Developry Plugins

How to Add Custom Block Patterns to WordPress Block Editor

Krasen Slavov — Tue, 25 Aug 2026 09:00:00 +0000

Block patterns revolutionize WordPress content creation by providing pre-designed layouts users can insert with one click. This guide shows you how to create custom patterns that accelerate workflow, maintain design consistency, and empower non-technical users.

What Are Block Patterns?

Block patterns are pre-configured collections of blocks arranged into ready-to-use designs. Unlike reusable blocks (synchronized across posts), patterns insert independent copies—users can modify them freely without affecting other instances.

Patterns bridge the gap between full-page templates and individual blocks, offering flexible starting points for common layouts like hero sections, testimonials, pricing tables, and calls-to-action.

Creating Your First Custom Pattern

function register_custom_patterns() {
    register_block_pattern(
        'myplugin/hero-section',
        array(
            'title'       => 'Hero Section',
            'description' => 'Eye-catching hero with heading, text, and button',
            'categories'  => array( 'featured' ),
            'content'     => '
                
                    
                    
                    
                        
                        Welcome to Our Site
                        

                        
                        Discover amazing products and services.
                        

                        
                        
                            
                            
                                Get Started
                            
                            
                        
                        
                    
                
                ',
        )
    );
}
add_action( 'init', 'register_custom_patterns' );

Getting Block Markup

The easiest way to create pattern content is building it in the editor, then copying the markup:

Create your design in the editor
Switch to Code Editor (⋮ menu → Code editor)
Copy the HTML comments and blocks
Paste into the content property

Creating Pattern Categories

Organize patterns with custom categories:

function register_pattern_categories() {
    register_block_pattern_category(
        'business',
        array( 'label' => 'Business' )
    );

    register_block_pattern_category(
        'marketing',
        array( 'label' => 'Marketing' )
    );
}
add_action( 'init', 'register_pattern_categories' );

Advanced Pattern Properties

Enhance patterns with additional properties:

register_block_pattern(
    'myplugin/testimonial',
    array(
        'title'       => 'Testimonial Card',
        'description' => 'Customer testimonial with quote and attribution',
        'categories'  => array( 'text', 'business' ),
        'keywords'    => array( 'review', 'quote', 'customer' ),
        'viewportWidth' => 800,
        'blockTypes'  => array( 'core/column' ), // Show pattern only for specific blocks
        'content'     => ''
    )
);

Testimonial Pattern Example

register_block_pattern(
    'myplugin/testimonial-card',
    array(
        'title' => 'Testimonial Card',
        'categories' => array( 'text' ),
        'content' => '
            
                
                "This product changed my business completely. Highly recommended!"
                

                
                
                

                
                John Doe
CEO, Example Company
                
            
            ',
    )
);

Pricing Table Pattern

register_block_pattern(
    'myplugin/pricing-table',
    array(
        'title' => 'Pricing Table - Three Column',
        'categories' => array( 'business' ),
        'content' => '
            
                
                
                    
                    Basic
                    

                    
                    $9/month
                    

                    
                    Feature 1
Feature 2
Feature 3
                    

                    
                    
                        
                        Choose Plan
                        
                    
                    
                
                

                
                
                    
                    Pro
                    

                    
                    $29/month
                    

                    
                    Everything in Basic
Feature 4
Feature 5
                    

                    
                    
                        
                        Choose Plan
                        
                    
                    
                
                

                
                
                    
                    Enterprise
                    

                    
                    Custom
                    

                    
                    Everything in Pro
Premium Support
Custom Integration
                    

                    
                    
                        
                        Contact Us
                        
                    
                    
                
                
            
            ',
    )
);

Unregistering Core Patterns

Remove unwanted patterns:

function remove_core_patterns() {
    unregister_block_pattern( 'core/query-standard-posts' );
    unregister_block_pattern( 'core/query-medium-posts' );
}
add_action( 'init', 'remove_core_patterns' );

Pattern Best Practices

Use placeholder images for visual patterns
Include descriptive keywords for searchability
Test across themes to ensure compatibility
Keep patterns focused – one purpose per pattern
Add helpful descriptions explaining pattern use cases
Use semantic HTML for accessibility
Consider mobile responsiveness in layouts

Translatable Patterns

Make pattern text translatable:

'content' => sprintf(
    '%s

    %s
',
    esc_html__( 'Welcome', 'textdomain' ),
    esc_html__( 'This is sample content.', 'textdomain' )
)

Organizing Patterns in Plugins

Structure patterns in separate files:

// patterns/hero.php
<?php
return array(
    'title' => 'Hero Section',
    'categories' => array( 'featured' ),
    'content' => ''
);

// functions.php
function register_pattern_library() {
    $patterns = glob( get_template_directory() . '/patterns/*.php' );

    foreach ( $patterns as $pattern_file ) {
        $pattern = require $pattern_file;
        $slug = basename( $pattern_file, '.php' );

        register_block_pattern( 'mytheme/' . $slug, $pattern );
    }
}
add_action( 'init', 'register_pattern_library' );

Conclusion

Block patterns transform WordPress content creation by providing professional design starting points. Start with simple patterns for common layouts, organize them into logical categories, and progressively build a pattern library tailored to your site’s needs. Well-designed patterns empower users to create beautiful pages without design expertise.

External Links

Call to Action

Streamline your workflow! Block Editor Navigator Pro provides instant block navigation, search, and organization. Find any block in seconds—try it free!

The post How to Add Custom Block Patterns to WordPress Block Editor appeared first on Developry Plugins.

How to Add Custom Post Types to WordPress Without Plugins

Krasen Slavov — Thu, 20 Aug 2026 09:00:00 +0000

Custom post types extend WordPress beyond blogs and pages, enabling portfolio items, products, testimonials, and any content structure imaginable. While plugins simplify creation, coding custom post types provides complete control, better performance, and deeper WordPress understanding. This comprehensive guide teaches custom post type registration, taxonomy association, template creation, and advanced customization without plugins.

Understanding Custom Post Types

WordPress includes five default post types:

post (Blog posts)
page (Static pages)
attachment (Media)
revision (Post revisions)
nav_menu_item (Menu items)

Custom post types add structured content beyond these defaults.

Common Use Cases:

Portfolio projects
Products/services
Team members
Testimonials
Events
Case studies
Properties/listings
Courses/lessons

Basic Custom Post Type Registration

Simple Portfolio CPT:

function dprt_register_portfolio() {
    register_post_type('portfolio', array(
        'labels' => array(
            'name' => 'Portfolio',
            'singular_name' => 'Portfolio Item',
            'add_new' => 'Add New Project',
            'add_new_item' => 'Add New Portfolio Item',
            'edit_item' => 'Edit Portfolio Item',
            'new_item' => 'New Portfolio Item',
            'view_item' => 'View Portfolio Item',
            'search_items' => 'Search Portfolio',
            'not_found' => 'No portfolio items found',
            'not_found_in_trash' => 'No portfolio items found in trash'
        ),
        'public' => true,
        'has_archive' => true,
        'rewrite' => array('slug' => 'portfolio'),
        'supports' => array('title', 'editor', 'thumbnail', 'excerpt'),
        'menu_icon' => 'dashicons-portfolio',
        'show_in_rest' => true, // Gutenberg support
    ));
}
add_action('init', 'dprt_register_portfolio');

Flush Rewrite Rules (run once after registration):

// Visit Settings → Permalinks to flush, or run this code once:
flush_rewrite_rules();

Complete Parameter Reference

Essential Parameters:

public (boolean): Makes CPT publicly queryable.

true: Visible on front-end and admin
false: Hidden from public

publicly_queryable (boolean): Whether post type can be queried from front-end.

show_ui (boolean): Generate admin UI.

show_in_menu (boolean): Show in admin menu.

true: Top-level menu
string: ‘tools.php’ makes submenu under Tools

menu_position (integer): Admin menu order.

5: Below Posts
10: Below Media
15: Below Links
20: Below Pages
25: Below Comments

menu_icon (string): Dashicon class or image URL.

‘dashicons-portfolio’
‘dashicons-products’
‘dashicons-groups’
get_template_directory_uri() . ‘/images/icon.png’

supports (array): Features CPT supports.

‘title’: Title field
‘editor’: Content editor
‘thumbnail’: Featured image
‘excerpt’: Excerpt field
‘custom-fields’: Custom fields metabox
‘comments’: Comment discussion
‘revisions’: Revision tracking
‘page-attributes’: Order/parent
‘post-formats’: Post format selection

taxonomies (array): Associated taxonomies.

array(‘category’, ‘post_tag’)

has_archive (boolean|string): Archive page support.

true: Uses CPT slug
‘projects’: Custom archive slug

rewrite (array|boolean): Permalink structure.

array(
    'slug' => 'portfolio',
    'with_front' => false,
    'hierarchical' => false
)

capability_type (string): Capability structure.

‘post’: Uses post capabilities
‘page’: Uses page capabilities
array(‘book’, ‘books’): Custom capabilities

show_in_rest (boolean): REST API and Gutenberg support.

true: Enables block editor

Advanced Custom Post Type Example

Complete Product CPT:

function dprt_register_products() {
    $labels = array(
        'name' => _x('Products', 'Post type general name', 'textdomain'),
        'singular_name' => _x('Product', 'Post type singular name', 'textdomain'),
        'menu_name' => _x('Products', 'Admin Menu text', 'textdomain'),
        'name_admin_bar' => _x('Product', 'Add New on Toolbar', 'textdomain'),
        'add_new' => __('Add New', 'textdomain'),
        'add_new_item' => __('Add New Product', 'textdomain'),
        'new_item' => __('New Product', 'textdomain'),
        'edit_item' => __('Edit Product', 'textdomain'),
        'view_item' => __('View Product', 'textdomain'),
        'all_items' => __('All Products', 'textdomain'),
        'search_items' => __('Search Products', 'textdomain'),
        'parent_item_colon' => __('Parent Products:', 'textdomain'),
        'not_found' => __('No products found.', 'textdomain'),
        'not_found_in_trash' => __('No products found in Trash.', 'textdomain'),
        'featured_image' => _x('Product Image', 'Overrides the "Featured Image" phrase', 'textdomain'),
        'set_featured_image' => _x('Set product image', 'Overrides the "Set featured image" phrase', 'textdomain'),
        'remove_featured_image' => _x('Remove product image', 'Overrides the "Remove featured image" phrase', 'textdomain'),
        'use_featured_image' => _x('Use as product image', 'Overrides the "Use as featured image" phrase', 'textdomain'),
        'archives' => _x('Product archives', 'The post type archive label', 'textdomain'),
        'insert_into_item' => _x('Insert into product', 'Overrides the "Insert into post" phrase', 'textdomain'),
        'uploaded_to_this_item' => _x('Uploaded to this product', 'Overrides the "Uploaded to this post" phrase', 'textdomain'),
        'filter_items_list' => _x('Filter products list', 'Screen reader text', 'textdomain'),
        'items_list_navigation' => _x('Products list navigation', 'Screen reader text', 'textdomain'),
        'items_list' => _x('Products list', 'Screen reader text', 'textdomain'),
    );

    $args = array(
        'labels' => $labels,
        'public' => true,
        'publicly_queryable' => true,
        'show_ui' => true,
        'show_in_menu' => true,
        'query_var' => true,
        'rewrite' => array('slug' => 'product'),
        'capability_type' => 'post',
        'has_archive' => true,
        'hierarchical' => false,
        'menu_position' => 5,
        'menu_icon' => 'dashicons-products',
        'supports' => array('title', 'editor', 'thumbnail', 'excerpt', 'custom-fields'),
        'show_in_rest' => true,
        'rest_base' => 'products',
        'rest_controller_class' => 'WP_REST_Posts_Controller',
    );

    register_post_type('product', $args);
}
add_action('init', 'dprt_register_products');

