10up Engineering Best Practices

repository·gh-pages·Indexed 21 days ago

https://github.com/10up/engineering-best-practices

The official engineering standards for 10up, providing a guide for building high-quality web experiences and standardizing processes to facilitate collaboration. This documentation covers CSS methodologies, including Inverted Triangle Architecture, mobile-first approaches, content-agnostic component design, accessibility requirements, and the use of CSS logical properties for RTL support.

Tokens
35.8K
Snippets
76
Records
169
Agent score
73%

What's inside 10up Engineering Best Practices

  1. Overview of 10up Engineering Best Practices

    gh-pages
    The 10up Engineering Best Practices guide defines the official standards for how 10up engineers build websites. The goal is to improve experience quality and standardize engineering processes to facilitate effective collaboration across the company.
  2. Implement WordPress security best practices

    gh-pages

    Follow these high-level security recommendations for WordPress environments:

    • Password Policy: Enforce strong passwords using a plugin or custom solution. Use randomly generated passwords from a password managers.
    • Authentication: Use Multi-Factor Authentication (MFA) or Two-Factor Authentication (2FA) for administrator accounts. Avoid SMS-based methods due to SIM hijacking risks.
    • User Management: Do not use admin as a default username. Disable User Enumeration to prevent attackers from harvesting usernames or emails via the WordPress JSON API.
    • Maintenance: Keep WordPress core updated, especially minor security releases. Regularly scan your codebase and plugins for vulnerabilities using tools like wpvulndb.com.
    • Attack Surface Reduction: Disable XML-RPC to prevent brute force and DDoS attacks; use the JSON API instead. Regularly remove unused plugins and themes to reduce attack vectors.
  3. Understand @wordpress/element in Gutenberg

    gh-pages

    In Gutenberg development, you should use @wordpress/element instead of importing React directly.

    @wordpress/element is an abstraction layer built on top of React specifically for WordPress. It provides a stable API entry point that protects your components from breaking changes when the underlying React version is updated by the WordPress core team.

  4. Use Batcache for page caching

    gh-pages

    Batcache is a WordPress plugin that uses the object cache (like Memcached) to store and serve entire rendered pages.

    Key Considerations:

    • User-Specific Logic: Because HTML is cached, you cannot rely on server-side logic involving $_SERVER or $_COOKIE. Move user-specific logic to the front-end using JavaScript.
    • Logged-in Users: Batcache does not cache logged-in users, which may impact performance on subscription-heavy sites like BuddyPress.
    • Query Strings: Batcache treats query strings as part of the URL. Using query strings for tracking (e.g., Google Analytics) can bypass the cache and render it ineffective.
    • Environment: While WordPress VIP uses Batcache, specific VIP rules apply that differ from the open-source version.
  5. Manage PHP sessions in multi-server environments

    gh-pages

    By default, PHP stores sessions as files on the local filesystem. In multi-server (load-balanced) environments, this prevents sessions from being shared across servers.

    To ensure session persistence across all web servers, use Memcached as the session storage location. This makes sessions available to all servers in the cluster.

  6. Use Functional Components for most React development

    gh-pages

    Functional components are the recommended way to write React components. They reduce boilerplate and allow for easier reuse of stateful logic via React Hooks. They help avoid complex logic fragmentation across various lifecycle methods like componentDidUpdate or componentDidMount.

    Use a functional component when you need to manage state, context, refs, or lifecycle effects using hooks.

    import React, { useState } from 'react';
    
    const SearchInput = () => {
    	const [searchTerm, setSearchTerm] = useState('');
    
    	const handleClick = (e) => {
    		setSearchTerm(e.target.value);
    	};
    
    	return (
    		<div className="search-input">
    			<input onChange={handleClick} value={searchTerm} />
    		</div
    	);
    };
    
    export default SearchInput;
  7. Use Gutenberg Higher-Order Components (HOCs)

    gh-pages

    Gutenberg provides a library of Higher-Order Components designed to build robust editor experiences. These components handle specialized tasks like focus management and auditory messaging.

    Before building custom utility functionality, check the Gutenberg HOC library to see if a solution already exists. You can find the library in the Gutenberg source under packages/components/src/higher-order.

  8. Choose a Vue templating style

    gh-pages

    Vue supports three main templating styles. Your choice should depend on the project type:

    1. HTML Templates: Using a script block or inline template in the HTML (similar to Mustache or Handlebars). This is useful when templates need to be accessible to backend technologies like PHP.
    2. Inline Template Strings: Using JavaScript inline template strings (similar to React). This is useful for small components that consume API data and do not need information from a WordPress template. You can pass data into these templates via props.
    3. External Files: Using an external .vue template file.
  9. Mitigate potential migration side effects

    gh-pages

    Be aware of these common side effects and implement safeguards:

    • Missing Data: Ensure scripts can handle missing items (especially media) without failing.
    • SEO Impact: Mitigate via a robust redirect plan.
    • Social Service Triggers: Prevent automated services (Facebook, Twitter, email) from triggering/spamming subscribers when hundreds of posts are imported. Account for this in your plan.
    • Test User Pollution: If importing a SQL dump, verify that local test users are not accidentally imported into production.
    • Time Overruns: Always estimate more time than strictly necessary for planning, writing, testing, and fixing.
    • Data Recovery & Re-runs:
      • Always keep a backup of the original data source.
      • Pro-tip: Save a piece of meta with any migrated content. This allows you to identify all migrated items easily, which is useful if you need to delete them and re-run a fresh migration.
  10. Write resilient components

    gh-pages

    Resilient components are robust, predictable, and less prone to bugs. Following these four principles helps ensure components behave correctly even in complex environments:

    1. Don't stop the data flow: Maintain a clear direction for data (usually top-down).
    2. Always be ready to render: Components should be able to render even if data is missing or in an unexpected state.
    3. No component is a singleton: Design components assuming they might be instantiated multiple times simultaneously.
    4. Keep the local state isolated: Avoid side effects that rely on or modify external state outside of the component's controlled lifecycle.