 6.3

6.6

Choosing and Managing Plugins and Themes

Make WordPress Core: Merge proposal, Rollback Auto-Update

Tutorials: put update filters in wp-config.php

Filters belong in a must-use plugin; wp-config.php runs before the Plugin API is loaded and conflicts with WP-CLI

Always

Updates and Auto-Updates

Advanced Administration Handbook: Configuring Automatic Background Updates

Ultimate Handbook: a WP_ADMIN_EMAIL constant sets the administration address

No such constant exists; the admin_email option changes through Settings > General (with e-mail confirmation), the REST API or WP-CLI. Only recovery mode has RECOVERY_MODE_EMAIL

Always

Settings Screens

WordPress.org Documentation: Settings General Screen

Ultimate Handbook: WP_USE_EXT_MYSQL selects the database driver

PHP 7.0 removed the old mysql extension; WordPress connects only through mysqli, and the constant has no effect

PHP 7.0

WP_Query and the Database API

PHP Manual: Removed extensions and SAPIs in PHP 7.0

Ultimate Handbook: define WP_ALLOW_REPAIR to regain a locked-out account

It only checks, repairs and optimises tables, and exposes /wp-admin/maint/repair.php without login while defined

Always

Advanced Administration Handbook: wp-config.php

Pro WordPress: encrypt the values in wp-config.php

PHP must read them in clear text on every request; protect the file with permissions and location, or keep the secrets out of it in environment variables or a secret manager

Always

Advanced Administration Handbook: Hardening WordPress

All-in-One: the memory defaults for single sites and Multisite

WP_MEMORY_LIMIT defaults to 40M (64M on Multisite) and WP_MAX_MEMORY_LIMIT to 256M; they only raise PHP’s limit where the host allows it

Always

Advanced Administration Handbook: wp-config.php

Tutorials: turn on WP_DEBUG to see errors

On its own it prints errors to every visitor (WP_DEBUG_DISPLAY defaults to true); log with WP_DEBUG_LOG outside the web root and keep display off in production

Always

Debugging, Site Health and Troubleshooting

Advanced Administration Handbook: Debugging in WordPress

Tutorials: a fatal error means a white screen and FTP

The fatal error handler shows a critical-error message and e-mails a recovery-mode link when the fault is in a plugin or theme

5.2

Debugging, Site Health and Troubleshooting

Make WordPress Core: Fatal Error Recovery Mode in 5.2

Tutorials: move a site with SQL REPLACE() over the database

Breaks serialized data; wp search-replace handles it, and the GUID column is left alone

Always

Importing, Exporting and Migrating

WP-CLI Commands: wp search-replace

Pro WordPress: choose the editor in Settings > Writing

Core has no such setting; the Classic Editor plugin adds the choice, and code uses the use_block_editor_for_post_type filter

5.0

Block Editor for Authors

WordPress.org Documentation: Settings Writing Screen

All-in-One: Tools offers Press This

Press This left core in 4.9 and is a separate plugin; importers are plugins too

4.9

Dashboard and Admin Screens

WordPress.org Plugins: Press This

Tutorials: "Discourage search engines" adds Disallow: / to robots.txt

Since 5.3 it prints a noindex robots meta tag instead, so crawlers can see the directive

5.3

Settings Screens

Make WordPress Core: Changes to prevent search engines indexing sites

Tutorials: Comment Blacklist and comment whitelist settings

Renamed Disallowed Comment Keys (disallowed_keys) and comment_previously_approved; blocklisted comments go to the Trash

5.5

Categories, Tags and Comments

Make WordPress Core: Codebase language improvements in 5.5

Tutorials: options are autoloaded yes or no, and new options autoload by default

The column holds on, off, auto, auto-on or auto-off; large options are not autoloaded, and yes/no are deprecated since 6.7

6.6

Options, Transients and Object Cache

Make WordPress Core: Options API, disabling autoload for large options

Tutorials: resize photos before uploading them

WordPress scales images above 2560 px and keeps the original (5.3), converts HEIC to JPEG (6.7) and, since 7.1, resizes in supporting browsers before upload

5.3

Media Library

Make WordPress Core: Handling of big images in WordPress 5.3

All-in-One, Ultimate Handbook: admin screenshots of 6.3 to 6.6

The Modern colour scheme is the default (7.0), the Command Palette works on every screen (6.9), Appearance > Fonts is a standalone page (7.0) and the toolbar stays visible in the editors (7.1)

