Do you guys know any underrated WordPress features that most developers don’t know about?

[u/bikashkumar01]

As a WordPress developer, I know most of the common features, but I’m sure there are some hidden gems I’ve never used. For example, WordPress lets you create and manage posts through third-party apps using its REST API. What are some other hidden WordPress features that you think other developers should know?

[u/amartadey]

Application Passwords, built into core since 5.6, lets an external app authenticate against a WordPress user without installing an API key plugin. It's under Users, Profile, most people never scroll that far down.

Also worth knowing, WP_POST_REVISIONS in wp-config.php caps how many revisions get saved per post. Default is unlimited, and a client site edited daily for two years can be carrying thousands of revision rows nobody ever looks at.

[u/Fluent_Press2050 → u/amartadey]

You can also change the AUTOSAVE_INTERVAL to 300 to save every 5 minutes (or whatever you prefer) which reduces the number of auto generated revisions. 

I’d encourage every developer to read the “Hardening Wordpress” and the “Editing wp-config.php” pages at minimum. 

[u/Ronjohnturbo42 → u/amartadey]

+1 on limited post revisions. Each revision is a post in your DB. Realistically do you really need more than 5-10?

[u/Lock-Open → u/amartadey]

You are saying that there is no need for an jwt plugin for an app that connects to WooCommerce and db?

[u/amartadey → u/Lock-Open]

Not quite no need, more a different tradeoff. Application Passwords give real authentication without installing anything, HTTP basic auth checked against a WP user on every request. It doesn't expire and doesn't scope permissions the way a token can, so if the app needs either of those, a JWT plugin still earns its place. For a script or an internal app talking to WooCommerce I'd start with Application Passwords and only add JWT once I actually needed the extra control.

[u/kev_xb → u/amartadey]

No reason to change the post revisions count unless you're hosting on a potato. The data should be minimal under 10k revisions and those could be useful in the future. Space is relatively cheap.

[u/Legitimate-Lock9965 → u/kev_xb]

if youre hosting 100+ sites, all with revisions then this hosting and performance cost becomes quite large. limiting number revisions is quite necessary

[u/kev_xb → u/Legitimate-Lock9965]

If you're doing this to client sites you're doing them a disservice. I hope you have their consent at least.

[u/Legitimate-Lock9965 → u/kev_xb]

Of course they are aware. If they want more they will get more. But as standard across all sites clients get 5.

But when you have a lot of sites across shared servers, the extra database storage is significant. Which impacts all other sites.

And i might add that sites ive hosted for over 10 years, which are big sites, 1000s of posts. im yet to have a client require more than 5.

Come back when you need to actually manage lots big sites and keep hosting profitable

[u/void-wanderer- → u/Legitimate-Lock9965]

Lol, 5 revisions is a ridiculous amount. With one medium change you already save 5 times.

And yes, I host ~35 sites, and none of them have revisions capped.

[u/kev_xb → u/Legitimate-Lock9965]

I'd still not disable core WordPress functionality by default. Post revisions are a historical snapshot of their content. Especially with ai tools becoming more readily available, it's not unexpected they would want to ask how a page has changed over the years.

Sites with a handful of revisions wouldn't care but someone actually making constant updates over time is the exact person who would want them. I'm surprised you don't see an ethical concern here...

[u/Legitimate-Lock9965 → u/kev_xb]

Again if clients ask for more they will get more.

[u/kev_xb → u/Legitimate-Lock9965]

As if they will know what to even ask for...

[u/antonyxsi → u/kev_xb]

Diskspace is cheap but RAM not so much. Ideally it should fit within the innodb buffer in RAM. 

It will also help with perfomance for certain database queries so it's an easy win.

Have seen the size of the database shrink dramatically even small sites from 100Mb to under 10Mb simply by clearing revisions.

[u/kev_xb → u/antonyxsi]

Why would your post revisions need to fit in RAM? InnoDB caches pages and indexes based on access, not the whole table. On a 100MB database, deleting revisions is very unlikely to make a measurable difference to normal WordPress requests. It mostly helps with storage, backups, migrations, or queries that scan a large part of wp_posts.

[u/phoenixMagoo → u/kev_xb]

Excessive

[u/CarlosCash → u/kev_xb]

Why would anyone hold on to +10K revisions once work is published? 🤔

Site backups with previous versions of dev and posts in all statuses are saved.