Custom Taxonomies for CPT

Category-Style Taxonomy (Hierarchical):

function dprt_register_product_category() {
    register_taxonomy('product_category', 'product', array(
        'labels' => array(
            'name' => 'Product Categories',
            'singular_name' => 'Product Category',
            'search_items' => 'Search Categories',
            'all_items' => 'All Categories',
            'parent_item' => 'Parent Category',
            'parent_item_colon' => 'Parent Category:',
            'edit_item' => 'Edit Category',
            'update_item' => 'Update Category',
            'add_new_item' => 'Add New Category',
            'new_item_name' => 'New Category Name',
            'menu_name' => 'Categories',
        ),
        'hierarchical' => true, // Like categories
        'show_ui' => true,
        'show_admin_column' => true, // Show in admin post list
        'query_var' => true,
        'rewrite' => array('slug' => 'product-category'),
        'show_in_rest' => true,
    ));
}
add_action('init', 'dprt_register_product_category');

Tag-Style Taxonomy (Non-Hierarchical):

function dprt_register_product_tag() {
    register_taxonomy('product_tag', 'product', array(
        'labels' => array(
            'name' => 'Product Tags',
            'singular_name' => 'Product Tag',
            'search_items' => 'Search Tags',
            'all_items' => 'All Tags',
            'edit_item' => 'Edit Tag',
            'update_item' => 'Update Tag',
            'add_new_item' => 'Add New Tag',
            'new_item_name' => 'New Tag Name',
            'menu_name' => 'Tags',
        ),
        'hierarchical' => false, // Like tags
        'show_ui' => true,
        'show_admin_column' => true,
        'query_var' => true,
        'rewrite' => array('slug' => 'product-tag'),
        'show_in_rest' => true,
    ));
}
add_action('init', 'dprt_register_product_tag');

Template Files for Custom Post Types

WordPress looks for these template files (in order):

Single Post:

single-{post-type}.php (single-portfolio.php)
single.php
singular.php
index.php

Archive:

archive-{post-type}.php (archive-portfolio.php)
archive.php
index.php

Taxonomy:

taxonomy-{taxonomy}-{term}.php
taxonomy-{taxonomy}.php
taxonomy.php
archive.php

Single Portfolio Template (single-portfolio.php):

 get_header(); ?>

"primary" class="site-main">
    <?php
    while (have_posts()) :
        the_post();
        ?>
        "post-" <?php post_class(); ?>>
            <header class="entry-header">
                class="entry-title"><?php the_title(); ?>
            header>

            <?php if (has_post_thumbnail()) : ?>
                class="post-thumbnail">
                    <?php the_post_thumbnail('large'); ?>
                
            <?php endif; ?>

            class="entry-content">
                <?php the_content(); ?>
            

            <?php
            // Display custom taxonomy terms
            $categories = get_the_terms(get_the_ID(), 'portfolio_category');
            if ($categories && !is_wp_error($categories)) :
                ?>
                class="portfolio-categories">
                    Categories:
                    <?php
                    foreach ($categories as $category) {
                        echo '' . esc_html($category->name) . ' ';
                    }
                    ?>
                
            <?php endif; ?>
        
    <?php endwhile; ?>


<?php get_footer(); ?>

Portfolio Archive Template (archive-portfolio.php):

 get_header(); ?>

"primary" class="site-main">
    <header class="page-header">
        class="page-title">Portfolio
    header>

    <?php if (have_posts()) : ?>
        class="portfolio-grid">
            <?php
            while (have_posts()) :
                the_post();
                ?>
                "post-" <?php post_class('portfolio-item'); ?>>
                    <?php if (has_post_thumbnail()) : ?>
                        "">
                            <?php the_post_thumbnail('medium'); ?>
                        
                    <?php endif; ?>

                    class="entry-title">
                        ""><?php the_title(); ?>
                    

                    class="entry-excerpt">
                        <?php the_excerpt(); ?>
                    
                
            <?php endwhile; ?>
        

        <?php the_posts_pagination(); ?>

    <?php else : ?>
        No portfolio items found.
    <?php endif; ?>


<?php get_footer(); ?>

Querying Custom Post Types

WP_Query Examples:

// Get all portfolio items
$portfolio = new WP_Query(array(
    'post_type' => 'portfolio',
    'posts_per_page' => 10,
));

// Get portfolio by category
$featured_portfolio = new WP_Query(array(
    'post_type' => 'portfolio',
    'posts_per_page' => 6,
    'tax_query' => array(
        array(
            'taxonomy' => 'portfolio_category',
            'field' => 'slug',
            'terms' => 'featured',
        ),
    ),
));

// Multiple post types
$mixed = new WP_Query(array(
    'post_type' => array('post', 'portfolio', 'product'),
    'posts_per_page' => 10,
));

// Custom field query
$expensive_products = new WP_Query(array(
    'post_type' => 'product',
    'meta_query' => array(
        array(
            'key' => 'price',
            'value' => 100,
            'compare' => '>',
            'type' => 'NUMERIC',
        ),
    ),
));

Adding Custom Columns to Admin List

// Add custom columns
function dprt_portfolio_columns($columns) {
    $new_columns = array();
    $new_columns['cb'] = $columns['cb'];
    $new_columns['thumbnail'] = 'Image';
    $new_columns['title'] = $columns['title'];
    $new_columns['portfolio_category'] = 'Category';
    $new_columns['date'] = $columns['date'];
    return $new_columns;
}
add_filter('manage_portfolio_posts_columns', 'dprt_portfolio_columns');

// Populate custom columns
function dprt_portfolio_column_content($column, $post_id) {
    switch ($column) {
        case 'thumbnail':
            echo get_the_post_thumbnail($post_id, array(60, 60));
            break;

        case 'portfolio_category':
            $terms = get_the_terms($post_id, 'portfolio_category');
            if ($terms && !is_wp_error($terms)) {
                $term_names = wp_list_pluck($terms, 'name');
                echo implode(', ', $term_names);
            } else {
                echo '—';
            }
            break;
    }
}
add_action('manage_portfolio_posts_custom_column', 'dprt_portfolio_column_content', 10, 2);

// Make columns sortable
function dprt_sortable_columns($columns) {
    $columns['portfolio_category'] = 'portfolio_category';
    return $columns;
}
add_filter('manage_edit-portfolio_sortable_columns', 'dprt_sortable_columns');

Custom Permalink Structure

function dprt_custom_permalinks($post_link, $post) {
    if ($post->post_type === 'portfolio') {
        $terms = get_the_terms($post->ID, 'portfolio_category');
        if ($terms && !is_wp_error($terms)) {
            $category = array_shift($terms);
            return str_replace('%portfolio_category%', $category->slug, $post_link);
        }
    }
    return $post_link;
}
add_filter('post_type_link', 'dprt_custom_permalinks', 10, 2);

// Register rewrite with taxonomy
register_post_type('portfolio', array(
    'rewrite' => array(
        'slug' => 'portfolio/%portfolio_category%',
        'with_front' => false
    ),
    // ... other args
));

Best Practices

Use Descriptive Slugs: ‘portfolio’ better than ‘pf’.

Translation Ready: Use _x() and __() for labels.

Namespace Functions: Prefix functions to avoid conflicts.

Flush Permalinks: After registration changes, visit Settings → Permalinks.

show_in_rest: Always true for Gutenberg support.

Separate Files: Keep CPT registration in dedicated file (inc/post-types.php).

Documentation: Comment complex registrations explaining purpose.

Conclusion

WordPress custom post types extend content structure beyond posts and pages without plugins. Register CPTs using register_post_type(), create custom taxonomies with register_taxonomy(), build template files following WordPress hierarchy, and query content with WP_Query. Manual CPT registration provides complete control, better performance, and deeper platform understanding compared to plugin-based approaches.

External Links

Call to Action

Custom post types need protection. Backup Copilot Pro safeguards your WordPress custom configurations and content. Protect your CPT implementations—start your free 30-day trial today!

The post How to Add Custom Post Types to WordPress Without Plugins appeared first on Developry Plugins.

How to Add Custom User Roles and Capabilities in WordPress

Krasen Slavov — Sat, 15 Aug 2026 09:00:00 +0000

WordPress user roles and capabilities system controls who accesses what functionality. Beyond default roles (Administrator, Editor, Author), custom roles enable precise permission management for clients, contributors, and specialized users. This comprehensive guide teaches role creation, capability assignment, conditional content display, and advanced permission management for granular WordPress access control.

Understanding Roles vs Capabilities

Roles: Predefined permission sets assigned to users.

Capabilities: Specific permissions (edit_posts, publish_pages, manage_options).

Relationship: Roles contain multiple capabilities. Users assigned roles inherit those capabilities.

Example: Editor role includes edit_posts, publish_posts, edit_pages, but excludes manage_options.

Default WordPress Roles

Super Admin (Multisite only):

Network-level control
All capabilities across all sites

Administrator:

Complete site control
User management
Plugin/theme installation
Settings modification

Editor:

Manage and publish all posts
Moderate comments
Manage categories/tags

Author:

Write and publish own posts
Upload files
Cannot edit others’ posts

Contributor:

Write posts (cannot publish)
Edit own unpublished posts
No media upload

Subscriber:

Read content
Manage own profile
No posting capabilities

Creating Custom User Roles

Basic Role Creation:

function dprt_add_custom_role() {
    add_role(
        'client',                    // Role slug
        'Client',                    // Display name
        array(
            'read' => true,          // Capability
            'edit_posts' => false,
            'delete_posts' => false,
        )
    );
}
add_action('init', 'dprt_add_custom_role');

Run once: Use plugin activation hook or run manually then remove code.

Plugin Activation Hook:

register_activation_hook(__FILE__, 'dprt_add_custom_role');

Custom Role with Specific Capabilities

Content Manager Role:

function dprt_add_content_manager_role() {
    add_role('content_manager', 'Content Manager', array(
        // Basic capabilities
        'read' => true,

        // Post capabilities
        'edit_posts' => true,
        'edit_published_posts' => true,
        'publish_posts' => true,
        'delete_posts' => true,
        'delete_published_posts' => true,

        // Page capabilities
        'edit_pages' => true,
        'edit_published_pages' => true,
        'publish_pages' => true,
        'delete_pages' => true,

        // Media
        'upload_files' => true,

        // Comments
        'moderate_comments' => true,

        // Categories/Tags
        'manage_categories' => true,

        // Excluded capabilities
        'manage_options' => false,
        'edit_theme_options' => false,
        'install_plugins' => false,
        'activate_plugins' => false,
    ));
}
register_activation_hook(__FILE__, 'dprt_add_content_manager_role');

Adding Capabilities to Existing Roles

Add Capability to Role:

function dprt_add_capabilities_to_editor() {
    $role = get_role('editor');
    $role->add_cap('edit_theme_options');  // Access Appearance menu
    $role->add_cap('manage_options');      // Access Settings
}
add_action('admin_init', 'dprt_add_capabilities_to_editor');

Run once then remove to avoid adding capability repeatedly.

Removing Capabilities

function dprt_remove_capability() {
    $role = get_role('author');
    $role->remove_cap('publish_posts');  // Authors can't publish, only draft
}
add_action('admin_init', 'dprt_remove_capability');

Custom Post Type Capabilities

CPT with Custom Capabilities:

register_post_type('portfolio', array(
    'capability_type' => array('portfolio_item', 'portfolio_items'),
    'map_meta_cap' => true,
    // ... other args
));

Generates capabilities:

edit_portfolio_item
edit_portfolio_items
edit_published_portfolio_items
publish_portfolio_items
read_private_portfolio_items
delete_portfolio_items
etc.

