A WooCommerce shop inherited custom plugins that broke on every update and dragged the admin down. The fix was not more hotfixes, it was the basics: prefixed functions, core hooks, sanitized input and capability checks.
Custom capabilities get messy fast on big WordPress sites. The Abilities API, in development for 6.9 as part of Core-AI, gives a structured way to define and manage them.
parse_blocks() loads an entire post into memory and can take a server down on large content. WordPress 6.9 adds WP_Block_Processor, a streaming parser that reads block content one pass at a time so you can work with big posts safely.
WordPress 6.9 finally makes HTTPS the default in esc_url() and esc_url_raw() when no scheme is given, as long as ‘https’ comes first in the $protocols array. No more str_replace hacks.
WordPress.org has started running the Plugin Check tool on every plugin update, new and existing. A look at what the automated scans catch and how to run the same checks before you upload.
Gutenberg 22.1 ships a native tabs block and an HTML block that can carry its own CSS and JavaScript. Here is what that means for custom code and how it cuts down on extra plugins.
A client’s custom roles suddenly locked users out after WordPress 6.9 shipped its Abilities API. The fix was to register capabilities and map_meta_cap the way core now expects, not to brute-force add_cap calls.
WordPress 6.9 adds border radius presets to theme.json. Define a set of radius options in your theme, and content editors pick from them instead of typing arbitrary pixel values.
A practical look at the monthly WordPress Core reports: what releases, component activity, and contributor counts actually signal, and how to turn them into decisions for your own projects.
A PHP 8.5 update took down a client’s WooCommerce store. Here is what beta support really means on WordPress 6.9, and how to test the upgrade on staging before it hits your live site.