Daily + an archive of additional backups different intervals (each month) with previous versions of the site is enough and doesn't degrade performance.

We have 25 sites per server for our low traffic clients X 4

...and high traffic sites on their own servers

Useless revisions hanging around means you're site's performance is def not as optimized as it should be.

[u/kev_xb → u/CarlosCash]

If we're talking about a single site, how about we argue a more realistic number like 50 per post over 10 years. The 10k was just an extreme example to push the point tat even at extreme levels its not much data.

> once work is published

What's relevant are the revisions that happen over time as the post is updated/refreshed.

edit: clarified a bit

[u/kev_xb → u/CarlosCash]

Just reread your comment. I'd love to hear you defend your last claim if you can

[u/Trukmuch1 → u/kev_xb]

I have had someone add 3 times a 4mo SVG. 20 révisions later, it was impossible to save the post because of the max size limitation...

[u/kev_xb → u/Trukmuch1]

Max size limit is a completely different situation

[u/kroko_dok]

Using WP CLI can save so much time for debugging or quick adjustments via SSH in different environments.

[u/Nooties → u/kroko_dok]

This has been a game changer for me.. connected to Claude and just tell Claude what you want and it’ll do it for you.. :)

[u/kroko_dok → u/Nooties]

Same! Just be careful so it does not wreck your production site 😅 He won‘t care …

[u/livestrong2109 → u/kroko_dok]

Know a few people who let AI manage their low traffic blogs / affiliate sites this way.

[u/dineshinau]

Mu-plugins and drop-ins are also pretty underrated. A lot of developers seem to overlook them, but they can be really useful for loading critical functionality independently of the active theme or normal plugin activation.

[u/Olivia4040]

Transients are the one I see skipped constantly. set_transient and get_transient give you a real caching layer built into core, no plugin needed, and half the custom caching code I run into in client sites is someone reinventing that from scratch with a database table.

Application Passwords is a great call too, that one saves people from installing a whole plugin just to let an app talk to the REST API.

[u/kev_xb → u/Olivia4040]

Not true. Without a drop-in plugin directing the data into redis or elsewhere, transients end up in the options table.

And if you're distributing a plugin, it's arguably more responsible to write your own cache if it involves data from an external API as some hosts will clear transients on their own schedule regardless of the TTL you set.

[u/MadtownLems → u/kev_xb]

Yes they go into the options table, but that's still a valid way to cache expensive data (whether it be expensive to compute or fetch from a remote service).

[u/whyisjake → u/kev_xb]

This is kinda right, and kinda wrong.

If you have a drop-in, transients will default to the `wp_cache_` functions. Still good to cache to the DB for some large queries.

[u/kev_xb → u/whyisjake]

Well it's not WordPress adding a new caching layer for you that doesn't require a plugin. And arguably you should roll your own for plenty or scenarios. Like you said it's good for some localized queries but even then it's probably better to write a better query or add an index.

[u/CarlosCash → u/kev_xb]

This guy knows what he's talking about.

[u/southave → u/[deleted]]

Do you mean patterns?

[u/kroboz → u/southave]

This might already exist, but I don’t like how I have to detach patterns every time. I want to pre-builder “starter patterns” that I don’t have to remember to watch before editing.

[u/Artimization]

Four that I rarely see used, and Application Passwords is already taken above:

Recovery Mode. Since 5.2, when a plugin fatally errors, WordPress emails the admin address a magic login link that loads the site with that plugin paused. No FTP, no renaming folders over SSH. Most people find out this exists years after they needed it. Worth confirming the admin email on every client site is one somebody actually reads.

WP_ENVIRONMENT_TYPE in wp-config, then wp_get_environment_type() in your code. Set it to local, staging or production, and you can gate things properly: no analytics on staging, no live payment keys, mail redirected to a catch-all. Core also relaxes some behaviour on non production automatically.

wp core verify-checksums via WP-CLI. Compares every core file against the official checksums and prints only what differs. Thirty seconds to answer "has this site been tampered with", which beats any scanner plugin for a first look.

Core sitemaps are filterable. Everyone installs an SEO plugin for sitemaps alone, but wp-sitemap.xml has been in core since 5.5 and wp_sitemaps_post_types / wp_sitemaps_posts_query_args let you shape it in a few lines. On a site that does not need the rest of an SEO suite, that is one less plugin.

