wordpress-pro

Use npx @wordpress/create-block to scaffold the project, define metadata in block.json with apiVersion 3, then implement edit.js with useBlockProps and InspectorControls. Register the block in PHP with register_block_type on the init hook.

Add wp_nonce_field to the form and verify submissions with wp_verify_nonce before processing. Combine this with capability checks using current_user_can and sanitize all input with functions like sanitize_text_field.

Static blocks save fixed HTML via a save.js component, while dynamic blocks render on the server through a render.php callback. Dynamic blocks suit content that changes, like recent posts lists, and use ServerSideRender for editor previews.

Yes, all custom queries must use $wpdb->prepare with placeholders like %d and %s to prevent SQL injection. Never interpolate variables directly into SQL strings or hardcode table names without $wpdb->prefix.

Common causes include N+1 queries, missing object caching, and unoptimized assets. Use transients for expensive queries, add no_found_rows to WP_Query when pagination is unneeded, defer non-critical scripts, and clean up revisions and expired transients.