18 Lesser-Known WordPress Tips & Tricks
Sometimes, when you’ve used WordPress for years, you think you’ve seen it all. But then a small tweak or hidden trick changes your workflow. That tweak might cut minutes every day, or help you avoid a bug that otherwise would haunt you. Those are the marginal gains that add up.
Let’s walk through a mix of tips for speed, admin ease, security, development, and polish — things you might not see in a “WordPress tips” listicle.
This article is a combination of tips/tricks that we ourselves have discovered over the last two decades of using WordPress. Some of these are beginner-friendly, while others are specific to developers and expert users. Nonethless, we think there’s something in here for everyone – enjoy!
Lazy-load your admin CSS / scripts with conditional enqueueing
Sometimes your admin area runs slowly because plugins enqueue assets on all admin pages. You can improve that:
function my_plugin_admin_assets($hook) {
if ($hook !== 'settings_page_myplugin') {
return;
}
wp_enqueue_style('my-plugin-admin-css', plugin_dir_url(__FILE__) . 'admin.css');
}
add_action('admin_enqueue_scripts', 'my_plugin_admin_assets');That ensures scripts/styles only load where needed, reducing overhead on other screens.
Use the Gettext filter to override text strings
Even if a plugin doesn’t provide settings to change a label or string, you can override most text via the gettext or gettext_with_context filter. Example:
add_filter('gettext', 'my_change_thank_you', 20, 3);
function my_change_thank_you($translated, $original, $domain) {
if ($original === 'Thank you for your purchase' && $domain === 'woocommerce') {
return 'Takk for bestillingen!'; // write the new "thank you" string in your language
}
return $translated;
}This is powerful for small tweaks without touching plugin code.
Analyze plugin resource use with Query Monitor + Debug Bar
Plugins aren’t all equal. Query Monitor, Debug Bar, or similar tools can highlight database queries, slow hooks, and memory hogs. If you see a plugin making dozens of queries per page load, consider replacing or optimizing it.
Some plugins look harmless, but their hidden queries or external API calls slow your site. Use monitoring early.
Defer noncritical CSS / JS rather than just minify
Minification is good, but if non-essential CSS or JS loads too early, it blocks rendering. Use wp_enqueue_script(..., array(), false, true) (the true is for loading in footer) or rel="preload" / rel="prefetch" hints. Some modern themes or frameworks support critical CSS extraction so the first bits render fast, and the rest loads asynchronously.
Check browser dev tools to find what’s blocking first paint, and tag those as “defer” or “async.” Most modern caching plugins should be able to help with this, if not the free versions then definitely premium ones. Ask your cache plugin provider about this.
Automate image optimization and format switching (WebP / AVIF)
Instead of just compressing your images by hand, you can use plugins or build tools that automatically convert them into newer, lighter formats like WebP or AVIF. These formats keep your images looking good while making them smaller in file size.
Most modern web hosts and plugins can even check what the visitor’s browser supports and serve the right format automatically.
You can also speed things up by:
- Inlining tiny images (so they load instantly).
- Lazy-loading big images (so they only load when the visitor scrolls to them).
Finally, combine this with responsive image features like srcset and sizes. That way, visitors only download the image size they actually need — not a giant one that slows everything down.
Show “Last Updated” date in posts dynamically
Instead of manually editing post footers every year (or forgetting), use:
if (get_the_modified_time() != get_the_time()) {
echo 'Last updated: ' . get_the_modified_time('F j, Y');
}This helps readers see freshness. We do this in our author boxes also.
Customize dashboard (hide widgets, add your own shortcuts)
Your WordPress dashboard has default widgets (“Welcome”, “WordPress News,” etc.) that might not serve you. Use “Screen Options” to disable ones you don’t use. You can also add your own dashboard widget:
function my_custom_dashboard_widget() {
echo "<p>Quick links: <a href='/wp-admin/edit.php'>All Posts</a> | <a href='/wp-admin/upload.php'>Media</a></p>";
}
function add_my_custom_dashboard() {
wp_add_dashboard_widget('my_custom_widget', 'My Quick Links', 'my_custom_dashboard_widget');
}
add_action('wp_dashboard_setup', 'add_my_custom_dashboard');And this is what it looks like:
It gives your team one click to go where they need.