Assign CPT Capabilities to Role:

function dprt_add_portfolio_caps_to_editor() {
    $role = get_role('editor');

    $caps = array(
        'edit_portfolio_item',
        'edit_portfolio_items',
        'edit_others_portfolio_items',
        'publish_portfolio_items',
        'read_private_portfolio_items',
        'delete_portfolio_items',
        'delete_private_portfolio_items',
        'delete_published_portfolio_items',
        'delete_others_portfolio_items',
        'edit_private_portfolio_items',
        'edit_published_portfolio_items',
    );

    foreach ($caps as $cap) {
        $role->add_cap($cap);
    }
}
add_action('admin_init', 'dprt_add_portfolio_caps_to_editor');

Removing Custom Roles

function dprt_remove_custom_role() {
    remove_role('client');
}
register_deactivation_hook(__FILE__, 'dprt_remove_custom_role');

Checking User Capabilities

Check if User Can:

if (current_user_can('manage_options')) {
    // User is administrator or has manage_options capability
    echo 'You have admin access';
}

if (current_user_can('edit_posts')) {
    echo 'You can edit posts';
}

Check Specific User:

$user = get_userdata($user_id);
if ($user && $user->has_cap('publish_posts')) {
    // User can publish posts
}

Conditional Content Display

Show Content Based on Role:

// Show admin-only content
if (current_user_can('administrator')) {
    echo 'Admin-only message
';
}

// Show for multiple roles
if (current_user_can('edit_posts') || current_user_can('edit_pages')) {
    echo 'You can edit content
';
}

Shortcode for Role-Based Content:

function dprt_role_content_shortcode($atts, $content = null) {
    $atts = shortcode_atts(array(
        'role' => 'administrator',
    ), $atts);

    if (current_user_can($atts['role'])) {
        return do_shortcode($content);
    }

    return '';
}
add_shortcode('role_content', 'dprt_role_content_shortcode');

// Usage: [role_content role="editor"]Content for editors only[/role_content]

Hide Menu Items by Role:

function dprt_remove_menus() {
    // For non-administrators
    if (!current_user_can('administrator')) {
        remove_menu_page('tools.php');        // Tools
        remove_menu_page('plugins.php');      // Plugins
        remove_menu_page('themes.php');       // Appearance
        remove_menu_page('users.php');        // Users
    }

    // For editors (more restrictive)
    if (current_user_can('editor')) {
        remove_menu_page('options-general.php'); // Settings
    }
}
add_action('admin_menu', 'dprt_remove_menus', 999);

function dprt_remove_dashboard_widgets() {
    if (!current_user_can('administrator')) {
        remove_meta_box('dashboard_primary', 'dashboard', 'side');  // WordPress News
        remove_meta_box('dashboard_quick_press', 'dashboard', 'side'); // Quick Draft
    }
}
add_action('wp_dashboard_setup', 'dprt_remove_dashboard_widgets');

Custom Capabilities for Plugins

Create Plugin-Specific Capability:

function dprt_add_plugin_capability() {
    $admin = get_role('administrator');
    $admin->add_cap('manage_custom_plugin');

    $editor = get_role('editor');
    $editor->add_cap('use_custom_plugin');  // Limited access
}
register_activation_hook(__FILE__, 'dprt_add_plugin_capability');

// Check capability before showing plugin features
if (current_user_can('manage_custom_plugin')) {
    // Show advanced plugin settings
}

Role Management Plugins

Members Plugin:

GUI for role/capability management
Clone existing roles
Create custom capabilities
User-friendly interface

User Role Editor:

Edit role capabilities visually
Assign multiple roles to users
Capability filtering

PublishPress Capabilities:

Role duplication
Capability management
Custom post type integration

Advanced: Multiple Roles per User

WordPress doesn’t natively support multiple roles well, but:

function dprt_add_secondary_role($user_id, $role) {
    $user = get_userdata($user_id);
    $user->add_role($role);  // Adds role without removing existing
}

// Usage
dprt_add_secondary_role(5, 'editor');  // User 5 now has their original role + editor

Check Any of Multiple Roles:

function dprt_user_has_role($user_id, $roles) {
    $user = get_userdata($user_id);
    if (!$user) return false;

    foreach ($roles as $role) {
        if (in_array($role, (array) $user->roles)) {
            return true;
        }
    }
    return false;
}

// Usage
if (dprt_user_has_role($user_id, array('editor', 'administrator'))) {
    // User is editor OR administrator
}

Security Best Practices

Principle of Least Privilege: Grant minimum necessary capabilities.

Avoid Capability Checks by Role Name:

// BAD
if (in_array('administrator', $user->roles)) { }

// GOOD
if (current_user_can('manage_options')) { }

Capability checks are more flexible and future-proof.

Escape Output:

// When displaying user-submitted content based on roles
if (current_user_can('edit_posts')) {
    echo '' . esc_html($user_content) . '
';
}

Debugging Roles and Capabilities

View User Capabilities:

function dprt_show_user_capabilities() {
    $user = wp_get_current_user();
    echo '';
    print_r($user->allcaps);  // All capabilities
    print_r($user->roles);     // Assigned roles
    echo '
';
}
add_action('admin_notices', 'dprt_show_user_capabilities');

List All Roles:

global $wp_roles;
$all_roles = $wp_roles->roles;
print_r($all_roles);

Programmatic Role Assignment

Assign Role to User on Registration:

function dprt_set_default_user_role($user_id) {
    $user = get_userdata($user_id);
    $user->set_role('client');  // Change from default 'subscriber'
}
add_action('user_register', 'dprt_set_default_user_role');

Change Role Based on Conditions:

function dprt_upgrade_user_role($user_id) {
    // Example: Upgrade to author after 10 published comments
    $comment_count = get_comments(array(
        'user_id' => $user_id,
        'status' => 'approve',
        'count' => true
    ));

    if ($comment_count >= 10) {
        $user = get_userdata($user_id);
        $user->set_role('author');
    }
}

WooCommerce Custom Roles

Customer Role Modifications:

function dprt_modify_customer_role() {
    $customer = get_role('customer');
    $customer->add_cap('read');
    $customer->add_cap('view_order_history');  // Custom capability
}
add_action('init', 'dprt_modify_customer_role');

Conclusion

WordPress custom user roles and capabilities enable precise permission management beyond default role limitations. Create custom roles with add_role(), assign specific capabilities via add_cap(), check permissions using current_user_can(), and implement role-based content visibility. Programmatic role management provides granular access control for clients, contributors, and specialized users, ensuring security through least-privilege principles while maintaining workflow flexibility.

External Links

Call to Action

User management configurations need protection. Backup Copilot Pro safeguards your WordPress user roles and permissions. Protect your access control setup—start your free 30-day trial today!

The post How to Add Custom User Roles and Capabilities in WordPress appeared first on Developry Plugins.

How to Block Brute Force Attacks on WordPress Login Pages

Krasen Slavov — Mon, 10 Aug 2026 09:00:00 +0000

Brute force attacks on WordPress login pages are relentless. Bots try thousands of username/password combinations until they gain access. These attacks consume server resources, slow down your site, and eventually succeed against weak passwords.

This guide provides multiple defensive layers to block brute force attacks, from limiting login attempts to IP whitelisting and CAPTCHA implementation.

Understanding Brute Force Attacks

How They Work

Attackers use automated scripts to try common passwords against wp-login.php:

admin / password
admin / 123456
admin / admin123
administrator / password
...thousands more combinations

Signs of an Attack

Hundreds of failed login attempts in logs
Increased server CPU/memory usage
Slow admin dashboard
Email flood of failed login notifications
IP addresses from foreign countries
Automated bot patterns (rapid-fire attempts)

# Install via WP-CLI
wp plugin install limit-login-attempts-reloaded --activate

Recommended Settings:

Allowed attempts: 4
Lockout duration: 20 minutes
Reset after: 12 hours
Long lockout: 24 hours after 4 lockouts

Manual Implementation:

// In functions.php or custom plugin
add_action('wp_login_failed', 'track_failed_login');

function track_failed_login($username) {
    $ip = $_SERVER['REMOTE_ADDR'];
    $attempts = get_transient('failed_login_' . $ip) ?: 0;
    $attempts++;

    set_transient('failed_login_' . $ip, $attempts, 20 * MINUTE_IN_SECONDS);

    if ($attempts >= 5) {
        // Lock out this IP
        set_transient('lockout_' . $ip, true, HOUR_IN_SECONDS);
        wp_die('Too many failed login attempts. Please try again in 1 hour.');
    }
}

// Check before allowing login
add_filter('authenticate', 'check_lockout', 30, 3);

function check_lockout($user, $username, $password) {
    $ip = $_SERVER['REMOTE_ADDR'];

    if (get_transient('lockout_' . $ip)) {
        return new WP_Error('lockout', 'Account locked due to too many failed attempts.');
    }

    return $user;
}

Layer 2: Add CAPTCHA Protection

Google reCAPTCHA v3 Integration

// Add to functions.php

// Enqueue reCAPTCHA script
add_action('login_enqueue_scripts', 'add_recaptcha_to_login');

function add_recaptcha_to_login() {
    ?>
    
    
    <?php
}

// Add reCAPTCHA to login form
add_action('login_form', 'display_recaptcha');

function display_recaptcha() {
    ?>
    class="g-recaptcha" data-sitekey="YOUR_SITE_KEY" data-callback="onSubmit">
    <?php
}

// Verify reCAPTCHA
add_filter('authenticate', 'verify_recaptcha', 30, 3);

function verify_recaptcha($user, $username, $password) {
    if (empty($_POST['g-recaptcha-response'])) {
        return new WP_Error('captcha_failed', 'Please complete the reCAPTCHA.');
    }

    $recaptcha = $_POST['g-recaptcha-response'];
    $secret_key = 'YOUR_SECRET_KEY';

    $response = wp_remote_post('https://www.google.com/recaptcha/api/siteverify', [
        'body' => [
            'secret' => $secret_key,
            'response' => $recaptcha,
            'remoteip' => $_SERVER['REMOTE_ADDR']
        ]
    ]);

    $response_body = json_decode(wp_remote_retrieve_body($response));

    if (!$response_body->success || $response_body->score < 0.5) {
        return new WP_Error('captcha_failed', 'reCAPTCHA verification failed.');
    }

    return $user;
}

wp plugin install wps-hide-login --activate

Settings: Change /wp-login.php to /my-secure-login

Manual Method (via .htaccess):

# Redirect wp-login.php to custom URL
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-login\.php
RewriteCond %{QUERY_STRING} !^action=logout
RewriteCond %{QUERY_STRING} !^action=rp
RewriteCond %{QUERY_STRING} !^action=register
RewriteRule ^(.*)$ /custom-login-url? [R=301,L]

Caution: Remember your custom URL. Losing it locks you out.

