An Introduction to WordPress Plugin Development

These are the slides from my WordPress Sydney talk on WordPress plugin development.

We did try to capture the screen but the screencast software screwed up and munched the output file.  Nom nom nom…

The talk was aimed at an introductory look at plugin development to show people how easy it is to get started.

I’ve had a lot of people comment about how scary it must be to develop WordPress plugins.

It’s not really and you can get started today.  Enjoy.



I encourage you to download the plugin file, install and play around with them.

Shortcode Basic:

My Branding:

Slide Outlines

  1. Adds extra functionality to your website
    Keeps functionality away from your theme
    – You could add code to your theme’s functions.php
    – You lose that functionality if you change theme
    Avoids hacking the core
    It could earn you money
    It’s fun!
  2. We’ll look at creating some shortcodes Basic shortcodes Shortcodes with attributes (inputs)
    Then we’ll look at building a “branding” plugin
    – Replace login logo & links
    – Remove & filter Dashboard items
  3. There are two types of plugins.
    These are the normal plugins you will find in the plugin repo at
    You can install, activate, deactivate, update and delete from Dashboard
    Must Use
    Have to be installed manually (ftp/unzip).
    Can’t uninstall, update or delete from Dashboard
    Useful for supplying critical functionality (user tamper proof)
  4. Single PHP file in mu-plugins folder – i.e. they don’t have their own plugin folder within mu- plugins
    MU-Plugins activate before regular plugins
    They are always on
    They don’t call activation hooks
    – Some regular plugins setup data on activation and remove data on removal/deactivation
  5. Name
    Give your plugin a unique and relevant name e.g. “Call to Action Shortcode Buttons”
    Not: CTASB1 Whaaat?
  6. Location
    Plugins sit in /wp-content/plugins (default)
    MU-Plugins sit in /wp-content/mu-plugins (default)
    Note Default locations can be overridden by wp-config.php defines. Don’t assume or hardcode these paths into your plugin
  7. Folder & Filename
    Choose a unique folder name (usually same as bootstrap file) e.g. /call-to-action-shortcodes-button/
    Plugins must have a bootstrap (startup) PHP file in it’s folder.
    Follow same naming convention as the folder e.g. call-to-action-shortcodes-button.php
  8. Other Files (if uploading to
    Read Me File
    Contains all info used to populate plugin page
  9. Other Files (if uploading to
    Screen Shots
    Usually screenshot-1.png, screenshot-2.png
    Linked to from readme.txt file
  10. Example File & Folder
  11. Needs a header
    <?php /**
    * Plugin Name: Name Of The Plugin
    * Plugin URI: http://URI_Of_Plugin_Page
    * Description: A brief description of the Plugin.
    * Version: The Plugin’s Version Number, e.g.: 1.0
    * Author: Name Of The Plugin Author
    * Author URI: http://URI_Of_The_Plugin_Author
    * License: A “Slug” license name e.g. GPL2
  12. Three uses for shortcodes
    1. On its own e.g. [company_address]
    2. With attributes e.g. [ button text=“Buy Now” ]
    3. Surrounding content e.g. [make_red]Blah blah blah[/make_red]
  13. DEMO
    Unfortunately the screencast failed
    Zip of Plugin at
  14. Always stop people from accessing your PHP plugin files directly.
  15. No arguments.
    Just outputs from a variable.
    Prefix your functions with a unique prefix “lc_” for us stands for Lime Canvas
    First argument to add_shortcode is the shortcode name, second is the function name
  16. Shortcode that accepts arguments or use default args.
  17. Shortcode applied to content. i.e. [make_red]This is red text[/make_red]
    Lines 81 & 96 use do_shortcode() making them recursive in nature.
  18. Wrap this shortcode around some content and it will only be shown if users are logged in.
  19. Obfuscate email and “hide” it from web bots looking for emails to spam.
    Uses WordPress’ antispambot() function. The HTML output
  20. This shortcode only shows content within 24 hours of the post date, thereafter outputting an expired message.
  21. Remember Never ‘echo’ output in a shortcode.
    ‘Return’ the output from your function Shortcodes are not recursive by default
  22. Brand Your Clients Dashboard
    Custom login logo
    Remove “helpful” login errors
    New Dashboard footer
    Remove Dashboard widgets – Primary, Quick Draft
    Remove WordPress “node” from Admin Bar
  23. DEMO
    Unfortunately the screencast failed
    Zip of Plugin at
  24. Sets up some global variables
    plugin_slug = “my-branding”
    plugin_url = http://wpsyd-local/wp-content/plugins/my-branding
    Having global variables makes it easier and safer to reference in later functions.
  25. You can and should hook into plugin activation and deactivations.
    This activation stores the plugin version number in the DB options table using the plugin slug as the option name.
    Nothing on deactivation yet.
  26. Clean up your mess when uninstalling plugin.
    You should give users the choice if keeping or deleting the data (as an settings option).
    This plugin deletes the DB option we set on activation.
    Nice and clean now.
  27. The “plugins_loaded” action is one of the earliest hooks you can use.
    Plugins loaded but not pluggable function. WordPress hasn’t executed anything yet.
    Some WordPress features not available here though. We don’t use it here.
  28. The “init” action is a popular hook to use for applying your plugin functions.
    Most of WordPress has now fully loaded and you have access to functions for post types and the database.
    We use this hook to apply most of our branding functions
  29. Here we run functions to:
    – Replace default login logo with our own logo
    – Replace the login logo header title and URL with our own
    – Replace the login error text (it’s a bit too helpful for hackers)
  30. We use “admin_menu” hook to apply our functions which apply changes to the admin Dashboard.
    We don’t want to use init because we only want our functions to be run in the Dashboard, not on the front-end.
    We could have also used the “admin_init” hook.
  31. Here we run functions to:
    – Replace the Dashboard footer text
    – Remove some Dashboard meta boxes such as Quick Draft and WordPress News
    – Remove the WordPress menu “node” from the Admin Bar
  32. Here’s the structure and files for our two test plugins.
    Very basic but good learning guides for unleashing your plugin potential.
  33. We don’t need to give hackers any additional help!
    WordPress logo links to and has the title “Powered by WordPress”
  34. Login error is now general.
    Our logo replaces WordPress logo. Links to our website. Title reads “<site-title> – Powered by Lime Canvas”
  35. Hopefully you can see that plugin development isn’t as scary as you may have thought it to be.
    Learn PHP Learn
    WordPress API
    Make Amazeballs plugins
  36. [1]