Tracing a filter through three plugins and living to tell the story.

What to check next

We started by reading the code rather than the documentation, because the code is what runs. Most of the surprises in a WordPress project live in the gap between what a function promises and what the theme actually asks of it. An hour with the templates open told us more than a week of status meetings ever had, and it gave us a list of real questions to bring to the client.

The first measurement is always the most useful one, even when it is rough. Write down the query count, the page weight and the time to first byte before you change anything. Without those numbers you cannot tell an improvement from a coincidence, and three weeks later nobody will remember what the site felt like before you touched it.

If you cannot explain why it is fast, it is only fast today.

Priya Raman

The short version

Caching hides problems as often as it solves them. A page that is fast only when the cache is warm is a page that falls over on the morning after a release, which is exactly when people are looking at it. Test the cold path on purpose. Clear everything, load the home page once, and read what the database had to do.

Nothing here needed a new plugin. The fix was a small change to a query and a better idea of when to run it. That is usually the case: the expensive part of a site is rarely the code you can see, and adding a layer on top only moves the cost somewhere harder to find. Delete first, then decide what is still missing.

What we found first

Escaping belongs at the point of output, where a reviewer can see it. When a value has been cleaned three functions earlier, nobody can tell by reading the template whether it is safe, and the next person to touch that line will not know either. We moved every escape next to its echo and the file got shorter and easier to trust.