7.0

Dashboard and Admin Screens

Make WordPress Core: WordPress 7.0 Field Guide

Security

Older claim Current state Since Covered in Official source

Older claim	Current state	Since	Covered in	Official source
All-in-One: set 666 or 777 when uploads or installs fail	644 for files, 755 for directories, 440 or 400 for `wp-config.php`; the real fix is ownership, and 777 still fails the filesystem method test	Always	File Permissions and Filesystem	Advanced Administration Handbook: Hardening, Changing file permissions
Tutorials: passwords are stored as phpass (MD5-based) hashes	bcrypt with a pre-hash, prefixed `$wp$2y$`; old hashes are rehashed at the next login, and application passwords use BLAKE2b	6.8	Authentication and Login API	Make WordPress Core: WordPress 6.8 will use bcrypt for password hashing
Tutorials: reset a lost password by writing an MD5 hash in phpMyAdmin	Still accepted once and rehashed, but legacy; use "Lost your password?", `wp user reset-password` or `wp user update` with `--user_pass`	6.8	Users, Roles and Profiles	WP-CLI Commands: wp user reset-password
Tutorials: WordPress enforces strong passwords	It shows a strength meter and asks to confirm a weak password; enforcement needs a plugin or SSO	Always	Users, Roles and Profiles	WordPress.org Documentation: Users Your Profile Screen
Tutorials: scripts and apps need the user’s real password or a Basic Auth plugin	Application passwords are built in: HTTPS-only by default, REST API and XML-RPC only, never `wp-login.php`, revocable one by one	5.6	REST API: Using It	Make WordPress Core: Application Passwords Integration Guide
Tutorials: `system.multicall` lets one request try hundreds of passwords	Since 4.4 the first failed login in a request makes the rest fail; disable XML-RPC when unused and rate-limit `wp-login.php` and `xmlrpc.php` at the server	4.4	Security Hardening	Advanced Administration Handbook: Brute Force Attacks
Tutorials: hide or rename the login URL to stop attacks	Obscurity, not a defense; rate limiting, strong passwords and two-factor login are	Always	Security Hardening	Advanced Administration Handbook: Brute Force Attacks
Tutorials: install iThemes Security	The same WordPress.org plugin was renamed Solid Security (9.0) and then Kadence Security (10.0)	Plugin 10.0	Security Hardening	WordPress.org Plugins: Kadence Security
Pro WordPress: an `admin-ajax.php` handler called from jQuery with no nonce	Any site can make a logged-in browser post to it (CSRF); check `check_ajax_referer()` and `current_user_can()`, or use a REST route with a `permission_callback`	Always	Security for Developers	Plugin Handbook: Nonces
Ultimate Handbook: a Customizer setting without `sanitize_callback`, printed with `get_theme_mod()` unescaped	Every setting has a `sanitize_callback`, and output is escaped late with `esc_html()`, `esc_attr()` or `esc_url()`	Always	Customizer API	Common APIs Handbook: Escaping Data
Tutorials: `is_admin()` checks that the user is an administrator	It tells whether an admin screen is loading; check a capability with `current_user_can()`	Always	Roles and Capabilities API	Plugin Handbook: Checking User Capabilities
Tutorials: `esc_sql()` or `addslashes()` makes a query safe	`$wpdb->prepare()` with unquoted placeholders, `%i` for identifiers, and `esc_like()` for `LIKE`	6.2	WP_Query and the Database API	Code Reference: wpdb::prepare()

All-in-One: set 666 or 777 when uploads or installs fail

644 for files, 755 for directories, 440 or 400 for wp-config.php; the real fix is ownership, and 777 still fails the filesystem method test

Always

File Permissions and Filesystem

Advanced Administration Handbook: Hardening, Changing file permissions

Tutorials: passwords are stored as phpass (MD5-based) hashes

bcrypt with a pre-hash, prefixed $wp$2y$; old hashes are rehashed at the next login, and application passwords use BLAKE2b

6.8

Authentication and Login API

Make WordPress Core: WordPress 6.8 will use bcrypt for password hashing

Tutorials: reset a lost password by writing an MD5 hash in phpMyAdmin

Still accepted once and rehashed, but legacy; use "Lost your password?", wp user reset-password or wp user update with --user_pass

6.8

Users, Roles and Profiles

WP-CLI Commands: wp user reset-password

Tutorials: WordPress enforces strong passwords

It shows a strength meter and asks to confirm a weak password; enforcement needs a plugin or SSO

Always

Users, Roles and Profiles

WordPress.org Documentation: Users Your Profile Screen

Tutorials: scripts and apps need the user’s real password or a Basic Auth plugin

Application passwords are built in: HTTPS-only by default, REST API and XML-RPC only, never wp-login.php, revocable one by one

5.6

REST API: Using It

Make WordPress Core: Application Passwords Integration Guide

Tutorials: system.multicall lets one request try hundreds of passwords

Since 4.4 the first failed login in a request makes the rest fail; disable XML-RPC when unused and rate-limit wp-login.php and xmlrpc.php at the server

4.4

Advanced Administration Handbook: Brute Force Attacks

Tutorials: hide or rename the login URL to stop attacks

Obscurity, not a defense; rate limiting, strong passwords and two-factor login are

Always

Advanced Administration Handbook: Brute Force Attacks

Tutorials: install iThemes Security

The same WordPress.org plugin was renamed Solid Security (9.0) and then Kadence Security (10.0)

Plugin 10.0

WordPress.org Plugins: Kadence Security

Pro WordPress: an admin-ajax.php handler called from jQuery with no nonce

Any site can make a logged-in browser post to it (CSRF); check check_ajax_referer() and current_user_can(), or use a REST route with a permission_callback

Always

Security for Developers

Plugin Handbook: Nonces

Ultimate Handbook: a Customizer setting without sanitize_callback, printed with get_theme_mod() unescaped

Every setting has a sanitize_callback, and output is escaped late with esc_html(), esc_attr() or esc_url()

Always

Customizer API

Common APIs Handbook: Escaping Data

Tutorials: is_admin() checks that the user is an administrator

It tells whether an admin screen is loading; check a capability with current_user_can()

Always

Roles and Capabilities API

Plugin Handbook: Checking User Capabilities

Tutorials: esc_sql() or addslashes() makes a query safe

$wpdb->prepare() with unquoted placeholders, %i for identifiers, and esc_like() for LIKE

6.2

WP_Query and the Database API

Code Reference: wpdb::prepare()

