Tutorial

How roles and capabilities work, checking current_user_can, and adding custom capabilities.

Find tickets, set up the core development environment, write patches and get them reviewed.

Sanitise input, validate it, and escape output with the right function for each context.

Environments, database search and replace, media, configuration per environment and rollbacks.

What nonces are and are not, adding them to forms, AJAX and REST requests, and verifying them.

Create a plugin with a header, hook into WordPress and activate it.

Run custom queries with $wpdb->prepare, table prefixes, and when to avoid raw SQL.

Organise files, prefix everything, guard direct access and keep the main file small.

Store settings with the Options API, cache expensive results with transients, and watch autoloaded data.

Run setup on activation, clean up on deactivation, and remove data on uninstall when users ask for it.

Manage sites, content, plugins and the database from the command line, and write custom commands.

Add admin menus and submenus with the right capabilities, and render admin pages.

Make code translatable with __ and friends, text domains, JavaScript translations and translation files.

Register settings, sections and fields with sanitisation, so options save securely.

The object cache API, persistent backends such as Redis, cache groups and invalidation.

How full-page caches and CDNs serve WordPress, what breaks caching, and purging on updates.

Find slow queries and hooks with Query Monitor, trim autoloaded options, and fix common bottlenecks.

Updates, least-privilege users, file permissions, security headers and what security plugins can and cannot do.

When to use Multisite, network setup, switching sites in code and network-wide plugins.

How WP-Cron runs, scheduling events, using a real cron, and handling long jobs. Canonical lesson.