Use custom post status (beyond “draft” / “private”) for workflow
You can register custom statuses (e.g. needs_review, awaiting_approval) so editorial teams have more granular states:
register_post_status('needs_review', [
'label' => 'Needs Review',
'public' => false,
'show_in_admin_status_list' => true,
'show_in_admin_all_list' => true,
]);That way your editorial team can see posts that are “ready for review,” reducing confusion.
Obfuscate CMS version and plugin info (e.g. via honeypot)
Attackers and bots often scan for known WordPress versions or plugin names. Some plugins, like WP Hide & Security Enhancer, inject deception or obfuscation to confuse scanners. The idea is that your real version or plugin list is hidden or spoofed to hinder automated scanning.
Use headers suppression, remove version meta tags, and even fake plugin names if your security posture demands it.
Use selective auto-updates with rollbacks
WordPress lets you set auto-updates for core, themes, and plugins. But be selective: auto-update only trusted items or minor versions. Combine that with a rollback mechanism (WP Rollback plugin) so if something breaks you can revert quickly.
Limit user login attempts + custom login throttle
Hackers often try to guess your password by trying hundreds of logins. Here’s how you can stop them:
Install a plugin like Limit Login Attempts Reloaded or Wordfence.
👉 These block someone after too many wrong password tries.
If you understand coding, you can add this to your theme’s functions.php:
// Stop IPs after 5 failed logins
function block_repeated_logins($user, $username, $password) {
$ip = $_SERVER['REMOTE_ADDR'];
$tries = get_transient('fail_' . $ip) ?: 0;
if ($tries >= 5) {
return new WP_Error('too_many', 'Too many failed logins. Try again in 30 minutes.');
}
if (is_wp_error($user)) {
set_transient('fail_' . $ip, $tries + 1, 30 * MINUTE_IN_SECONDS);
} else {
delete_transient('fail_' . $ip); // reset on success
}
return $user;
}
add_filter('authenticate', 'block_repeated_logins', 30, 3);👉 This blocks an IP for 30 minutes after 5 failed attempts.
You can also block attacks at the server level. This is even faster because WordPress doesn’t have to load at all.
On Apache (.htaccess file):
# Block a bad IP
<Limit POST>
Order Allow,Deny
Allow from all
Deny from 123.45.67.89
</Limit>👉 Replace 123.45.67.89 with the hacker’s IP.
If your host uses Nginx or LiteSpeed, you can add similar rules to the server config.
Scaffold faster with code generators or starter themes
Instead of writing every boilerplate file, use generators or starter themes—_underscores (_s), Sage, or Yeoman generators.
They give you a clean base, letting you focus on features.
Automatically update the copyright year
You see sites manually editing footers each January. Don’t.
Use:
© <?php echo date('Y'); ?> Your Site NameSo it always stays current.
Create invisible “Editor Notes” meta fields for editors
If multiple editors or clients use your site, set up a custom meta box (or hidden field) where editors can leave notes or reminders (e.g. “Revise this after Q2”). It doesn’t show on the front end but is visible in the backend.
Put this in your functions.php:
/**
* Register "Editor Notes" meta box for Posts (right sidebar).
*/
function my_register_editor_notes_metabox() {
add_meta_box(
'editor_notes',
'Editor Notes',
'my_editor_notes_metabox_cb',
'post',
'side',
'default'
);
}
add_action('add_meta_boxes', 'my_register_editor_notes_metabox');
/**
* Meta box markup.
*/
function my_editor_notes_metabox_cb($post) {
// Security nonce
wp_nonce_field('my_save_editor_note', 'my_editor_note_nonce');
$note = get_post_meta($post->ID, '_editor_note', true);
echo '<p><label for="my_editor_note">Private note for editors:</label></p>';
echo '<textarea id="my_editor_note" name="my_editor_note" rows="6" style="width:100%;">'
. esc_textarea($note)
. '</textarea>';
}
/**
* Save the meta when the post is saved.
*/
function my_save_editor_note($post_id) {
// 1) Check nonce exists
if (!isset($_POST['my_editor_note_nonce']) ||
!wp_verify_nonce($_POST['my_editor_note_nonce'], 'my_save_editor_note')) {
return;
}
// 2) Bail on autosave/revisions
if (defined('DOING_AUTOSAVE') && DOING_AUTOSAVE) return;
if (wp_is_post_revision($post_id)) return;
// 3) Check user capability
if (!current_user_can('edit_post', $post_id)) return;
// 4) Only for posts (optional — remove if you want on all types)
if (get_post_type($post_id) !== 'post') return;
// 5) Save
if (isset($_POST['my_editor_note'])) {
$sanitized = sanitize_textarea_field($_POST['my_editor_note']);
update_post_meta($post_id, '_editor_note', $sanitized);
} else {
// If the field was removed/empty, optionally delete meta
delete_post_meta($post_id, '_editor_note');
}
}
add_action('save_post', 'my_save_editor_note');Little touches like this help teams avoid confusion.