Layer 4: IP Whitelisting

Restrict wp-admin by IP

# In wp-admin/.htaccess
 admin-ajax.php>
    Order allow,deny
    Allow from all
    Satisfy any


# Block all other wp-admin access except your IP
Order deny,allow
Deny from all
Allow from 123.456.789.0
Allow from 987.654.321.0

For Nginx:

location ~* /wp-admin/ {
    allow 123.456.789.0;
    deny all;
}

Dynamic IP Solution (for VPN/mobile users):

// In functions.php - Email-based IP whitelisting
add_action('wp_login_failed', 'email_whitelist_request');

function email_whitelist_request($username) {
    $ip = $_SERVER['REMOTE_ADDR'];
    $whitelist = get_option('ip_whitelist', []);

    if (!in_array($ip, $whitelist)) {
        // Send email to admin with "approve" link
        $approve_url = admin_url('admin.php?action=approve_ip&ip=' . $ip);
        wp_mail(
            get_option('admin_email'),
            'New IP Login Attempt',
            "Approve IP $ip: $approve_url"
        );
    }
}

Layer 5: WordPress Firewall

Wordfence Configuration

wp plugin install wordfence --activate

Essential Settings:

Enable Extended Protection (premium feature)
Brute Force Protection:
- Enable login page CAPTCHA
- Immediately block invalid usernames
- Lock out after 5 failed logins
Advanced Blocking:
- Block attackers from specific countries
- Throttle login attempts
- Block known malicious IPs

Rate Limiting Example:

// Wordfence alternative - manual rate limiting
add_action('login_form', 'add_login_delay');

function add_login_delay() {
    $ip = $_SERVER['REMOTE_ADDR'];
    $last_attempt = get_transient('last_login_attempt_' . $ip);

    if ($last_attempt && (time() - $last_attempt) < 3) {
        sleep(3); // Force 3-second delay between attempts
    }

    set_transient('last_login_attempt_' . $ip, time(), MINUTE_IN_SECONDS);
}

Layer 6: Cloudflare Protection

Enable Cloudflare Firewall Rules

Sign up for Cloudflare (free plan works)
Add your domain
Update nameservers
Enable “Under Attack Mode” during active brute force

Firewall Rule:

(http.request.uri.path contains "/wp-login.php") and
(not ip.geoip.country in {"US" "CA" "GB"})

This blocks non-US/CA/GB traffic to login page.

Layer 7: Two-Factor Authentication

Combine 2FA with login limits for ultimate protection:

wp plugin install two-factor --activate

Even if attackers guess passwords, they can’t login without the second factor.

Layer 8: Disable XML-RPC

XML-RPC can be used for brute force attacks:

# In .htaccess
 xmlrpc.php>
    Order deny,allow
    Deny from all

Or via plugin code:

// Completely disable XML-RPC
add_filter('xmlrpc_enabled', '__return_false');

// Or disable only certain methods
add_filter('xmlrpc_methods', 'disable_xmlrpc_methods');

function disable_xmlrpc_methods($methods) {
    unset($methods['wp.getUsersBlogs']);
    unset($methods['system.multicall']);
    unset($methods['system.listMethods']);
    return $methods;
}

Layer 9: Server-Level Protection (Fail2Ban)

Configure Fail2Ban for WordPress

# Install Fail2Ban (Ubuntu/Debian)
sudo apt-get install fail2ban

# Create WordPress filter
sudo nano /etc/fail2ban/filter.d/wordpress.conf

Filter Content:

[Definition]
failregex = ^ .* "POST /wp-login.php
            ^ .* "POST /xmlrpc.php
ignoreregex =

Jail Configuration:

# In /etc/fail2ban/jail.local
[wordpress]
enabled = true
port = http,https
filter = wordpress
logpath = /var/log/apache2/access.log
maxretry = 5
bantime = 3600
findtime = 600

Restart Fail2Ban:

sudo systemctl restart fail2ban

Monitoring and Alerts

Email Notifications

// Email admin on failed logins
add_action('wp_login_failed', 'notify_failed_login');

function notify_failed_login($username) {
    $ip = $_SERVER['REMOTE_ADDR'];
    $time = current_time('mysql');

    wp_mail(
        get_option('admin_email'),
        'Failed Login Attempt',
        "Failed login for username: $username\nIP: $ip\nTime: $time"
    );
}

Log Analysis

# View recent failed logins (Apache)
grep "wp-login.php" /var/log/apache2/access.log | grep "POST" | tail -50

# Count attempts by IP
awk '{print $1}' /var/log/apache2/access.log | grep -v "^$" | sort | uniq -c | sort -rn | head -20

Testing Your Protection

Safe Simulation

Use incognito browser
Attempt 5-6 failed logins
Verify lockout occurs
Check email notifications
Confirm CAPTCHA appears (if configured)
Test IP whitelist (from different IP)

Automated Test:

# Test with curl (safely)
for i in {1..6}; do
    curl -X POST https://yoursite.com/wp-login.php \
    -d "log=testuser&pwd=wrongpassword"
    sleep 2
done

Best Practices Summary

✅ Do:

Limit login attempts (4-5 max)
Add CAPTCHA protection
Use strong, unique passwords
Enable 2FA for all admins
Monitor failed login logs
Update security plugins regularly

❌ Don’t:

Use “admin” as username
Allow unlimited login attempts
Ignore failed login notifications
Use same password across accounts
Disable security features for convenience

Complete Protection Stack

Recommended combination:

Strong passwords (20+ characters)
Limit Login Attempts Reloaded (free)
Google reCAPTCHA v3 (free)
Wordfence or Sucuri (free/premium)
Two-Factor Authentication (free)
Cloudflare (free tier sufficient)
Fail2Ban (server-level, free)

This multi-layered approach stops 99.9% of brute force attacks while maintaining usability for legitimate users.

Brute force attacks are preventable. By implementing these protective layers, you transform WordPress login from a vulnerable entry point into a hardened fortress. Start with basic login limits and CAPTCHA, then add additional layers based on your threat level and resources.

External Links

Call to Action

Secure your site with bulletproof backups! Backup Copilot Pro offers automated security audits, malware scanning before backups, and instant recovery—try it free!

The post How to Block Brute Force Attacks on WordPress Login Pages appeared first on Developry Plugins.

How to Build Dynamic Blocks with WordPress Block Editor

Krasen Slavov — Wed, 05 Aug 2026 09:00:00 +0000

Dynamic blocks represent a powerful evolution in WordPress block development, enabling server-side rendering that displays real-time data, database queries, and user-specific content. This guide teaches you to build dynamic blocks that combine the flexibility of Gutenberg with the power of PHP.

Static vs Dynamic Blocks

Understanding the difference between static and dynamic blocks is fundamental.

Static blocks save their content directly to the database as HTML. When you create a paragraph block, WordPress stores the exact HTML in post_content. This is efficient for content that doesn’t change.

Dynamic blocks save only their attributes to the database. Each time the page loads, WordPress executes a PHP render callback that generates the HTML. This enables real-time data like “latest posts,” user-specific content, and database queries.

Use static blocks for fixed content. Use dynamic blocks when content must update automatically based on data changes, user context, or external sources.

When to Use Dynamic Blocks

Dynamic blocks excel in specific scenarios:

Latest content displays – Showing recent posts, comments, or custom post types
User-specific content – Displaying personalized data based on logged-in users
External data – Fetching and displaying API data, weather, stock prices
Database queries – Running complex WP_Query operations
Real-time calculations – Computing values based on current data

Avoid dynamic blocks for purely presentational content that never changes. The server-side rendering adds processing overhead unnecessary for static content.

Creating Your First Dynamic Block

Start with block.json to define your block:

{
    "apiVersion": 3,
    "name": "dprt/recent-posts",
    "title": "Recent Posts",
    "category": "widgets",
    "icon": "list-view",
    "description": "Display recent posts dynamically",
    "attributes": {
        "numberOfPosts": {
            "type": "number",
            "default": 5
        },
        "postType": {
            "type": "string",
            "default": "post"
        }
    },
    "editorScript": "file:./index.js",
    "editorStyle": "file:./editor.css",
    "style": "file:./style.css"
}

function dprt_register_recent_posts_block() {
    register_block_type( __DIR__ . '/build/blocks/recent-posts', array(
        'render_callback' => 'dprt_render_recent_posts_block'
    ) );
}
add_action( 'init', 'dprt_register_recent_posts_block' );

Implementing the Render Callback

The render callback function generates your block’s HTML:

function dprt_render_recent_posts_block( $attributes, $content, $block ) {
    $number_of_posts = isset( $attributes['numberOfPosts'] ) ? absint( $attributes['numberOfPosts'] ) : 5;
    $post_type = isset( $attributes['postType'] ) ? sanitize_text_field( $attributes['postType'] ) : 'post';

    $args = array(
        'post_type' => $post_type,
        'posts_per_page' => $number_of_posts,
        'post_status' => 'publish',
        'orderby' => 'date',
        'order' => 'DESC'
    );

    $query = new WP_Query( $args );

    if ( ! $query->have_posts() ) {
        return '' . esc_html__( 'No posts found.', 'dprt' ) . '
';
    }

    $output = '';
    $output .= '';

    while ( $query->have_posts() ) {
        $query->the_post();
        $output .= '';
        $output .= '( get_permalink() ) . '">';
        $output .= esc_html( get_the_title() );
        $output .= '';
        $output .= ' - ' . esc_html( get_the_date() ) . '';
        $output .= '
';
    }

    $output .= '
';
    $output .= '
';

    wp_reset_postdata();

    return $output;
}

Always sanitize attributes and escape output to prevent security vulnerabilities.

Editor Controls and Preview

Create InspectorControls for block settings:

import { useBlockProps, InspectorControls } from "@wordpress/block-editor";
import { PanelBody, RangeControl, SelectControl } from "@wordpress/components";
import ServerSideRender from "@wordpress/server-side-render";

export default function Edit({ attributes, setAttributes }) {
    const { numberOfPosts, postType } = attributes;

    return (
        <>
            <InspectorControls>
                <PanelBody title="Settings">
                    <RangeControl
                        label="Number of posts"
                        value={numberOfPosts}
                        onChange={(value) => setAttributes({ numberOfPosts: value })}
                        min={1}
                        max={20}
                    />
                    <SelectControl
                        label="Post Type"
                        value={postType}
                        options={[
                            { label: "Posts", value: "post" },
                            { label: "Pages", value: "page" }
                        ]}
                        onChange={(value) => setAttributes({ postType: value })}
                    />
                PanelBody>
            InspectorControls>
            <div {...useBlockProps()}>
                <ServerSideRender block="dprt/recent-posts" attributes={attributes} />
            div>
        
    );
}

ServerSideRender displays a live preview in the editor by calling your render callback via AJAX.

Performance Optimization with Caching

Dynamic blocks can impact performance. Implement caching for expensive operations:

function dprt_render_recent_posts_block( $attributes, $content, $block ) {
    $number_of_posts = isset( $attributes['numberOfPosts'] ) ? absint( $attributes['numberOfPosts'] ) : 5;

    // Create unique cache key based on attributes
    $cache_key = 'dprt_recent_posts_' . md5( serialize( $attributes ) );

    // Try to get cached result
    $cached = get_transient( $cache_key );
    if ( false !== $cached ) {
        return $cached;
    }

    // Generate output (expensive operation)
    $output = dprt_generate_recent_posts_html( $number_of_posts );

    // Cache for 1 hour
    set_transient( $cache_key, $output, HOUR_IN_SECONDS );

    return $output;
}

Clear the cache when content updates:

function dprt_clear_recent_posts_cache( $post_id ) {
    // Clear all recent posts caches
    global $wpdb;
    $wpdb->query( "DELETE FROM {$wpdb->options} WHERE option_name LIKE '_transient_dprt_recent_posts_%'" );
}
add_action( 'save_post', 'dprt_clear_recent_posts_cache' );

User-Specific Content

Display personalized content based on the logged-in user:

function dprt_render_user_dashboard_block( $attributes, $content, $block ) {
    if ( ! is_user_logged_in() ) {
        return '' . esc_html__( 'Please log in to view your dashboard.', 'dprt' ) . '
';
    }

    $current_user = wp_get_current_user();
    $user_posts = count_user_posts( $current_user->ID );