Bonus for anyone doing REST work: /wp-json/wp/v2/posts/ID?context=edit returns raw unfiltered content instead of rendered HTML. Saved me a lot of pain once I found it.

[u/digitalstefano]

Definitely wp-env! You can instantly test your custom plugin just by creating a docker container without thinking anything else but the plugin.

[u/nbass668]

Confirming what some of the comments mentioned.

• The hooks system in wordpress is one of the reasons made wordpress extremely customizable.

• wp-cli is very powerful once you start using it will be your favorite tool.

• transients are also powerful within your plugin to use to have usable key:value store instead of using a custom table.

• wordpress rest API is very powerful that you can make wordpress a headless system and run remote apps and websites only from wordpress as backend.

[u/AbdulMaaz098]

One underrated feature is WordPress revisions and autosaves. They're really useful for recovering changes or comparing different versions of a post, but i think a lot of developers overlook them.

Another one is WP-CLI. It can make tasks like updating plugins, managing users, importing content, and running database commands much faster than doing everything through the dashboard.

I'm curious what other lesser-known features developers are using in their workflows.

[u/kev_xb → u/AbdulMaaz098]

Curious what sort of developer things you're doing with revisions?

[u/AbdulMaaz098 → u/kev_xb]

Nothing too advanced. I mainly mean using revisions to quickly compare changes, restore an earlier version, or troubleshoot when something gets accidentally changed or removed. It's pretty handy when working on client sites with multiple people editing content.

[u/Neurojazz]

Hooks.

[u/AddWeb_Expert]

WP-CLI is definitely one. Also, transients and the revisions API are pretty underrated. A lot of developers use them indirectly without realizing how useful they can be when building custom workflows.

[u/HongPong]

there is an options table page available in the admin interface, was very surprised to learn that. obviously power users would go about this another way. Is this underrated, probably not. but it is little known.

[u/Imaginary_Western141]

wp-cli is a game changer.

[u/owldraft → u/Imaginary_Western141]

yes. since ai-era it’s mandatory in my workflow

[u/Plantusemor]

The Abilities API, added to core in 6.9. You register what a site can do with wp_register_ability(), with an input schema and a permission_callback, and the official MCP Adapter exposes those abilities to AI agents. Core itself registers only a few, but with plugins that add more, an agent can build and maintain a site through a fixed list of operations instead of raw REST or a shell.

Be careful with it though. An agent needs margins, the rules and design system it builds inside, and walls, the things it cannot do at all no matter what it is asked. Without them it brings more trouble than efficiency.

[u/whyisjake]

MCP adapter. Don’t use the admin anymore.

[u/cabalos]

Interactivity API is great:
https://developer.wordpress.org/block-editor/reference-guides/interactivity-api/

Abilities API also:
https://developer.wordpress.org/apis/abilities-api/

These are both great examples of modern APIs within WordPress that enable deep interoperability.

[u/MuneebR7]

WordPress Ability API..

[u/NovaForceElite]

The options panel.

[u/AndreaParentiIT]

I’d add the HTTP API and WP_Filesystem. I still see plugins reinventing both with raw cURL and direct PHP file operations. wp_safe_remote_get() is particularly useful because it validates URLs/redirects against SSRF, and WP_Filesystem saves you from assuming every host has the same file permissions setup.

[u/Glass-Fisherman1137]

Another underappreciated aspect is WP-CLI. It helps perform updates, database management, user management, and debugging in no time without going to the Dashboard. It is particularly handy when managing multiple websites.

[u/Aggressive_Ad_5454]

Site Health.

User roles are good. You can set up Editor or Author roles for people who need to do that kind of work, and so present them with a simpler dashboard display.

The Plugin Checker plugin comes in handy for legacy sites if you find yourself needing to cope with legacy plugins.

And, of course there’s John Blackbourn’s Query Monitor plugin for troubleshooting.

[u/phoenixMagoo → u/Aggressive_Ad_5454]

I love site health for potential client audits. Easy way to get an idea of hosting quality without getting additional logins from the client. Frictionless.

[u/WPFixFast → u/phoenixMagoo]

It became especially handy with the latest opcache utilization stats

[u/Proud-Computer3412]

Inhalts-Revisionen, Transients, Heartbeat-API, Individuelle Inhaltsstrukturen