Bulk-edit broken image links via Media Library filters or SQL
Sites evolve; images move, links break. Use SQL like:
UPDATE wp_posts
SET post_content = REPLACE(post_content, 'old-url.com/wp-content/uploads', 'new-url.com/wp-content/uploads');Or in WP admin, filter the Media Library by “Unattached,” fix links, and reassign. Or use plugins that scan for broken image URLs and let you batch edit.
Create a temporary (or permanent) notification bar
Adding a temporary notification bar in WordPress is simple with a short snippet that outputs HTML, CSS, and JavaScript. This bar sits above your site header without overlapping it, thanks to position: sticky, and includes a dismiss button that hides it for the visitor’s session using sessionStorage.
It’s perfect for promotions, announcements, or alerts you don’t want to permanently clutter your theme.
// Temporary top notification bar that doesn't overlap the header.
add_action('wp_head', function () { ?>
<div id="temp-notice" role="region" aria-label="Site notice">
<div class="temp-notice__inner">
<span>🚀 This is a temporary notification!</span>
<button type="button" id="temp-notice-close" aria-label="Dismiss">✖</button>
</div>
</div>
<style>
#temp-notice {
position: sticky;
top: 0;
width: 100%;
background: #ff9800;
color: #fff;
z-index: 100;
font-family: Arial, sans-serif;
}
.temp-notice__inner {
max-width: var(--wp--style--global--content-size, 1200px);
margin: 0 auto;
padding: 10px 16px;
display: flex;
align-items: center;
justify-content: center;
gap: 12px;
}
#temp-notice button {
background: none;
border: none;
color: inherit;
font-size: 16px;
cursor: pointer;
line-height: 1;
}
#temp-notice[hidden] { display: none !important; }
</style>
<script>
(function () {
var bar = document.getElementById('temp-notice');
if (!bar) return;
if (sessionStorage.getItem('tempNoticeClosed') === '1') {
bar.setAttribute('hidden', '');
return;
}
var btn = document.getElementById('temp-notice-close');
if (btn) {
btn.addEventListener('click', function () {
bar.setAttribute('hidden', '');
sessionStorage.setItem('tempNoticeClosed', '1');
});
}
})();
</script>
<?php });
How to enable it:
- Open your theme’s
functions.phpfile (Appearance → Theme File Editor → Theme Functions). - Paste the snippet at the bottom and save.
- Alternatively, install the free Code Snippets plugin, create a new snippet, paste the code, set it to run “Everywhere,” and activate it.
- Reload your site, and the notification bar will appear above the header with a close button.
Use WP-CLI aliases for faster switching
If you work with multiple environments (local, staging, production), you can define WP-CLI aliases (in your wp-cli.yml) so you don’t have to type full URLs or paths each time. For example:
@local:
path: /home/user/sites/mysite
url: http://mysite.local
@prod:
ssh: user@server.com
path: /var/www/html/mysite
url: https://mysite.comThen commands like wp @prod plugin update --all or wp @local db export become trivial. Saves typing and avoids errors.
This kind of aliasing is underutilized even by seasoned devs.
Run database search/replace safely using WP-CLI with --dry-run
Going live or migrating, you’ll often need to replace URLs (say http://dev.example.com → https://example.com). Rather than risking broken links, run:
wp search-replace 'http://dev.example.com' 'https://example.com' --all-tables --dry-runInspect the output. If all looks good, then re-run without --dry-run. Avoids broken HTML, serialized data corruption, or partial replacements.
For non-developers: you need to backup your site/database before you make any major changes.
The tricks are only as powerful as your use
These tips and tricks aren’t magic. They don’t replace sound architecture, good design, or reliable hosting. But each of them is a tweak or habit that — when combined — can make your WordPress life smoother, faster, safer.
You know what I love? The more I dig, the more I find little wins like these. And they compound. Take one or two today, make them part of your toolkit, and over time you’ll wonder how you ever managed without them.
Related
