Hey Reader, here are a few highlights and ideas I’ve been sharing lately around WordPress development and security.

🔍 Debugging WordPress Redirects

Ever seen a WordPress redirect and had no clue where it’s coming from? I wrote a guide on how redirects work and the tools you can use to track them down, including a must-use plugin I built to log redirect sources with PHP backtraces. Did you know that Query Monitor adds an HTTP header with backtrace info for some redirects?

🔐 Encrypting WordPress Options & Meta

Ever felt hesitant about storing API keys and other secrets in WP options? I've been working on a PHP library to enable encryption of WordPress options and meta values using symmetrical keys stored in constants, environment variables and PHP files (similar to *.asset.php files).

The eventual goal is to get the underlying API into WordPress core so I'm building a commercial plugin with an interface for encrypting existing options (without any changes to the plugin using the option value). With a standardized API in core, plugins would be able to opt-in for encrypted storage of specific options through a single filter.

One of the biggest challenges when running this as a plugin is to ensure that the decrypt logic runs before any of the plugins attempt to use the encrypted option. For now I've added an activation logic that places a must-use loader plugin that include_once the main plugin, making it run before all other plugins (hopefully).

🧪 Post Meta Inspector for the Block Editor

Ever wanted inspect post meta values but without relying on legacy meta boxes? I’ve been experimenting with a block-based post meta inspector that integrates directly into the editor UI inside

What are you experimenting with in your WordPress work right now? Hit reply and share -- I’d love to hear about it.

Until next time,
Kaspars