    $output = '';
    $output .= '' . sprintf( esc_html__( 'Welcome, %s', 'dprt' ), esc_html( $current_user->display_name ) ) . '
';
    $output .= '' . sprintf( esc_html__( 'You have published %d posts.', 'dprt' ), $user_posts ) . '
';
    $output .= '
';

    return $output;
}

External API Integration

Fetch and display external data:

function dprt_render_weather_block( $attributes, $content, $block ) {
    $city = isset( $attributes['city'] ) ? sanitize_text_field( $attributes['city'] ) : 'London';
    $cache_key = 'dprt_weather_' . sanitize_title( $city );

    $weather_data = get_transient( $cache_key );

    if ( false === $weather_data ) {
        $api_url = 'https://api.weatherapi.com/v1/current.json?key=YOUR_KEY&q=' . urlencode( $city );
        $response = wp_remote_get( $api_url );

        if ( is_wp_error( $response ) ) {
            return '' . esc_html__( 'Unable to fetch weather data.', 'dprt' ) . '
';
        }

        $weather_data = json_decode( wp_remote_retrieve_body( $response ), true );
        set_transient( $cache_key, $weather_data, 30 * MINUTE_IN_SECONDS );
    }

    $temp = isset( $weather_data['current']['temp_c'] ) ? $weather_data['current']['temp_c'] : 'N/A';

    return '' .
           '' . esc_html( $city ) . ': ' . esc_html( $temp ) . '°C
' .
           '
';
}

Error Handling

Implement robust error handling:

function dprt_render_dynamic_block( $attributes, $content, $block ) {
    try {
        // Validate attributes
        if ( ! isset( $attributes['requiredField'] ) ) {
            throw new Exception( 'Required field missing' );
        }

        // Attempt operation
        $result = dprt_perform_operation( $attributes );

        if ( false === $result ) {
            throw new Exception( 'Operation failed' );
        }

        return $result;
    } catch ( Exception $e ) {
        // Log error
        error_log( 'Dynamic block error: ' . $e->getMessage() );

        // Return user-friendly message
        return '' . esc_html__( 'Content temporarily unavailable.', 'dprt' ) . '
';
    }
}

Conclusion

Dynamic blocks combine Gutenberg’s user-friendly interface with PHP’s server-side power. Use them for real-time data, personalization, and database queries. Implement caching for performance, validate all inputs, escape all outputs, and handle errors gracefully. Start with simple dynamic blocks and gradually build more complex functionality as you master the concepts.

External Links

Call to Action

Streamline your workflow! Block Editor Navigator Pro provides instant block navigation, search, and organization. Find any block in seconds—try it free!

The post How to Build Dynamic Blocks with WordPress Block Editor appeared first on Developry Plugins.

How to Create a WordPress Plugin Settings Page (Step-by-Step)

Krasen Slavov — Thu, 30 Jul 2026 09:00:00 +0000

Plugin settings pages allow users to configure your plugin without touching code. The WordPress Settings API provides a standardized, secure way to create settings pages that follow WordPress UI conventions and handle data properly.

Why Use the Settings API

The Settings API offers significant advantages over custom form handling:

Automatic security – Nonces and capability checks are built-in Consistent UI – Pages match WordPress admin styling automatically Data handling – WordPress manages saving, sanitization, and validation Best practices – Follows WordPress standards automatically

Avoid building custom form handlers. The Settings API is tested, secure, and maintained by WordPress core.

First, add a menu page to WordPress admin:

function dprt_add_settings_page() {
    add_options_page(
        'My Plugin Settings',          // Page title
        'My Plugin',                   // Menu title
        'manage_options',              // Capability
        'my-plugin-settings',          // Menu slug
        'dprt_render_settings_page'    // Callback function
    );
}
add_action( 'admin_menu', 'dprt_add_settings_page' );

This adds a submenu under Settings. For a top-level menu, use add_menu_page() instead.

Registering Settings

function dprt_register_settings() {
    register_setting(
        'dprt_settings_group',       // Option group
        'dprt_api_key',              // Option name
        array(
            'type' => 'string',
            'sanitize_callback' => 'sanitize_text_field',
            'default' => ''
        )
    );

    register_setting(
        'dprt_settings_group',
        'dprt_enable_feature',
        array(
            'type' => 'boolean',
            'default' => false
        )
    );
}
add_action( 'admin_init', 'dprt_register_settings' );

Each setting gets a name (stored in wp_options), type, sanitization callback, and default value.

Creating Settings Sections

Organize settings into logical sections:

function dprt_register_settings_sections() {
    add_settings_section(
        'dprt_api_section',              // Section ID
        'API Configuration',             // Section title
        'dprt_api_section_callback',     // Section callback
        'my-plugin-settings'             // Page slug
    );

    add_settings_section(
        'dprt_display_section',
        'Display Options',
        'dprt_display_section_callback',
        'my-plugin-settings'
    );
}
add_action( 'admin_init', 'dprt_register_settings_sections' );

function dprt_api_section_callback() {
    echo 'Configure API settings for third-party integrations.
';
}

function dprt_display_section_callback() {
    echo 'Control how content displays on your site.
';
}

Sections group related settings with descriptive headers and instructions.

Adding Settings Fields

Add individual fields to sections:

function dprt_register_settings_fields() {
    // Text field
    add_settings_field(
        'dprt_api_key',                  // Field ID
        'API Key',                       // Field title
        'dprt_api_key_callback',         // Field callback
        'my-plugin-settings',            // Page slug
        'dprt_api_section'               // Section ID
    );

    // Checkbox field
    add_settings_field(
        'dprt_enable_feature',
        'Enable Feature',
        'dprt_enable_feature_callback',
        'my-plugin-settings',
        'dprt_display_section'
    );
}
add_action( 'admin_init', 'dprt_register_settings_fields' );

Field Callback Functions

Field callbacks render the HTML inputs:

// Text input
function dprt_api_key_callback() {
    $value = get_option( 'dprt_api_key', '' );
    echo '( $value ) . '" class="regular-text">';
    echo 'Enter your API key from the provider.
';
}

// Checkbox
function dprt_enable_feature_callback() {
    $value = get_option( 'dprt_enable_feature', false );
    echo ' . checked( 1, $value, false ) . '>';
    echo 'Enable this experimental feature';
}

// Select dropdown
function dprt_display_style_callback() {
    $value = get_option( 'dprt_display_style', 'default' );
    $options = array(
        'default' => 'Default Style',
        'minimal' => 'Minimal Style',
        'fancy' => 'Fancy Style'
    );
    echo '';
}

Always escape output and use WordPress helper functions like checked() and selected().

Rendering the Settings Page

The settings page displays all registered sections and fields:

function dprt_render_settings_page() {
    // Check user capabilities
    if ( ! current_user_can( 'manage_options' ) ) {
        return;
    }

    // Show error/update messages
    settings_errors( 'dprt_messages' );
    ?>
    class="wrap">
        <?php echo esc_html( get_admin_page_title() ); ?>
        "options.php" method="post">
            <?php
            // Output security fields
            settings_fields( 'dprt_settings_group' );

            // Output settings sections
            do_settings_sections( 'my-plugin-settings' );

            // Output submit button
            submit_button( 'Save Settings' );
            ?>
        
    
    <?php
}

settings_fields() outputs hidden nonce fields. do_settings_sections() renders all registered sections and fields. submit_button() creates the submit button.

Custom Sanitization

Implement custom sanitization for complex data:

function dprt_sanitize_email_list( $input ) {
    $emails = explode( ',', $input );
    $sanitized = array();

    foreach ( $emails as $email ) {
        $email = trim( $email );
        if ( is_email( $email ) ) {
            $sanitized[] = sanitize_email( $email );
        }
    }

    return implode( ', ', $sanitized );
}

register_setting(
    'dprt_settings_group',
    'dprt_email_list',
    array(
        'sanitize_callback' => 'dprt_sanitize_email_list'
    )
);

Sanitization callbacks clean data before saving to the database.

Validation and Error Messages

Add validation with admin notices:

function dprt_validate_api_key( $value ) {
    if ( strlen( $value ) < 32 ) {
        add_settings_error(
            'dprt_messages',
            'dprt_message',
            'API key must be at least 32 characters long.',
            'error'
        );
        // Return old value to prevent invalid save
        return get_option( 'dprt_api_key' );
    }
    return $value;
}

Tabbed Settings Interface

For complex plugins, organize settings into tabs:

function dprt_render_tabbed_settings_page() {
    $active_tab = isset( $_GET['tab'] ) ? $_GET['tab'] : 'general';
    ?>
    class="wrap">
        My Plugin Settings
        class="nav-tab-wrapper">
            "?page=my-plugin-settings&tab=general" class="nav-tab $active_tab === 'general' ? 'nav-tab-active' : ''; ?>">General
            "?page=my-plugin-settings&tab=advanced" class="nav-tab $active_tab === 'advanced' ? 'nav-tab-active' : ''; ?>">Advanced
        
        "options.php" method="post">
            <?php
            if ( $active_tab === 'general' ) {
                settings_fields( 'dprt_general_settings' );
                do_settings_sections( 'dprt-general-settings' );
            } else {
                settings_fields( 'dprt_advanced_settings' );
                do_settings_sections( 'dprt-advanced-settings' );
            }
            submit_button();
            ?>
        
    
    <?php
}

Retrieving Saved Options

Access saved settings anywhere in your plugin:

// Single option
$api_key = get_option( 'dprt_api_key', '' );

// Multiple options
$options = array(
    'api_key' => get_option( 'dprt_api_key', '' ),
    'enable_feature' => get_option( 'dprt_enable_feature', false ),
    'display_style' => get_option( 'dprt_display_style', 'default' )
);

Always provide default values as the second parameter.

Conclusion

The WordPress Settings API streamlines plugin configuration. Register settings, create sections and fields, render the page with built-in functions, and WordPress handles security, validation, and data storage. This approach creates professional, secure settings pages that integrate seamlessly with WordPress admin.

Real-world settings page examples

Includes complete code examples, form templates, and best practices for creating user-friendly plugin settings interfaces.

External Links

Call to Action

Supercharge your development! ACF Copilot Pro generates ACF field groups with AI, exports to PHP, and accelerates custom field workflows—try it free!

The post How to Create a WordPress Plugin Settings Page (Step-by-Step) appeared first on Developry Plugins.

How to Create ACF Field Groups Programmatically with PHP

Krasen Slavov — Sat, 25 Jul 2026 09:00:00 +0000

Programmatic ACF field registration through acf_add_local_field_group() enables version-controlled field configurations eliminating manual UI setup and database storage. From basic field group arrays and field type definitions to conditional logic arrays and dynamic field generation, programmatic registration ensures consistent deployments. This comprehensive guide teaches acf_add_local_field_group() syntax, field array structure, location rules, conditional logic, field cloning, and advanced techniques creating maintainable ACF configurations through code.

Why Register Fields Programmatically?