Performance

Older claim Current state Since Covered in Official source

Older claim	Current state	Since	Covered in	Official source
Pro WordPress: concatenate CSS and JavaScript and use image sprites	Under HTTP/2 and HTTP/3 small cached files share one connection; ship minified files from a build step, use `defer`, per-block CSS and inline SVG icons	HTTP/2	Performance and Caching	Advanced Administration Handbook: Optimization
Pro WordPress: tune the MySQL query cache	Removed in MySQL 8.0; MariaDB keeps one, off by default and poor under concurrent writes. Use a persistent object cache and the InnoDB buffer pool	MySQL 8.0	Scaling and High Availability	MariaDB Knowledge Base: Query Cache
Ultimate Handbook: use HTTP/2 Server Push for critical assets	Removed from Chrome (106) and Firefox (132); use `fetchpriority`, `<link rel="preload">` or 103 Early Hints	2022	Web Servers: Apache and nginx	Chrome for Developers: Remove HTTP/2 Server Push from Chrome
Ultimate Handbook: lazy-load with a plugin, or a filter for iframes	Native `loading="lazy"` for images (5.5) and iframes (5.7), `fetchpriority` and no lazy loading for the first images (6.3), `sizes="auto"` (6.7); a second library tends to lazy-load the LCP image	5.5	Images and Media API	Make WordPress Core: Image performance enhancements in WordPress 6.3
Tutorials: move every script to the footer	Register with `'strategy' => 'defer'` (or `async`) and keep it in the head without blocking	6.3	functions.php, Theme Supports and Assets	Make WordPress Core: Registering scripts with async and defer attributes in 6.3
Tutorials: prefetching or prerendering needs a plugin	Core adds speculative loading rules (`prefetch` with `conservative` eagerness by default); since 7.1 they are configurable by constants or environment variables	6.8	Performance and Caching	Make WordPress Core: Speculative Loading in 6.8
Tutorials: a page-caching plugin is enough	Page caches serve anonymous visitors only; logged-in users, the admin and the REST API need a persistent object cache, OPcache and lean autoloaded options	Always	Options, Transients and Object Cache	Advanced Administration Handbook: Cache
Tutorials: set `DISABLE_WP_CRON` to speed the site up	Only together with a system cron; alone it stops scheduled posts, update checks and clean-up. Since 6.9 the spawn runs on `shutdown`, after the page is sent	6.9	WP-Cron and Scheduled Tasks	Plugin Handbook: Hooking WP-Cron Into the System Task Scheduler
Ultimate Handbook: add an index on `wp_posts.post_name`	Core already creates it; a lookup by slug uses the `post_name` index	Always	WP_Query and the Database API	wordpress-develop: wp-admin/includes/schema.php
Tutorials: HyperDB for read replicas	Not updated since 2022; LudicrousDB is the maintained fork	2022	Scaling and High Availability	WordPress.org Plugins: HyperDB
Tutorials: optimise for First Input Delay	Interaction to Next Paint replaced FID as a Core Web Vital in March 2024	2024	Performance and Caching	web.dev: Web Vitals

Pro WordPress: concatenate CSS and JavaScript and use image sprites

Under HTTP/2 and HTTP/3 small cached files share one connection; ship minified files from a build step, use defer, per-block CSS and inline SVG icons

HTTP/2

Advanced Administration Handbook: Optimization

Pro WordPress: tune the MySQL query cache

Removed in MySQL 8.0; MariaDB keeps one, off by default and poor under concurrent writes. Use a persistent object cache and the InnoDB buffer pool

MySQL 8.0

Scaling and High Availability

MariaDB Knowledge Base: Query Cache

Ultimate Handbook: use HTTP/2 Server Push for critical assets

Removed from Chrome (106) and Firefox (132); use fetchpriority, <link rel="preload"> or 103 Early Hints

2022

Web Servers: Apache and nginx

Chrome for Developers: Remove HTTP/2 Server Push from Chrome

Ultimate Handbook: lazy-load with a plugin, or a filter for iframes

Native loading="lazy" for images (5.5) and iframes (5.7), fetchpriority and no lazy loading for the first images (6.3), sizes="auto" (6.7); a second library tends to lazy-load the LCP image

5.5

Images and Media API

Make WordPress Core: Image performance enhancements in WordPress 6.3

Tutorials: move every script to the footer

6.3

functions.php, Theme Supports and Assets

Make WordPress Core: Registering scripts with async and defer attributes in 6.3

Tutorials: prefetching or prerendering needs a plugin

Core adds speculative loading rules (prefetch with conservative eagerness by default); since 7.1 they are configurable by constants or environment variables

6.8

Make WordPress Core: Speculative Loading in 6.8

Tutorials: a page-caching plugin is enough

Page caches serve anonymous visitors only; logged-in users, the admin and the REST API need a persistent object cache, OPcache and lean autoloaded options

Always

Options, Transients and Object Cache

Advanced Administration Handbook: Cache

Tutorials: set DISABLE_WP_CRON to speed the site up

Only together with a system cron; alone it stops scheduled posts, update checks and clean-up. Since 6.9 the spawn runs on shutdown, after the page is sent

6.9

WP-Cron and Scheduled Tasks

Plugin Handbook: Hooking WP-Cron Into the System Task Scheduler

Ultimate Handbook: add an index on wp_posts.post_name

Core already creates it; a lookup by slug uses the post_name index

Always

WP_Query and the Database API

wordpress-develop: wp-admin/includes/schema.php

Tutorials: HyperDB for read replicas

Not updated since 2022; LudicrousDB is the maintained fork

2022

Scaling and High Availability

WordPress.org Plugins: HyperDB

Tutorials: optimise for First Input Delay

Interaction to Next Paint replaced FID as a Core Web Vital in March 2024

2024

web.dev: Web Vitals

SEO

Older claim Current state Since Covered in Official source

Older claim	Current state	Since	Covered in	Official source
All-in-One: ping search engines with the sitemap after publishing	Google retired the sitemap ping endpoint (announced June 2023); list the sitemap in `robots.txt` and submit it in Search Console	2023	SEO, Analytics and Privacy	Google Search Central Blog: Sitemaps ping endpoint is going away
All-in-One: use the `link:` search operator to find backlinks	No longer supported; use the Links report in Search Console	2017	SEO, Analytics and Privacy	Search Console Help: Links report
Pro WordPress: the sitemap is at `/sitemap.xml`	Core’s index is `/wp-sitemap.xml`; SEO plugins use their own names, announced in `robots.txt`	5.5	SEO, Analytics and Privacy	Make WordPress Core: New XML Sitemaps Functionality in WordPress 5.5
Pro WordPress: validate markup in the Structured Data Testing Tool	Retired; use the Rich Results Test and the Schema Markup Validator	2021	SEO, Analytics and Privacy	Google Search Central: Introduction to structured data
Ultimate Handbook: set `priority` and `changefreq` for each sitemap URL	Google ignores both and uses `lastmod` when it is consistently accurate	2023	SEO, Analytics and Privacy	Google Search Central: Build and submit a sitemap
Ultimate Handbook: build AMP pages to rank or reach Top Stories	AMP is not required for any Google Search feature; core has no AMP output, and the AMP plugin is an extra template layer	2021	SEO, Analytics and Privacy	WordPress.org Plugins: AMP
Ultimate Handbook: turn on IP anonymization in Google Analytics	A Universal Analytics setting; GA4 does not log or store IP addresses, and consent settings are what matter	2023	SEO, Analytics and Privacy	Analytics Help: IP masking in Google Analytics
Tutorials: submit the site to directories and link exchanges	Links exchanged or bought to manipulate ranking are spam; mark paid links `rel="sponsored"`	Always	SEO, Analytics and Privacy	Google Search Central: Spam policies

