wordpress-pro

Use @wordpress/create-block to scaffold the project, define metadata in block.json with apiVersion 3, then implement edit.js and save.js components. Register the block in PHP with register_block_type on the init hook.

Add wp_nonce_field to the form and verify submissions with wp_verify_nonce before processing. Combine this with capability checks using current_user_can and sanitize all input with functions like sanitize_text_field.

Static blocks save fixed HTML via save.js, while dynamic blocks render on the server through a render.php callback. Dynamic blocks suit content that changes, like recent posts lists, and use ServerSideRender for editor previews.

Yes, all custom queries through $wpdb must use $wpdb->prepare with placeholders like %d and %s to prevent SQL injection. Never interpolate user input directly into SQL strings or hardcode table names without $wpdb->prefix.

Common causes include N+1 queries, missing object caching, and unoptimized assets. Use transients for expensive queries, enable Redis or Memcached object caching, defer non-critical scripts, and set no_found_rows on WP_Query when pagination is unneeded.