Blog

When a search engine crawler visits a site, it usually doesn’t jump straight to your articles. It first checks robots.txt to learn where it may go, and it reads sitemap.xml to learn what pages exist. Both files are “notes for crawlers,” so they get confused a lot — but they say different things and matter at different moments. The last few posts (hreflang, JSON-LD, OGP) were about how a page should be interpreted. This one is about the step before that: how a crawler gets to the page at all. Note: crawlers are also called bots or spiders. Googlebot and Bingbot are the best-known examples. Each identifies itself with a …

Paste a URL into X (formerly Twitter) or Facebook, and a card appears: a title, a description, and an image, neatly assembled. That is not automatic guesswork — the page itself publishes metadata called OGP (Open Graph Protocol), and the platform’s crawler reads it to build the card. Following the previous post on JSON-LD, this one covers OGP, another piece of metadata that lives in <head>, using this blog’s implementation (wpmm.jp/blog and en.wpmm.jp/blog) as the example. Note: OGP was proposed by Facebook in 2010. The name reflects the idea of treating a page as part of a graph — a network of connected nodes. Today it has become a de …

You have probably seen search results that show more than a blue link and a snippet: a publish date, an author, or a breadcrumb trail of the site’s hierarchy. These are called rich results, and the raw material behind them is structured data embedded in the page. This post covers JSON-LD, today’s most common format: what it describes and how to verify it, using the implementation on this blog (wpmm.jp/blog and en.wpmm.jp/blog) as the example. Note: structured data is an annotation that presents a page’s meaning in a machine-readable form. Writing it does not guarantee any particular display. It is a hint that helps a search engine understand the content. …

If you run a site in both Japanese and English, a few questions come up quickly. Will a search engine treat the two versions of the same article as unrelated pages? Will someone searching in Japanese be shown the English page? The hreflang annotation, placed in the HTML <head>, exists to address exactly this. This post covers what hreflang says, how it needs to be written, and how it works in practice on this blog (wpmm.jp/blog and en.wpmm.jp/blog). Note: hreflang tells search engines that a page has counterparts in other languages or regions. It does not translate anything. It only declares which URLs are language variants of the same content. …

Read enough WordPress theme or plugin code and you’ll notice that values are almost never echoed directly. Instead you see echo esc_html( $title ); or <a href=”<?php echo esc_url( $url ); ?>”>. These are WordPress’s escaping functions, the core tools for preventing XSS (cross-site scripting). This post looks at why there are several of them and, more importantly, when escaping should happen. Note: XSS is a broad term for problems where a value shown on a page contains text that the browser interprets as HTML or script rather than as plain text. The root cause is a blurred boundary between “a value” and “the structure of the HTML.” It’s the …

When a WordPress plugin or theme needs to talk to the database directly, it uses the core-provided global object $wpdb. The one thing to absolutely avoid when doing so is dropping user input straight into a SQL string through concatenation. The tool WordPress provides instead is $wpdb->prepare(). This post looks at why that matters and what the function actually does under the hood. Note: SQL injection is a broad term for attacks where unexpected input gets mixed into a SQL statement an application builds, rewriting what that statement actually tells the database to do. Any value coming from outside the application — form fields, URL parameters, and so on — …

WordPress plugins and themes change what gets displayed and how data gets processed without ever touching WordPress core’s own files (the code under wp-includes / wp-admin). What makes that possible is a mechanism called hooks, which come in two flavors: actions and filters. This blog’s own theme, wpmm-blog, uses both extensively in its functions.php, so this article walks through real code from it. Note: a hook is a point WordPress core deliberately builds in for outside code to plug into. At specific points in core’s own source, calls like do_action() and apply_filters() are already embedded. Plugins and themes “hook” their own functions onto those points to intercept what core does …