All-in-One: ping search engines with the sitemap after publishing

Google retired the sitemap ping endpoint (announced June 2023); list the sitemap in robots.txt and submit it in Search Console

2023

Google Search Central Blog: Sitemaps ping endpoint is going away

All-in-One: use the link: search operator to find backlinks

No longer supported; use the Links report in Search Console

2017

Search Console Help: Links report

Pro WordPress: the sitemap is at /sitemap.xml

Core’s index is /wp-sitemap.xml; SEO plugins use their own names, announced in robots.txt

5.5

Make WordPress Core: New XML Sitemaps Functionality in WordPress 5.5

Pro WordPress: validate markup in the Structured Data Testing Tool

Retired; use the Rich Results Test and the Schema Markup Validator

2021

Google Search Central: Introduction to structured data

Ultimate Handbook: set priority and changefreq for each sitemap URL

Google ignores both and uses lastmod when it is consistently accurate

2023

Google Search Central: Build and submit a sitemap

Ultimate Handbook: build AMP pages to rank or reach Top Stories

AMP is not required for any Google Search feature; core has no AMP output, and the AMP plugin is an extra template layer

2021

WordPress.org Plugins: AMP

Ultimate Handbook: turn on IP anonymization in Google Analytics

A Universal Analytics setting; GA4 does not log or store IP addresses, and consent settings are what matter

2023

Analytics Help: IP masking in Google Analytics

Tutorials: submit the site to directories and link exchanges

Links exchanged or bought to manipulate ranking are spam; mark paid links rel="sponsored"

Always

Google Search Central: Spam policies

Multisite

Older claim Current state Since Covered in Official source

Older claim	Current state	Since	Covered in	Official source
Pro WordPress: map domains with the WordPress MU Domain Mapping plugin; All-in-One: only through the host’s portal	Native: edit the Site Address under Network Admin > Sites, then add DNS, a certificate and, on subdomain networks, `COOKIE_DOMAIN`	4.5	Multisite Networks	Advanced Administration Handbook: WordPress Multisite Domain Mapping
All-in-One: a network has a fixed number of tables	Six network tables (`wp_blogmeta` since 5.1), the main site’s tables with the base prefix, and ten more per site from `wp_2_` on (`termmeta` since 4.4)	5.1	Multisite Networks	wordpress-develop: wp-admin/includes/schema.php
All-in-One, Ultimate Handbook: Apache rules for the network with `Order allow,deny`	The official `.htaccess` blocks use Apache 2.4 syntax	Apache 2.4	Multisite Networks	Advanced Administration Handbook: Apache HTTPD / .htaccess
Tutorials: uploads live in `blogs.dir` and are served by `ms-files.php`	Only networks created before 3.5; newer ones use `wp-content/uploads/sites/<id>/`	3.5	Multisite Networks	Advanced Administration Handbook: nginx
Tutorials: react to new sites with `wpmu_new_blog`	Deprecated; use `wp_initialize_site` (after priority 10) and `wp_uninitialize_site` or `wp_delete_site`	5.1	Multisite Development	Code Reference: wp_initialize_site
Tutorials: list sites with `wp_get_sites()` or a query on `wp_blogs`	`get_sites()` and `WP_Site_Query`, with meta queries on site meta (5.1)	4.6	Multisite Development	Code Reference: get_sites()
Tutorials: `current_user_can_for_blog()`	Deprecated in favour of `current_user_can_for_site()`	6.7	Multisite Development	Code Reference: current_user_can_for_site()

Pro WordPress: map domains with the WordPress MU Domain Mapping plugin; All-in-One: only through the host’s portal

Native: edit the Site Address under Network Admin > Sites, then add DNS, a certificate and, on subdomain networks, COOKIE_DOMAIN

4.5

Advanced Administration Handbook: WordPress Multisite Domain Mapping

All-in-One: a network has a fixed number of tables

Six network tables (wp_blogmeta since 5.1), the main site’s tables with the base prefix, and ten more per site from wp_2_ on (termmeta since 4.4)

5.1

wordpress-develop: wp-admin/includes/schema.php

All-in-One, Ultimate Handbook: Apache rules for the network with Order allow,deny

The official .htaccess blocks use Apache 2.4 syntax

Apache 2.4

Advanced Administration Handbook: Apache HTTPD / .htaccess

Tutorials: uploads live in blogs.dir and are served by ms-files.php

Only networks created before 3.5; newer ones use wp-content/uploads/sites/<id>/

3.5

Advanced Administration Handbook: nginx

Tutorials: react to new sites with wpmu_new_blog

Deprecated; use wp_initialize_site (after priority 10) and wp_uninitialize_site or wp_delete_site

5.1

Multisite Development

Code Reference: wp_initialize_site

Tutorials: list sites with wp_get_sites() or a query on wp_blogs

get_sites() and WP_Site_Query, with meta queries on site meta (5.1)

4.6

Multisite Development

Code Reference: get_sites()

Tutorials: current_user_can_for_blog()

Deprecated in favour of current_user_can_for_site()

6.7

Multisite Development

Code Reference: current_user_can_for_site()