Benefits of Programmatic Registration:

Version Control: Field configurations in Git
Deployment: Automatic field sync across environments
Code Review: Field changes reviewed in pull requests
Portability: Easy theme/plugin distribution
Performance: Faster than database lookups
Documentation: Self-documenting field structure
Automation: Dynamic field generation

Database vs Programmatic:

Database (UI):
- Stored in wp_posts
- Manual export/import
- Sync issues between environments

Programmatic (PHP):
- Stored in theme/plugin files
- Git versioned
- Automatic sync via code deployment

Basic Field Group Registration

Simple Field Group (functions.php):

function mytheme_register_acf_fields() {
    // Check if ACF is installed
    if (!function_exists('acf_add_local_field_group')) {
        return;
    }

    acf_add_local_field_group(array(
        'key' => 'group_product_details',
        'title' => 'Product Details',
        'fields' => array(
            array(
                'key' => 'field_product_price',
                'label' => 'Price',
                'name' => 'product_price',
                'type' => 'number',
                'prefix' => '$',
                'prepend' => '$',
                'step' => 0.01,
                'required' => 1,
            ),
            array(
                'key' => 'field_product_sku',
                'label' => 'SKU',
                'name' => 'product_sku',
                'type' => 'text',
                'placeholder' => 'Enter SKU',
            ),
        ),
        'location' => array(
            array(
                array(
                    'param' => 'post_type',
                    'operator' => '==',
                    'value' => 'product',
                ),
            ),
        ),
    ));
}
add_action('acf/init', 'mytheme_register_acf_fields');

Field Group Array Structure

Complete Field Group Configuration:

acf_add_local_field_group(array(
    // Required
    'key' => 'group_unique_key',
    'title' => 'Field Group Title',

    // Optional settings
    'fields' => array(), // Field array
    'location' => array(), // Location rules
    'menu_order' => 0, // Order in edit screen
    'position' => 'normal', // normal, acf_after_title, side
    'style' => 'default', // default, seamless
    'label_placement' => 'top', // top, left
    'instruction_placement' => 'label', // label, field
    'hide_on_screen' => array(), // Hide WP metaboxes
    'active' => true, // Active state
    'description' => '', // Group description
));

Common Field Types

Text Field:

array(
    'key' => 'field_company_name',
    'label' => 'Company Name',
    'name' => 'company_name',
    'type' => 'text',
    'default_value' => '',
    'placeholder' => '',
    'maxlength' => '',
    'required' => 0,
    'prepend' => '',
    'append' => '',
)

Textarea Field:

array(
    'key' => 'field_description',
    'label' => 'Description',
    'name' => 'description',
    'type' => 'textarea',
    'rows' => 4,
    'new_lines' => 'wpautop', // wpautop, br, ''
)

Number Field:

array(
    'key' => 'field_quantity',
    'label' => 'Quantity',
    'name' => 'quantity',
    'type' => 'number',
    'min' => 0,
    'max' => 100,
    'step' => 1,
    'default_value' => 1,
)

Email Field:

array(
    'key' => 'field_contact_email',
    'label' => 'Contact Email',
    'name' => 'contact_email',
    'type' => 'email',
    'required' => 1,
)

URL Field:

array(
    'key' => 'field_website',
    'label' => 'Website URL',
    'name' => 'website',
    'type' => 'url',
    'placeholder' => 'https://',
)

Select Field:

array(
    'key' => 'field_category',
    'label' => 'Category',
    'name' => 'category',
    'type' => 'select',
    'choices' => array(
        'technology' => 'Technology',
        'design' => 'Design',
        'marketing' => 'Marketing',
    ),
    'default_value' => 'technology',
    'allow_null' => 0,
    'multiple' => 0,
    'ui' => 1, // Enhanced UI
    'return_format' => 'value', // value, label, array
)

Checkbox Field:

array(
    'key' => 'field_features',
    'label' => 'Features',
    'name' => 'features',
    'type' => 'checkbox',
    'choices' => array(
        'ssl' => 'SSL Certificate',
        'backup' => 'Daily Backups',
        'support' => '24/7 Support',
    ),
    'default_value' => array(),
    'layout' => 'vertical', // vertical, horizontal
    'toggle' => 0,
    'return_format' => 'value', // value, label, array
)

Radio Button Field:

array(
    'key' => 'field_status',
    'label' => 'Status',
    'name' => 'status',
    'type' => 'radio',
    'choices' => array(
        'active' => 'Active',
        'inactive' => 'Inactive',
        'pending' => 'Pending',
    ),
    'default_value' => 'active',
    'layout' => 'horizontal',
)

True/False Field:

array(
    'key' => 'field_featured',
    'label' => 'Featured',
    'name' => 'is_featured',
    'type' => 'true_false',
    'default_value' => 0,
    'ui' => 1, // Toggle UI
    'ui_on_text' => 'Yes',
    'ui_off_text' => 'No',
)

Image Field:

array(
    'key' => 'field_featured_image',
    'label' => 'Featured Image',
    'name' => 'featured_image',
    'type' => 'image',
    'return_format' => 'array', // array, url, id
    'preview_size' => 'medium',
    'library' => 'all', // all, uploadedTo
    'min_width' => 800,
    'min_height' => 600,
    'max_size' => 2, // MB
)

File Field:

array(
    'key' => 'field_download',
    'label' => 'Downloadable File',
    'name' => 'download_file',
    'type' => 'file',
    'return_format' => 'array',
    'library' => 'all',
    'mime_types' => 'pdf,doc,docx',
)

Wysiwyg Editor:

array(
    'key' => 'field_content',
    'label' => 'Content',
    'name' => 'custom_content',
    'type' => 'wysiwyg',
    'tabs' => 'all', // all, visual, text
    'toolbar' => 'full', // full, basic
    'media_upload' => 1,
    'delay' => 0,
)

Date and Time Fields

Date Picker:

array(
    'key' => 'field_event_date',
    'label' => 'Event Date',
    'name' => 'event_date',
    'type' => 'date_picker',
    'display_format' => 'd/m/Y',
    'return_format' => 'Y-m-d',
    'first_day' => 1, // 0 = Sunday, 1 = Monday
)

Date Time Picker:

array(
    'key' => 'field_publish_datetime',
    'label' => 'Publish Date & Time',
    'name' => 'publish_datetime',
    'type' => 'date_time_picker',
    'display_format' => 'd/m/Y g:i a',
    'return_format' => 'Y-m-d H:i:s',
    'first_day' => 1,
)

Time Picker:

array(
    'key' => 'field_opening_time',
    'label' => 'Opening Time',
    'name' => 'opening_time',
    'type' => 'time_picker',
    'display_format' => 'g:i a',
    'return_format' => 'H:i:s',
)

Relationship and Post Object Fields

Post Object Field:

array(
    'key' => 'field_related_post',
    'label' => 'Related Post',
    'name' => 'related_post',
    'type' => 'post_object',
    'post_type' => array('post', 'page'),
    'taxonomy' => array(),
    'allow_null' => 0,
    'multiple' => 0,
    'return_format' => 'object', // object, id
    'ui' => 1,
)

Relationship Field:

array(
    'key' => 'field_related_projects',
    'label' => 'Related Projects',
    'name' => 'related_projects',
    'type' => 'relationship',
    'post_type' => array('portfolio'),
    'taxonomy' => array(),
    'filters' => array('search', 'post_type', 'taxonomy'),
    'min' => 0,
    'max' => 5,
    'return_format' => 'object',
)

Repeater Field (ACF PRO)

Repeater Configuration:

array(
    'key' => 'field_team_members',
    'label' => 'Team Members',
    'name' => 'team_members',
    'type' => 'repeater',
    'layout' => 'block', // table, block, row
    'button_label' => 'Add Team Member',
    'min' => 0,
    'max' => 10,
    'sub_fields' => array(
        array(
            'key' => 'field_member_name',
            'label' => 'Name',
            'name' => 'name',
            'type' => 'text',
        ),
        array(
            'key' => 'field_member_position',
            'label' => 'Position',
            'name' => 'position',
            'type' => 'text',
        ),
        array(
            'key' => 'field_member_photo',
            'label' => 'Photo',
            'name' => 'photo',
            'type' => 'image',
            'return_format' => 'array',
        ),
    ),
)

Flexible Content Field (ACF PRO)

Flexible Content Configuration:

array(
    'key' => 'field_page_content',
    'label' => 'Page Content',
    'name' => 'page_content',
    'type' => 'flexible_content',
    'button_label' => 'Add Content Block',
    'min' => 0,
    'max' => 20,
    'layouts' => array(
        'text_block' => array(
            'key' => 'layout_text',
            'name' => 'text_block',
            'label' => 'Text Block',
            'display' => 'block',
            'sub_fields' => array(
                array(
                    'key' => 'field_heading',
                    'label' => 'Heading',
                    'name' => 'heading',
                    'type' => 'text',
                ),
                array(
                    'key' => 'field_content',
                    'label' => 'Content',
                    'name' => 'content',
                    'type' => 'wysiwyg',
                ),
            ),
        ),
        'image_block' => array(
            'key' => 'layout_image',
            'name' => 'image_block',
            'label' => 'Image Block',
            'display' => 'block',
            'sub_fields' => array(
                array(
                    'key' => 'field_image',
                    'label' => 'Image',
                    'name' => 'image',
                    'type' => 'image',
                    'return_format' => 'array',
                ),
            ),
        ),
    ),
)

Gallery Field (ACF PRO)

Gallery Configuration:

array(
    'key' => 'field_project_gallery',
    'label' => 'Project Gallery',
    'name' => 'project_gallery',
    'type' => 'gallery',
    'return_format' => 'array',
    'library' => 'all',
    'min' => 1,
    'max' => 50,
    'insert' => 'append', // append, prepend
    'preview_size' => 'medium',
)

Group Field

Group Configuration:

array(
    'key' => 'field_contact_info',
    'label' => 'Contact Information',
    'name' => 'contact_info',
    'type' => 'group',
    'layout' => 'block', // block, table, row
    'sub_fields' => array(
        array(
            'key' => 'field_email',
            'label' => 'Email',
            'name' => 'email',
            'type' => 'email',
        ),
        array(
            'key' => 'field_phone',
            'label' => 'Phone',
            'name' => 'phone',
            'type' => 'text',
        ),
    ),
)

Location Rules

Single Location Rule:

'location' => array(
    array(
        array(
            'param' => 'post_type',
            'operator' => '==',
            'value' => 'product',
        ),
    ),
)

Multiple Location Rules (OR):

'location' => array(
    // Show on Products OR Pages
    array(
        array(
            'param' => 'post_type',
            'operator' => '==',
            'value' => 'product',
        ),
    ),
    array(
        array(
            'param' => 'post_type',
            'operator' => '==',
            'value' => 'page',
        ),
    ),
)

Multiple Conditions (AND):

'location' => array(
    array(
        // Show on Pages AND page template is "Full Width"
        array(
            'param' => 'post_type',
            'operator' => '==',
            'value' => 'page',
        ),
        array(
            'param' => 'page_template',
            'operator' => '==',
            'value' => 'template-full-width.php',
        ),
    ),
)

Common Location Parameters:

// Post Type
'param' => 'post_type'
'param' => 'post'
'param' => 'page'

// Page Template
'param' => 'page_template'

// Taxonomy
'param' => 'post_taxonomy'
'param' => 'post_category'

// User Role
'param' => 'current_user_role'

// Options Page
'param' => 'options_page'

Conditional Logic

Show Field Based on Another Field:

array(
    'key' => 'field_enable_feature',
    'label' => 'Enable Feature',
    'name' => 'enable_feature',
    'type' => 'true_false',
),
array(
    'key' => 'field_feature_settings',
    'label' => 'Feature Settings',
    'name' => 'feature_settings',
    'type' => 'text',
    'conditional_logic' => array(
        array(
            array(
                'field' => 'field_enable_feature',
                'operator' => '==',
                'value' => '1',
            ),
        ),
    ),
)

Multiple Conditions (AND):

'conditional_logic' => array(
    array(
        array(
            'field' => 'field_type',
            'operator' => '==',
            'value' => 'premium',
        ),
        array(
            'field' => 'field_active',
            'operator' => '==',
            'value' => '1',
        ),
    ),
)

Multiple Conditions (OR):

'conditional_logic' => array(
    array(
        array(
            'field' => 'field_color',
            'operator' => '==',
            'value' => 'red',
        ),
    ),
    array(
        array(
            'field' => 'field_color',
            'operator' => '==',
            'value' => 'blue',
        ),
    ),
)

