Engineering Notes

A quiet journal on architecture & craft.

Field notes from real production work — WordPress and WooCommerce architecture, ACF and Gutenberg systems, Shopify Liquid, performance engineering and the frontend decisions that age well.

Featured · Uncategorized

WordPress Data Sanitization and Escaping — A Developer’s Guide

Sanitization and escaping are the two habits that separate WordPress code that’s merely working from code that’s actually safe. They get conflated constantly, skipped under deadline pressure, and bolted on after a security audit instead of being baked in from the first line. Here’s how I think about them in practice. The one rule that […]

Jun 13, 2026 3 min read

Read article

WordPress Actions and Filters — Keeping Hooks Clean

Engineering

May 20, 2026 5 min read

WordPress Actions and Filters — Keeping Hooks Clean

WordPress hooks actions filters are the language the entire platform speaks — but without discipline, they become the thing that makes your codebase unmaintainable. The Language WordPress Speaks WordPress core, every plugin, and every theme communicate through a shared event system. An action fires — wp_head, save_post, wp_enqueue_scripts — and any code that has hooked […]

Read article

Debugging WordPress — How Senior Developers Actually Do It

Engineering

May 20, 2026 5 min read

Debugging WordPress — How Senior Developers Actually Do It

WordPress debugging workflow is what separates a developer who spends three hours on a blank screen from one who finds the problem in fifteen minutes. The Part Nobody Talks About Debugging is the majority of the job. Most documentation, most tutorials, most portfolio pieces celebrate the building part — the elegant architecture, the clean component, […]

Read article

WordPress Security Best Practices — A Developer’s Guide

Engineering

May 20, 2026 5 min read

WordPress Security Best Practices — A Developer’s Guide

WordPress security best practices are what separates a production-ready theme from a liability waiting for a bad actor to find it. The Security Plugin Trap Every WordPress developer I’ve worked with has, at some point, installed a security plugin and assumed the job was done. Wordfence is active, the firewall is green, the dashboard says […]

Read article

WordPress WP_Query Performance — Writing Efficient Database Queries

Engineering

May 17, 2026 8 min read

WordPress WP_Query Performance — Writing Efficient Database Queries

A single poorly constructed WP_Query can add two seconds to every page load. Here are the five patterns that eliminate most WordPress database performance problems.

Read article

WordPress

May 15, 2026 7 min read

WordPress Theme Launch Checklist — My Complete Pre-launch Process

Every custom theme I have launched had the same 8 to 10 issues surface on launch day — not bugs, but the things that are simply absent. This is the checklist I run before every launch, built from real mistakes I will not make again.

Read article

Shopify

May 15, 2026 10 min read

Shopify Metafields Product Content — Cleaner Templates

The Shopify product description field is a textarea with formatting buttons. Treating it as a database for structured product data breaks catalogs, mobile rendering, and editorial workflows. Metafields fix this by giving editors form fields instead of a formatting toolbar.

Read article