Themes and design

Older claim Current state Since Covered in Official source

Older claim	Current state	Since	Covered in	Official source
Pro WordPress: full site editing arrived in 5.4 to 5.6	Block themes, block templates and the Site Editor arrived in 5.9 (January 2022), `theme.json` in 5.8; earlier releases only had Gutenberg plugin experiments	5.9	Themes Overview	WordPress News: WordPress 5.9 "Joséphine"
Ultimate Handbook: full site editing is still maturing, so design with a commercial theme, the Customizer and a builder	Block themes are the default of every bundled theme since Twenty Twenty-Two; builders are an optional ecosystem choice with lock-in and markup trade-offs	5.9	Page Builders and Commercial Themes	WordPress.org Documentation: Site Editor
Pro WordPress, Ultimate Handbook: a theme is PHP templates, `functions.php` and the Customizer	That describes classic themes, which still work; block themes are HTML block templates plus `theme.json`, and adding `templates/index.html` makes a theme a block theme	5.9	Templates and Template Parts	Theme Handbook: Theme Structure
Pro WordPress, Ultimate Handbook: adjust any theme in Customizer > Additional CSS	The Customizer is hidden for block themes; Additional CSS is in Styles, and 7.0 added CSS per block instance	7.0	Site Editor and Global Styles	Make WordPress Core: Custom CSS for individual block instances in 7.0
Pro WordPress: menus are built in Appearance > Menus with `wp_nav_menu()`	True for classic themes; block themes use Navigation blocks stored as `wp_navigation` posts (classic menus can be imported), with overlay templates since 7.0	7.0	Navigation and Menus	WordPress.org Documentation: Navigation block
Pro WordPress: widgets are `WP_Widget` classes dragged onto sidebars	The Widgets screen is a block editor since 5.8; block themes have no widget areas and use template parts and patterns instead	5.8	Widgets and Sidebars	Make WordPress Core: Block-based Widgets Editor in WordPress 5.8
Ultimate Handbook: reusable blocks	Renamed synced patterns in 6.3 (same posts, same IDs), with per-instance overrides since 6.6 and for custom blocks since 7.0	6.3	Patterns for Site Builders	WordPress News: Synced Patterns, the Evolution of Reusable Blocks
All-in-One: Site Editor walkthroughs for 6.3 and Twenty Twenty-Four	Template parts are listed under Patterns, Fonts is in Appearance (7.0), 7.1 adds the Identity section and responsive styles; Twenty Twenty-Five is the default theme	7.1	Site Editor and Global Styles	Make WordPress Core: WordPress 7.1 Field Guide
Pro WordPress, Ultimate Handbook: load Google Fonts from Google’s servers	Self-host with `fontFace` in `theme.json` or the Font Library (6.5), which works for every theme since 7.0	6.5	Typography and Fonts	Make WordPress Core: New Feature, Font Library
Tutorials: `theme.json` presets with core slugs override core’s sizes	In version 3 `defaultFontSizes` and `defaultSpacingSizes` default to `true`; set them to `false` to keep the version 2 behaviour	6.6	theme.json Settings	Make WordPress Core: theme.json version 3
All-in-One: a theme update keeps or overwrites the owner’s changes	Edited templates and styles are `wp_template`, `wp_template_part` and `wp_global_styles` posts that hide the updated files until reset; export them with Create Block Theme	5.9	Create Block Theme and Version Control	WordPress.org Plugins: Create Block Theme
Ultimate Handbook: a child theme needs `style.css` and `functions.php`, importing the parent CSS	A block child needs only `style.css` and `theme.json`; classic children enqueue the parent stylesheet instead of `@import`, and the child’s `functions.php` runs before the parent’s	5.9	Child Themes	Theme Handbook: Child Themes
Pro WordPress: register post types and shortcodes in the theme	Plugin territory: content disappears on a theme switch, and the Theme Directory rejects it	Always	functions.php, Theme Supports and Assets	Themes Team Handbook: Required
Tutorials: print `<title>` with `wp_title()` and hard-code `<link>`/`<script>` tags	Declare `title-tag` support and enqueue on `wp_enqueue_scripts`	4.1	Classic Theme Anatomy and The Loop	Code Reference: wp_title()
Tutorials: patterns are only for block themes	Classic themes with `editor-styles` or a `theme.json` get the Patterns screen and the Style Book under Appearance > Design	6.8	Hybrid Themes and Migration to Block Themes	WordPress News: WordPress 6.8 "Cecil"

Pro WordPress: full site editing arrived in 5.4 to 5.6

Block themes, block templates and the Site Editor arrived in 5.9 (January 2022), theme.json in 5.8; earlier releases only had Gutenberg plugin experiments

5.9

Themes Overview

WordPress News: WordPress 5.9 "Joséphine"

Ultimate Handbook: full site editing is still maturing, so design with a commercial theme, the Customizer and a builder

Block themes are the default of every bundled theme since Twenty Twenty-Two; builders are an optional ecosystem choice with lock-in and markup trade-offs

5.9

Page Builders and Commercial Themes

WordPress.org Documentation: Site Editor

Pro WordPress, Ultimate Handbook: a theme is PHP templates, functions.php and the Customizer

That describes classic themes, which still work; block themes are HTML block templates plus theme.json, and adding templates/index.html makes a theme a block theme

5.9

Templates and Template Parts

Theme Handbook: Theme Structure

Pro WordPress, Ultimate Handbook: adjust any theme in Customizer > Additional CSS

The Customizer is hidden for block themes; Additional CSS is in Styles, and 7.0 added CSS per block instance

7.0

Site Editor and Global Styles

Make WordPress Core: Custom CSS for individual block instances in 7.0

Pro WordPress: menus are built in Appearance > Menus with wp_nav_menu()

True for classic themes; block themes use Navigation blocks stored as wp_navigation posts (classic menus can be imported), with overlay templates since 7.0

7.0

Navigation and Menus

WordPress.org Documentation: Navigation block

Pro WordPress: widgets are WP_Widget classes dragged onto sidebars

The Widgets screen is a block editor since 5.8; block themes have no widget areas and use template parts and patterns instead