Dynamic Field Registration

Generate Fields from Array:

function mytheme_generate_dynamic_fields() {
    $social_networks = array('facebook', 'twitter', 'instagram', 'linkedin');
    $fields = array();

    foreach ($social_networks as $network) {
        $fields[] = array(
            'key' => 'field_' . $network,
            'label' => ucfirst($network) . ' URL',
            'name' => $network . '_url',
            'type' => 'url',
        );
    }

    acf_add_local_field_group(array(
        'key' => 'group_social_links',
        'title' => 'Social Links',
        'fields' => $fields,
        'location' => array(
            array(
                array(
                    'param' => 'options_page',
                    'operator' => '==',
                    'value' => 'acf-options',
                ),
            ),
        ),
    ));
}
add_action('acf/init', 'mytheme_generate_dynamic_fields');

Best Practices

Unique Keys:

// Good - unique, descriptive keys
'key' => 'field_product_price'
'key' => 'group_product_details'

// Bad - generic, duplicate-prone keys
'key' => 'field_1'
'key' => 'group_1'

Organize in Separate Files:

theme/
├── inc/
│   └── acf/
│       ├── field-groups.php
│       ├── product-fields.php
│       ├── page-fields.php
│       └── options-fields.php

Include in functions.php:

require_once get_template_directory() . '/inc/acf/field-groups.php';

Use Constants for Keys:

define('MYTHEME_PRODUCT_GROUP', 'group_product_details');
define('MYTHEME_PRICE_FIELD', 'field_product_price');

acf_add_local_field_group(array(
    'key' => MYTHEME_PRODUCT_GROUP,
    'fields' => array(
        array(
            'key' => MYTHEME_PRICE_FIELD,
            // ...
        ),
    ),
));

Conclusion

Programmatic ACF field registration with acf_add_local_field_group() enables version-controlled field configurations eliminating manual UI setup and database dependencies. Register field groups with unique keys and comprehensive field arrays, implement location rules for targeted display, add conditional logic for dynamic field visibility, and organize field registrations in separate files for maintainability. Programmatic registration ensures consistent ACF deployments across environments while providing code review capabilities and automatic synchronization through version control systems.

External Links

Call to Action

Programmatic field configurations need backup protection. Backup Copilot Pro backs up your WordPress theme files and ACF code automatically. Safeguard your version-controlled fields—start your free 30-day trial today!

The post How to Create ACF Field Groups Programmatically with PHP appeared first on Developry Plugins.

How to Create XML Sitemaps in WordPress for Better Indexing

Krasen Slavov — Mon, 20 Jul 2026 09:00:00 +0000

XML sitemaps help search engines discover and index WordPress content efficiently. These structured files list all important URLs, guiding crawlers to fresh content and indicating update priorities. This comprehensive guide teaches XML sitemap creation, optimization, submission to search engines, and troubleshooting for maximum indexing efficiency.

What Is an XML Sitemap

XML sitemaps are machine-readable files listing website URLs with metadata about content freshness, update frequency, and relative importance. Search engines use sitemaps to discover pages, especially on large sites or sites with poor internal linking.

Basic XML Sitemap Structure:

 version="1.0" encoding="UTF-8"?>
 xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  
    https://example.com/page/
    2025-01-15
    weekly
    0.8

Why XML Sitemaps Matter for SEO

Faster Indexing: New content discovered within hours instead of days.

Complete Coverage: Ensures all important pages indexed, especially those with few backlinks.

Crawl Efficiency: Guides search bots to updated content first.

Large Site Management: Critical for sites with 100+ pages.

Content Prioritization: Indicates which pages matter most.

WordPress Default Sitemap (WordPress 5.5+)

WordPress generates basic XML sitemaps automatically since version 5.5.

Access Default Sitemap:

https://yoursite.com/wp-sitemap.xml

Sitemap Index Structure:

wp-sitemap-posts-post-1.xml (blog posts)
wp-sitemap-posts-page-1.xml (pages)
wp-sitemap-taxonomies-category-1.xml (categories)
wp-sitemap-taxonomies-post_tag-1.xml (tags)
wp-sitemap-users-1.xml (author archives)

Limitations:

Basic functionality only
No priority or change frequency
Limited customization options
No advanced features

Creating Advanced Sitemaps with Yoast SEO

Yoast SEO provides more comprehensive sitemap functionality.

Enabling Yoast Sitemap:

Install Yoast SEO plugin
Navigate to SEO → General → Features
Enable XML sitemaps
Access sitemap at: yoursite.com/sitemap_index.xml

Yoast Sitemap Features:

Automatic updates
Excluded content types
Custom post type inclusion
Taxonomy sitemaps
Image sitemaps
News sitemaps (premium)

Configuring Yoast Sitemap:

Go to SEO → Search Appearance
Select content type (Posts, Pages, etc.)
Toggle “Show in search results”
Set noindex for unwanted content

Creating Sitemaps with Rank Math

Rank Math offers similar advanced sitemap features.

Enabling Rank Math Sitemap:

Install Rank Math plugin
Navigate to Rank Math → Sitemap Settings
Enable sitemaps
Access at: yoursite.com/sitemap_index.xml

Rank Math Features:

Automatic generation
Exclude specific URLs
Ping search engines on update
Author/date archive inclusion
Custom sitemap links

Manual XML Sitemap Creation

For custom requirements, generate sitemaps programmatically.

Simple Sitemap Function:

function dprt_generate_sitemap() {
    $posts = get_posts(array(
        'post_type' => 'post',
        'post_status' => 'publish',
        'numberposts' => -1,
        'orderby' => 'modified',
    ));

    $sitemap = '';
    $sitemap .= '';

    foreach ($posts as $post) {
        $sitemap .= '';
        $sitemap .= '' . get_permalink($post->ID) . '';
        $sitemap .= '' . get_the_modified_date('c', $post->ID) . '';
        $sitemap .= 'weekly';
        $sitemap .= '0.8';
        $sitemap .= '';
    }

    $sitemap .= '';

    file_put_contents(ABSPATH . 'sitemap.xml', $sitemap);
}

// Generate sitemap when post published/updated
add_action('save_post', 'dprt_generate_sitemap');

Sitemap Best Practices

1. Include Only Indexable URLs

Exclude:

Duplicate content
Noindexed pages
Login/admin pages
Thank you pages
Cart/checkout pages

2. Keep Under 50,000 URLs

Split large sitemaps into multiple files.

Sitemap Index Example:

 version="1.0" encoding="UTF-8"?>
 xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  
    https://example.com/sitemap-posts.xml
    2025-01-15
  
  
    https://example.com/sitemap-pages.xml
    2025-01-10

3. Keep File Size Under 50MB

Compress large sitemaps with gzip.

4. Update Regularly

Regenerate when content published or updated.

5. Use Accurate lastmod Dates

Helps search engines prioritize crawling fresh content.

Submitting Sitemap to Google

Google Search Console:

Log into search.google.com/search-console
Select property
Navigate to Sitemaps (left menu)
Enter sitemap URL: sitemap_index.xml
Click Submit

Verify Submission: Check “Discovered” and “Submitted” URL counts match expectations.

Automatic Ping (optional):

function dprt_ping_google($post_id) {
    if (get_post_status($post_id) == 'publish') {
        $sitemap_url = urlencode(home_url('/sitemap_index.xml'));
        wp_remote_get('http://www.google.com/ping?sitemap=' . $sitemap_url);
    }
}
add_action('publish_post', 'dprt_ping_google');

Submitting to Other Search Engines

Bing Webmaster Tools:

Visit bing.com/webmasters
Add site
Navigate to Sitemaps
Submit sitemap URL

Yandex Webmaster:

Visit webmaster.yandex.com
Add site
Go to Indexing → Sitemap files
Add sitemap URL

Image Sitemaps

Help Google discover and index images.

Image Sitemap Structure:


  https://example.com/post-with-images/
  
    https://example.com/image.jpg
    Image caption here
    Image title

Yoast SEO automatically includes images in sitemaps.

Video Sitemaps

Enhance video content discovery.

Video Sitemap Example:


  https://example.com/video-post/
  
    https://example.com/thumb.jpg
    Video Title
    Video description
    https://example.com/video.mp4
    600

Excluding URLs from Sitemap

Yoast SEO – Individual Posts:

Edit post/page
Scroll to Yoast meta box
Advanced tab
Set “Allow search engines to show this Post in search results?” to No

Yoast SEO – Entire Post Types: SEO → Search Appearance → Content Types → Toggle off

Rank Math – Individual Posts: Rank Math meta box → Advanced → Robots Meta → Select noindex

Manual Exclusion:

add_filter('wpseo_sitemap_exclude_post_type', function($excluded, $post_type) {
    if ($post_type === 'custom_post_type') {
        return true;
    }
    return $excluded;
}, 10, 2);

WooCommerce Sitemaps

E-commerce sites require careful sitemap configuration.

Include:

Product pages (in stock)
Product categories
Main shop page

Exclude:

Out of stock products
Cart/checkout pages
My account pages
Order confirmation pages

Yoast WooCommerce SEO (addon): Automatically optimizes WooCommerce sitemaps.

Multilingual Sitemaps

For multilingual sites (WPML, Polylang, etc.).

Hreflang in Sitemaps:


  https://example.com/page/
   rel="alternate" hreflang="en" href="https://example.com/page/" />
   rel="alternate" hreflang="es" href="https://example.es/pagina/" />
   rel="alternate" hreflang="fr" href="https://example.fr/page/" />

WPML and Polylang automatically generate language-specific sitemaps.

Troubleshooting Sitemap Issues

Sitemap Not Found (404):

Flush permalinks: Settings → Permalinks → Save
Check plugin conflicts
Verify .htaccess rules

Duplicate Sitemaps: Disable WordPress core sitemap if using plugin:

add_filter('wp_sitemaps_enabled', '__return_false');

Sitemap Not Updating:

Clear caching plugins
Regenerate sitemap manually
Check file permissions

Crawl Errors in Search Console:

Review excluded URLs
Fix broken internal links
Remove deleted pages from sitemap

Monitoring Sitemap Performance

Google Search Console Insights:

Navigate to Sitemaps report
Check submitted vs. indexed URLs
Investigate discrepancies
Monitor error reports

Expected Indexing:

Small sites (under 100 pages): 80-100% indexed
Medium sites (100-1,000): 70-90% indexed
Large sites (1,000+): 60-80% indexed

Advanced Sitemap Optimizations

Priority Values:

Homepage: 1.0
Main category pages: 0.8
Blog posts: 0.6
Tag archives: 0.4

Change Frequency:

News sites: daily
Blogs: weekly
Static pages: monthly
Archived content: yearly

Custom Sitemap Routes:

add_action('init', function() {
    add_rewrite_rule(
        'custom-sitemap\.xml$',
        'index.php?custom_sitemap=1',
        'top'
    );
});

add_filter('query_vars', function($vars) {
    $vars[] = 'custom_sitemap';
    return $vars;
});

add_action('template_redirect', function() {
    if (get_query_var('custom_sitemap')) {
        header('Content-Type: application/xml');
        // Generate custom sitemap
        exit;
    }
});

Sitemap Caching

Cache sitemaps for performance.

Cache Sitemap Output:

function dprt_cached_sitemap() {
    $cached = get_transient('dprt_sitemap_cache');
    if ($cached) {
        return $cached;
    }

    // Generate sitemap
    $sitemap = dprt_generate_sitemap();

    set_transient('dprt_sitemap_cache', $sitemap, 12 * HOUR_IN_SECONDS);
    return $sitemap;
}

Conclusion

WordPress XML sitemaps improve search engine indexing through structured URL lists, metadata about content freshness, and efficient crawl guidance. Use Yoast SEO or Rank Math for comprehensive sitemap management, submit to Google Search Console and Bing Webmaster Tools, exclude non-indexable content, and monitor performance regularly. Proper sitemap implementation ensures all valuable content gets discovered and indexed efficiently.

