WordPress Core APIs

1. Administration Menus

add_menu_page( $page_title, $menu_title, $capability, $menu_slug, $callback, $icon_url, $position )
add_submenu_page( $parent_slug, $page_title, $menu_title, $capability, $menu_slug, $callback )

• Hook: admin_menu
• Use load-{$hook_suffix} to process form submissions before output.
• remove_menu_page( $slug ) / remove_submenu_page( $parent, $slug ) to hide entries.

2. Shortcodes

add_shortcode( $tag, $callback )
// Callback signature: ( $atts, $content = null, $tag = '' ): string
shortcode_atts( $defaults, $atts, $tag )
do_shortcode( $content )  // Process nested shortcodes in enclosing content.

Rules:

• Return, don’t echo — shortcodes must return HTML; echo corrupts layout.
• Prefix names — use a unique prefix to avoid collisions.
• Escape output — all attribute values through esc_attr() / esc_html().
• Pass $tag to shortcode_atts() to enable the shortcode_atts_{$tag} filter.

3. Custom Meta Boxes

add_meta_box( $id, $title, $callback, $screen, $context, $priority )
// Contexts: normal | side | advanced
// Priorities: high | core | default | low
remove_meta_box( $id, $screen, $context )

Save handler checklist (hook: save_post):

1. Verify nonce with wp_verify_nonce()
2. Check DOING_AUTOSAVE
3. Check current_user_can( 'edit_post', $post_id )
4. Sanitize input before update_post_meta()

4. Custom Post Types & Taxonomies

register_post_type( $post_type, $args )
register_taxonomy( $taxonomy, $object_type, $args )

Key CPT args: public, has_archive, show_in_rest (required for Block Editor), supports, rewrite, menu_icon, capability_type.

Key taxonomy args: hierarchical (true = categories, false = tags), show_in_rest, rewrite, show_admin_column.

• Hook on init. Flush rewrite rules on activation only — never on every request.

5. HTTP API

wp_remote_get( $url, $args )
wp_remote_post( $url, $args )
wp_remote_retrieve_response_code( $response )
wp_remote_retrieve_body( $response )
is_wp_error( $response )

• Cache external responses with set_transient() / get_transient().

6. WP-Cron

wp_schedule_event( $timestamp, $recurrence, $hook, $args )
wp_schedule_single_event( $timestamp, $hook, $args )
wp_next_scheduled( $hook, $args )
wp_unschedule_event( $timestamp, $hook, $args )

Custom intervals: filter cron_schedules to add entries like array( 'interval' => 300, 'display' => 'Every 5 Minutes' ).

Rules:

• Always guard with wp_next_scheduled() before scheduling.
• Clean up with wp_unschedule_event() in register_deactivation_hook.
• For production: define( 'DISABLE_WP_CRON', true ) + system crontab running wp cron event run --due-now.

7. Dashboard Widgets

wp_add_dashboard_widget( $widget_id, $widget_name, $callback )
// Hook: wp_dashboard_setup

• For side column: use add_meta_box() with 'dashboard' screen and 'side' context.
• Remove defaults: remove_meta_box( $id, 'dashboard', $context ).

8. Users & Roles

add_role( $role, $display_name, $capabilities )
remove_role( $role )
$role->add_cap( $cap )  // via get_role()
$role->remove_cap( $cap )
current_user_can( $capability )

User Meta:

update_user_meta( $user_id, $key, $value )
get_user_meta( $user_id, $key, $single )
delete_user_meta( $user_id, $key )

WP_User_Query: accepts role, orderby, order, number, meta_query.

• Roles persist in DB — add on activation, remove on uninstall.

9. Privacy API

WordPress 4.9.6+ GDPR/privacy tools. Plugins storing personal data should register exporters and erasers.

Filters:

• wp_privacy_personal_data_exporters — register exporter callback returning array( 'data' => [...], 'done' => bool ).
• wp_privacy_personal_data_erasers — register eraser callback returning array( 'items_removed' => int, 'items_retained' => int, 'messages' => [], 'done' => bool ).

Privacy policy: wp_add_privacy_policy_content( $plugin_name, $policy_text ) on admin_init.

• Use $page parameter and 'done' => false for large datasets.

10. Theme Modification API

set_theme_mod( $name, $value )
get_theme_mod( $name, $default )
remove_theme_mod( $name )
get_theme_mods()

Use theme_mod for visual/display settings. Use option for functional plugin settings.

11. Site Health API

Custom tab: filter site_health_navigation_tabs, action site_health_tab_content.

Custom status test: filter site_status_tests with $tests['direct']['key'] = array( 'label' => ..., 'test' => $callback ).

Test callback returns: label, status (good | recommended | critical), badge (label + color), description, actions, test.

Debug info: filter debug_information to add fields under $info['plugin-slug']['fields'].

12. Global Variables

Inside the Loop

Core Objects

Admin & Version

Server Detection

Best Practices

• Use API functions first — get_queried_object() instead of global $wp_query; $wp_query->get_queried_object().
• Always declare global before use: global $wpdb;
• Never modify $post without wp_reset_postdata() afterward.
• $wpdb is the exception — it has no wrapper and must be used directly for custom queries.

13. Responsive Images

wp_get_attachment_image( $attachment_id, $size )           // Full <img> with srcset/sizes.
wp_get_attachment_image_srcset( $attachment_id, $size )    // Just srcset string.
wp_get_attachment_image_sizes( $attachment_id, $size )     // Just sizes string.
add_image_size( $name, $width, $height, $crop )            // Register custom size.

Filters:

• wp_calculate_image_sizes — override sizes attribute for your layout.
• wp_calculate_image_srcset — modify source list (e.g., remove oversized sources).
• max_srcset_image_width — cap max width in srcset (default 2048px).

WordPress 5.5+ adds loading="lazy" automatically. Pass 'loading' => 'eager' for above-the-fold images.

14. Advanced Hooks

remove_action( $hook, $callback, $priority )
remove_filter( $hook, $callback, $priority )
do_action( $hook, ...$args )       // Fire a custom action.
apply_filters( $hook, $value, ...$args )  // Fire a custom filter.

Rules:

• Removal must happen after the original add_action() and at the same priority.
• Use did_action() > 1 guard to prevent recursive triggers in save_post.
• Prefix all custom hook names. Document with @since/@param. Never change signatures after release.

15. Common Mistakes

Resources

• resources/menus-shortcodes-metaboxes.md — Full code examples for admin menus, shortcodes, and meta boxes
• resources/cpt-http-cron.md — Full code examples for custom post types, HTTP API, and WP-Cron
• resources/widgets-users-privacy.md — Full code examples for dashboard widgets, users/roles, and privacy API
• resources/theme-health-images-hooks.md — Full code examples for theme mods, Site Health, responsive images, and advanced hooks