5.8

Widgets and Sidebars

Make WordPress Core: Block-based Widgets Editor in WordPress 5.8

Ultimate Handbook: reusable blocks

Renamed synced patterns in 6.3 (same posts, same IDs), with per-instance overrides since 6.6 and for custom blocks since 7.0

6.3

Patterns for Site Builders

WordPress News: Synced Patterns, the Evolution of Reusable Blocks

All-in-One: Site Editor walkthroughs for 6.3 and Twenty Twenty-Four

Template parts are listed under Patterns, Fonts is in Appearance (7.0), 7.1 adds the Identity section and responsive styles; Twenty Twenty-Five is the default theme

7.1

Site Editor and Global Styles

Make WordPress Core: WordPress 7.1 Field Guide

Pro WordPress, Ultimate Handbook: load Google Fonts from Google’s servers

Self-host with fontFace in theme.json or the Font Library (6.5), which works for every theme since 7.0

6.5

Typography and Fonts

Make WordPress Core: New Feature, Font Library

Tutorials: theme.json presets with core slugs override core’s sizes

In version 3 defaultFontSizes and defaultSpacingSizes default to true; set them to false to keep the version 2 behaviour

6.6

theme.json Settings

Make WordPress Core: theme.json version 3

All-in-One: a theme update keeps or overwrites the owner’s changes

Edited templates and styles are wp_template, wp_template_part and wp_global_styles posts that hide the updated files until reset; export them with Create Block Theme

5.9

Create Block Theme and Version Control

WordPress.org Plugins: Create Block Theme

Ultimate Handbook: a child theme needs style.css and functions.php, importing the parent CSS

A block child needs only style.css and theme.json; classic children enqueue the parent stylesheet instead of @import, and the child’s functions.php runs before the parent’s

5.9

Child Themes

Theme Handbook: Child Themes

Pro WordPress: register post types and shortcodes in the theme

Plugin territory: content disappears on a theme switch, and the Theme Directory rejects it

Always

functions.php, Theme Supports and Assets

Themes Team Handbook: Required

Tutorials: print <title> with wp_title() and hard-code <link>/<script> tags

Declare title-tag support and enqueue on wp_enqueue_scripts

4.1

Classic Theme Anatomy and The Loop

Code Reference: wp_title()

Tutorials: patterns are only for block themes

Classic themes with editor-styles or a theme.json get the Patterns screen and the Style Book under Appearance > Design

6.8

Hybrid Themes and Migration to Block Themes

WordPress News: WordPress 6.8 "Cecil"

Plugin and block development

Older claim Current state Since Covered in Official source

Older claim	Current state	Since	Covered in	Official source
All-in-One: plugins cannot depend on other plugins	The `Requires Plugins` header blocks activation until the dependencies are active (no version constraints)	6.5	Plugin Fundamentals	Make WordPress Core: Introducing Plugin Dependencies in WordPress 6.5
Pro WordPress: register a custom post type with labels and `supports` only	Without `show_in_rest` the type gets the classic editor, no REST endpoint and no Block Bindings for its meta	5.0	Custom Post Types and Taxonomies	Code Reference: register_post_type()
Pro WordPress: jQuery code with a bare `$`	WordPress loads jQuery in noConflict mode; wrap the code or use `jQuery`, and prefer the Interactivity API for new front-end behaviour	Always	JavaScript, AJAX and Heartbeat	Plugin Handbook: jQuery
Ultimate Handbook: call `add_role()` on every `init`	Roles are stored in the database; later calls return `null` and change nothing. Add on activation, update in a versioned upgrade, remove on uninstall	Always	Roles and Capabilities API	Code Reference: add_role()
Tutorials: call `flush_rewrite_rules()` in the `init` callback that registers a post type	Flush on activation and deactivation only; per-request flushing is slow and can race	Always	Rewrite API and Permalinks	Code Reference: flush_rewrite_rules()
Tutorials: call `load_plugin_textdomain()` on `plugins_loaded`	Not needed for WordPress.org plugins (4.6) or with `Text Domain` and `Domain Path` headers (6.8); translating before `init` triggers a notice since 6.7	6.7	Internationalization	Make WordPress Core: Internationalization improvements in 6.7
Tutorials: callbacks built with `create_function()`	Removed in PHP 8.0; use a named function, a static method or a stored closure	PHP 8.0	Hooks: Actions and Filters	PHP Manual: Backward incompatible changes in PHP 8.0
Tutorials: append output to every post with a `the_content` filter	In block themes a hooked block (Block Hooks) is visible and movable in the Site Editor	6.4	Block Hooks	Make WordPress Core: Introducing Block Hooks for dynamic blocks
Tutorials: one `register_block_type()` call per block	`wp_register_block_types_from_metadata_collection()` (6.8) with a generated `blocks-manifest.php`; the underlying `wp_register_block_metadata_collection()` is 6.7	6.8	block.json and Registration	Code Reference: wp_register_block_types_from_metadata_collection()
Tutorials: `apiVersion` 1 or 2, editor CSS on `admin_enqueue_scripts`	`apiVersion` 3 (versions up to 2 are deprecated since 6.9); the post editor is always iframed since 7.1, so only `block.json` styles reach the canvas and code must not touch `window.document`	7.1	Block Development Environment	Block Editor Handbook: API Versions
Tutorials: every block needs JavaScript and a build	Simple server-rendered blocks can be PHP-only: `register_block_type()` with `autoRegister` support and a `render_callback`	7.0	block.json and Registration	Make WordPress Core: PHP-only block registration
Tutorials: `wp-scripts test-unit-js` runs Jest	It runs Vitest since `@wordpress/scripts` 36.0.0; Jest needs `test-unit-jest` and a project-installed Jest	scripts 36	Testing	Gutenberg: @wordpress/scripts Vitest migration guide
Tutorials: `wp-scripts test-e2e` drives Puppeteer; `wp-scripts env` starts a test site	Playwright since `@wordpress/scripts` 33.0.0; `wp-env` is its own package (12.0.0), and its separate tests site is deprecated (`"testsEnvironment": false`)	scripts 33	Block Development Environment	Block Editor Handbook: @wordpress/env
Tutorials: an attribute with `"source": "meta"`, or a shortcode, to show a custom field	Bind a core block to `core/post-meta` or a custom source with Block Bindings	6.5	Block Bindings API	Make WordPress Core: New Feature, The Block Bindings API
Tutorials: admin list screens subclass `WP_List_Table`	The class is still marked private; core builds new screens with React and DataViews over the REST API	6.5	Components, DataViews and Admin Screens	WordPress Developer Blog: Using Data Views in plugins
Tutorials: install WPCS by cloning it and setting `installed_paths`	WPCS 3 installs only through Composer with PHPCSUtils, PHPCSExtra and the installer plugin; `// WPCS:` annotations no longer work	WPCS 3	Coding Standards and Static Analysis	GitHub: WordPress Coding Standards
Tutorials: `Requests_*` classes or `new PHPMailer()` from `class-phpmailer.php`	`WpOrg\Requests` names since 6.2 (use `wp_remote_get()` anyway) and `PHPMailer\PHPMailer\PHPMailer` since 5.5, configured through `phpmailer_init`	5.5	HTTP and Filesystem APIs	Plugin Handbook: HTTP API
Tutorials: a REST route needs no `permission_callback`	A missing one triggers `_doing_it_wrong`; `__return_true` only for public routes, and a cookie request without the `wp_rest` nonce runs as user 0	5.5	REST API: Extending It	Make WordPress Core: REST API Changes in WordPress 5.5