External Links

Call to Action

SEO configurations need protection. Backup Copilot Pro safeguards your WordPress sitemap settings and SEO data. Protect your indexing optimizations—start your free 30-day trial today!

The post How to Create XML Sitemaps in WordPress for Better Indexing appeared first on Developry Plugins.

How to Customize WordPress Login Page Without Plugins

Krasen Slavov — Wed, 15 Jul 2026 09:00:00 +0000

WordPress login page customization transforms generic wp-login.php into branded experiences matching site identity. From logo replacement and color schemes to complete CSS overhauls and background images, login customization establishes professional first impressions without plugin overhead. This comprehensive guide teaches login page branding, styling, functionality modifications, and security enhancements through code-based approaches.

Professional Branding: First touchpoint for admins and contributors.

Client Impressions: Agencies benefit from white-label experiences.

Security Through Obscurity: Custom appearance discourages automated attacks.

User Experience: Familiar branding increases user confidence.

Performance: Code-based approach faster than plugins.

Custom Logo

Replace WordPress Logo:

function dprt_custom_login_logo() {
    ?>
    
    <?php
}
add_action('login_enqueue_scripts', 'dprt_custom_login_logo');

Logo Specifications:

Recommended size: 320×80 pixels
Formats: PNG (transparency), SVG (scalable)
Path: theme/images/login-logo.png

Logo URL and Title

By default, logo links to wordpress.org. Change to your site:

function dprt_login_logo_url() {
    return home_url();
}
add_filter('login_headerurl', 'dprt_login_logo_url');

function dprt_login_logo_url_title() {
    return get_bloginfo('name');
}
add_filter('login_headertext', 'dprt_login_logo_url_title');

Now logo links to site homepage with site name as title attribute.

Complete Login Page Styling:

function dprt_custom_login_styles() {
    ?>
    
    <?php
}
add_action('login_enqueue_scripts', 'dprt_custom_login_styles');

Background Image

Full-Screen Background:

function dprt_login_background() {
    ?>
    
    <?php
}
add_action('login_enqueue_scripts', 'dprt_login_background');

Background Image Requirements:

High resolution (1920×1080 minimum)
Optimized file size (under 500KB)
Appropriate licensing

Replace Generic Error Messages:

function dprt_custom_login_errors() {
    return 'Invalid username or password. Please try again.';
}
add_filter('login_errors', 'dprt_custom_login_errors');

Security benefit: Generic message doesn’t reveal whether username or password incorrect.

Custom Welcome Message:

function dprt_custom_login_message() {
    return 'Welcome! Please log in to access your dashboard.
';
}
add_filter('login_message', 'dprt_custom_login_message');

Enqueue Custom Stylesheet

Separate CSS File Approach:

function dprt_enqueue_login_stylesheet() {
    wp_enqueue_style('custom-login', get_stylesheet_directory_uri() . '/css/login.css');
}
add_action('login_enqueue_scripts', 'dprt_enqueue_login_stylesheet');

login.css (in theme/css/login.css):

body.login {
    background: #f1f1f1;
}

#login h1 a,
.login h1 a {
    background-image: url(../images/login-logo.png);
    height: 80px;
    width: 320px;
    background-size: contain;
    background-repeat: no-repeat;
    padding-bottom: 30px;
}

.login form {
    border: 1px solid #ddd;
    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
}

/* Additional styles... */

Benefits: Better organization, easier maintenance, browser caching.

Remove “Remember Me” Checkbox

function dprt_remove_rememberme() {
    ?>
    
    <?php
}
add_action('login_head', 'dprt_remove_rememberme');

Security consideration for shared computers.

Add Custom Text Below Form:

function dprt_custom_login_footer() {
    echo '
        Need help? Contact Support
    
';
}
add_action('login_footer', 'dprt_custom_login_footer');

Hide “Lost Your Password” Link

function dprt_remove_lostpassword() {
    ?>
    
    <?php
}
add_action('login_head', 'dprt_remove_lostpassword');

Useful for restricted client sites or when using custom password reset.

Redirect by User Role:

function dprt_login_redirect($redirect_to, $request, $user) {
    // Check user object exists
    if (isset($user->roles) && is_array($user->roles)) {
        // Administrators go to dashboard
        if (in_array('administrator', $user->roles)) {
            return admin_url();
        }
        // Editors go to posts
        elseif (in_array('editor', $user->roles)) {
            return admin_url('edit.php');
        }
        // Authors/contributors go to profile
        else {
            return admin_url('profile.php');
        }
    }
    return $redirect_to;
}
add_filter('login_redirect', 'dprt_login_redirect', 10, 3);

Add Custom JavaScript

Client-Side Functionality:

function dprt_custom_login_js() {
    ?>
    
    <?php
}
add_action('login_footer', 'dprt_custom_login_js');

All-in-One Implementation:

// Custom logo
function dprt_custom_login_logo() {
    ?>
    
    <?php
}
add_action('login_enqueue_scripts', 'dprt_custom_login_logo');

// Logo URL
add_filter('login_headerurl', function() { return home_url(); });
add_filter('login_headertext', function() { return get_bloginfo('name'); });

// Custom styles
function dprt_custom_login_styles() {
    wp_enqueue_style('custom-login', get_stylesheet_directory_uri() . '/css/login.css');
}
add_action('login_enqueue_scripts', 'dprt_custom_login_styles');

// Custom error message
add_filter('login_errors', function() {
    return 'Login failed. Please check your credentials and try again.';
});

// Login redirect
function dprt_login_redirect($redirect_to, $request, $user) {
    return (is_array($user->roles) && in_array('administrator', $user->roles)) ? admin_url() : home_url();
}
add_filter('login_redirect', 'dprt_login_redirect', 10, 3);

Ensure Mobile Compatibility:

@media only screen and (max-width: 768px) {
    #login {
        padding: 20px 0;
    }

    .login form {
        margin-left: 20px;
        margin-right: 20px;
        padding: 20px;
    }

    #login h1 a {
        width: 250px;
        background-size: contain;
    }
}

Language Selector

Multilingual Login Page:

function dprt_login_language_selector() {
    echo '';
    // Custom language switcher HTML
    echo '
';
}
add_action('login_footer', 'dprt_login_language_selector');

Security Enhancements

Limit Login Attempts (without plugin):

function dprt_check_attempted_login($user, $username, $password) {
    $login_attempts = get_transient('attempted_login');

    if ($login_attempts && $login_attempts >= 3) {
        return new WP_Error('too_many_attempts', 'Too many failed login attempts. Please wait 15 minutes.');
    }

    return $user;
}
add_filter('authenticate', 'dprt_check_attempted_login', 30, 3);

function dprt_login_failed() {
    $login_attempts = get_transient('attempted_login');
    $login_attempts = $login_attempts ? $login_attempts + 1 : 1;
    set_transient('attempted_login', $login_attempts, 900); // 15 minutes
}
add_action('wp_login_failed', 'dprt_login_failed');

CAPTCHA Integration (Google reCAPTCHA):

function dprt_add_captcha_to_login() {
    ?>
    class="g-recaptcha" data-sitekey="YOUR_SITE_KEY">
    
    <?php
}
add_action('login_form', 'dprt_add_captcha_to_login');

function dprt_verify_captcha($user, $username, $password) {
    if (!isset($_POST['g-recaptcha-response'])) {
        return new WP_Error('captcha_error', 'Please complete the CAPTCHA.');
    }

    $response = wp_remote_post('https://www.google.com/recaptcha/api/siteverify', array(
        'body' => array(
            'secret' => 'YOUR_SECRET_KEY',
            'response' => $_POST['g-recaptcha-response']
        )
    ));

    $result = json_decode(wp_remote_retrieve_body($response));

    if (!$result->success) {
        return new WP_Error('captcha_failed', 'CAPTCHA verification failed.');
    }

    return $user;
}
add_filter('authenticate', 'dprt_verify_captcha', 30, 3);

Test Across Browsers:

Chrome
Firefox
Safari
Edge

Test Scenarios:

Successful login
Failed login
Password reset
Mobile devices
Different screen sizes

Logout and Test: Always test as logged-out user to see actual login page.

Troubleshooting

Logo Not Appearing:

Check image path
Verify image exists
Inspect browser console for 404 errors

Styles Not Applying:

Clear browser cache
Check CSS syntax
Verify hook priority
Inspect element to see applied styles

Redirect Not Working:

Verify user role checks
Test with different user roles
Check for conflicting plugins

Best Practices

Keep It Simple: Overly complex designs may confuse users.

Maintain Readability: Ensure sufficient contrast and legible fonts.

Test Thoroughly: Verify functionality across devices and browsers.

Backup First: Save working code before modifications.

Use Child Themes: Prevent customization loss during theme updates.

Performance: Optimize images and minimize CSS/JS.

Conclusion

WordPress login page customization creates branded experiences through logo replacement, custom styling, background images, and security enhancements without plugins. Implement CSS modifications via login_enqueue_scripts hook, modify logo URL and title with filters, customize messages and redirects, and add security features like login attempt limiting. Code-based customization provides better performance, complete control, and professional client experiences.

External Links

Call to Action

Login customizations need protection. Backup Copilot Pro safeguards your WordPress custom code and configurations. Protect your login page modifications—start your free 30-day trial today!

The post How to Customize WordPress Login Page Without Plugins appeared first on Developry Plugins.

Developry Plugins

How to Add Custom Block Patterns to WordPress Block Editor

What Are Block Patterns?

Creating Your First Custom Pattern

Welcome to Our Site

Getting Block Markup

Creating Pattern Categories

Advanced Pattern Properties

Testimonial Pattern Example

Pricing Table Pattern

Basic

Pro

Enterprise

Unregistering Core Patterns

Pattern Best Practices

Translatable Patterns

%s

Organizing Patterns in Plugins

Conclusion

External Links

Call to Action

How to Add Custom Post Types to WordPress Without Plugins

Understanding Custom Post Types

Basic Custom Post Type Registration

Complete Parameter Reference

Advanced Custom Post Type Example

Custom Taxonomies for CPT

Template Files for Custom Post Types

class="entry-title"><?php the_title(); ?>

class="page-title">Portfolio

class="entry-title"> ""><?php the_title(); ?>

Querying Custom Post Types

Adding Custom Columns to Admin List

Custom Permalink Structure

Best Practices

Conclusion

External Links

Call to Action

How to Add Custom User Roles and Capabilities in WordPress

Understanding Roles vs Capabilities

Default WordPress Roles

Creating Custom User Roles

Custom Role with Specific Capabilities

Adding Capabilities to Existing Roles

Removing Capabilities

Custom Post Type Capabilities

Removing Custom Roles

Checking User Capabilities

Conditional Content Display

Admin Menu Restrictions

Dashboard Widget Restrictions

Custom Capabilities for Plugins

Role Management Plugins

Advanced: Multiple Roles per User

Security Best Practices

Debugging Roles and Capabilities

Programmatic Role Assignment

WooCommerce Custom Roles

Conclusion

External Links

Call to Action

How to Block Brute Force Attacks on WordPress Login Pages

Understanding Brute Force Attacks

How They Work

Signs of an Attack

Layer 1: Limit Login Attempts

Using Limit Login Attempts Reloaded

Layer 2: Add CAPTCHA Protection

Google reCAPTCHA v3 Integration

Layer 3: Change Login URL

Using WPS Hide Login Plugin

Layer 4: IP Whitelisting

Restrict wp-admin by IP

Layer 5: WordPress Firewall

Wordfence Configuration

Layer 6: Cloudflare Protection

Enable Cloudflare Firewall Rules

Layer 7: Two-Factor Authentication

Layer 8: Disable XML-RPC

Layer 9: Server-Level Protection (Fail2Ban)