All-in-One: plugins cannot depend on other plugins

The Requires Plugins header blocks activation until the dependencies are active (no version constraints)

6.5

Plugin Fundamentals

Make WordPress Core: Introducing Plugin Dependencies in WordPress 6.5

Pro WordPress: register a custom post type with labels and supports only

Without show_in_rest the type gets the classic editor, no REST endpoint and no Block Bindings for its meta

5.0

Custom Post Types and Taxonomies

Code Reference: register_post_type()

Pro WordPress: jQuery code with a bare $

WordPress loads jQuery in noConflict mode; wrap the code or use jQuery, and prefer the Interactivity API for new front-end behaviour

Always

JavaScript, AJAX and Heartbeat

Plugin Handbook: jQuery

Ultimate Handbook: call add_role() on every init

Roles are stored in the database; later calls return null and change nothing. Add on activation, update in a versioned upgrade, remove on uninstall

Always

Roles and Capabilities API

Code Reference: add_role()

Tutorials: call flush_rewrite_rules() in the init callback that registers a post type

Flush on activation and deactivation only; per-request flushing is slow and can race

Always

Rewrite API and Permalinks

Code Reference: flush_rewrite_rules()

Tutorials: call load_plugin_textdomain() on plugins_loaded

Not needed for WordPress.org plugins (4.6) or with Text Domain and Domain Path headers (6.8); translating before init triggers a notice since 6.7

6.7

Internationalization

Make WordPress Core: Internationalization improvements in 6.7

Tutorials: callbacks built with create_function()

Removed in PHP 8.0; use a named function, a static method or a stored closure

PHP 8.0

Hooks: Actions and Filters

PHP Manual: Backward incompatible changes in PHP 8.0

Tutorials: append output to every post with a the_content filter

In block themes a hooked block (Block Hooks) is visible and movable in the Site Editor

6.4

Block Hooks

Make WordPress Core: Introducing Block Hooks for dynamic blocks

Tutorials: one register_block_type() call per block

wp_register_block_types_from_metadata_collection() (6.8) with a generated blocks-manifest.php; the underlying wp_register_block_metadata_collection() is 6.7

6.8

block.json and Registration

Code Reference: wp_register_block_types_from_metadata_collection()

Tutorials: apiVersion 1 or 2, editor CSS on admin_enqueue_scripts

apiVersion 3 (versions up to 2 are deprecated since 6.9); the post editor is always iframed since 7.1, so only block.json styles reach the canvas and code must not touch window.document

7.1

Block Development Environment

Block Editor Handbook: API Versions

Tutorials: every block needs JavaScript and a build

Simple server-rendered blocks can be PHP-only: register_block_type() with autoRegister support and a render_callback

7.0

block.json and Registration

Make WordPress Core: PHP-only block registration

Tutorials: wp-scripts test-unit-js runs Jest

It runs Vitest since @wordpress/scripts 36.0.0; Jest needs test-unit-jest and a project-installed Jest

scripts 36

Testing

Gutenberg: @wordpress/scripts Vitest migration guide

Tutorials: wp-scripts test-e2e drives Puppeteer; wp-scripts env starts a test site

Playwright since @wordpress/scripts 33.0.0; wp-env is its own package (12.0.0), and its separate tests site is deprecated ("testsEnvironment": false)

scripts 33

Block Development Environment

Block Editor Handbook: @wordpress/env

Tutorials: an attribute with "source": "meta", or a shortcode, to show a custom field

Bind a core block to core/post-meta or a custom source with Block Bindings

6.5

Block Bindings API

Make WordPress Core: New Feature, The Block Bindings API

Tutorials: admin list screens subclass WP_List_Table

The class is still marked private; core builds new screens with React and DataViews over the REST API

6.5

Components, DataViews and Admin Screens

WordPress Developer Blog: Using Data Views in plugins

Tutorials: install WPCS by cloning it and setting installed_paths

WPCS 3 installs only through Composer with PHPCSUtils, PHPCSExtra and the installer plugin; // WPCS: annotations no longer work

WPCS 3

Coding Standards and Static Analysis

GitHub: WordPress Coding Standards

Tutorials: Requests_* classes or new PHPMailer() from class-phpmailer.php

WpOrg\Requests names since 6.2 (use wp_remote_get() anyway) and PHPMailer\PHPMailer\PHPMailer since 5.5, configured through phpmailer_init

5.5

HTTP and Filesystem APIs

Plugin Handbook: HTTP API

Tutorials: a REST route needs no permission_callback

A missing one triggers _doing_it_wrong; __return_true only for public routes, and a cookie request without the wp_rest nonce runs as user 0

5.5

REST API: Extending It

Make WordPress Core: REST API Changes in WordPress 5.5

Changed since older tutorials

The shifts below change the default way of doing something rather than correcting a single statement. The older way usually still works; new work should start from the newer one.

Older way Current way Since Covered in Official source

Older way	Current way	Since	Covered in	Official source
Classic themes (PHP templates)	Block themes (HTML block templates and `theme.json`)	5.9	Hybrid Themes and Migration to Block Themes	Learn WordPress: Converting a classic theme to a block theme
Reusable blocks	Synced patterns, with overrides	6.3	Theme Patterns	WordPress Developer Blog: An introduction to overrides in synced patterns
Customizer	Site Editor Styles (global styles, style variations, section styles)	5.9	Style Variations and Section Styles	WordPress.org Documentation: Styles Overview
Appearance > Menus	Navigation block and `wp_navigation` posts	5.9	Navigation and Menus	REST API Handbook: Navigations
Widget areas	Template parts and patterns	5.9	Widgets and Sidebars	Learn WordPress: Importing widget areas from a classic theme to a block theme
phpass password hashes	bcrypt	6.8	Authentication and Login API	Make WordPress Core: WordPress 6.8 will use bcrypt for password hashing
`admin-ajax.php`	REST API routes with a `permission_callback`	4.7	REST API: Extending It	Plugin Handbook: AJAX
jQuery on the front end	Interactivity API directives with a script module; React stays the editor and admin technology	6.5	Interactivity API	Make WordPress Core: Merge announcement, Interactivity API
Classic scripts for front-end code	Script Modules (`viewScriptModule`)	6.5	Interactivity API	Make WordPress Core: Script Modules in 6.5
`wp-now`	Playground CLI (`@wp-playground/cli`)	2026	Playground and Blueprints	Playground documentation: Playground CLI
Jest in `wp-scripts test-unit-js`	Vitest	scripts 36	Testing	Gutenberg: @wordpress/scripts Vitest migration guide
WordPress MU Domain Mapping plugin	Native domain mapping	4.5	Multisite Networks	Advanced Administration Handbook: WordPress Multisite Domain Mapping
Google Fonts CDN or a fonts plugin	Font Library, self-hosted files	6.5	Typography and Fonts	WordPress.org Documentation: The Font Library
Lazy-loading and prefetch plugins	Native `loading="lazy"`, `fetchpriority` and speculative loading	6.8	Performance and Caching	Make WordPress Core: Speculative Loading in 6.8
Sitemap plugins for basic sitemaps	Core sitemaps at `/wp-sitemap.xml`	5.5	SEO, Analytics and Privacy	Make WordPress Core: New XML Sitemaps Functionality in WordPress 5.5
`WP_List_Table` admin screens	DataViews and DataForm	6.5	Components, DataViews and Admin Screens	WordPress Developer Blog: How to use DataForm to create plugin settings pages
Shortcodes and widgets for dynamic content	Dynamic blocks with `render.php`	6.1	Static and Dynamic Blocks	Block Editor Handbook: Metadata in block.json, render
One `register_block_type()` per block	Block metadata collections and `blocks-manifest.php`	6.8	block.json and Registration	Make WordPress Core: More efficient block type registration in 6.8
Custom REST endpoints for machine clients only	Abilities API, exposed to AI agents through the MCP Adapter (an official package, not core)	6.9	Abilities API and MCP Adapter	Make WordPress Core: WordPress 6.9 Field Guide

Classic themes (PHP templates)

Block themes (HTML block templates and theme.json)

5.9

Hybrid Themes and Migration to Block Themes

Learn WordPress: Converting a classic theme to a block theme

Reusable blocks

Synced patterns, with overrides

6.3

Theme Patterns

WordPress Developer Blog: An introduction to overrides in synced patterns

Customizer

Site Editor Styles (global styles, style variations, section styles)

5.9

Style Variations and Section Styles

WordPress.org Documentation: Styles Overview

Appearance > Menus

Navigation block and wp_navigation posts

5.9

Navigation and Menus

REST API Handbook: Navigations

Widget areas

Template parts and patterns

5.9

Widgets and Sidebars

Learn WordPress: Importing widget areas from a classic theme to a block theme

phpass password hashes

bcrypt

6.8

Authentication and Login API

Make WordPress Core: WordPress 6.8 will use bcrypt for password hashing

admin-ajax.php

REST API routes with a permission_callback

4.7

REST API: Extending It

Plugin Handbook: AJAX

jQuery on the front end

Interactivity API directives with a script module; React stays the editor and admin technology

6.5

Interactivity API

Make WordPress Core: Merge announcement, Interactivity API

Classic scripts for front-end code

Script Modules (viewScriptModule)

6.5

Interactivity API

Make WordPress Core: Script Modules in 6.5

wp-now

Playground CLI (@wp-playground/cli)

2026

Playground and Blueprints

Playground documentation: Playground CLI

Jest in wp-scripts test-unit-js

Vitest

scripts 36

Testing

Gutenberg: @wordpress/scripts Vitest migration guide

WordPress MU Domain Mapping plugin

Native domain mapping

4.5

Advanced Administration Handbook: WordPress Multisite Domain Mapping

Google Fonts CDN or a fonts plugin

Font Library, self-hosted files

6.5

Typography and Fonts

WordPress.org Documentation: The Font Library

Lazy-loading and prefetch plugins

Native loading="lazy", fetchpriority and speculative loading

6.8

Make WordPress Core: Speculative Loading in 6.8

Sitemap plugins for basic sitemaps

Core sitemaps at /wp-sitemap.xml

5.5