10up Engineering Best Practices
repository·gh-pages·Indexed 21 days ago
https://github.com/10up/engineering-best-practicesThe official engineering standards for 10up, providing a guide for building high-quality web experiences and standardizing processes to facilitate collaboration. This documentation covers CSS methodologies, including Inverted Triangle Architecture, mobile-first approaches, content-agnostic component design, accessibility requirements, and the use of CSS logical properties for RTL support.
What's inside 10up Engineering Best Practices
- The 10up Engineering Best Practices guide defines the official standards for how 10up engineers build websites. The goal is to improve experience quality and standardize engineering processes to facilitate effective collaboration across the company.
Implement WordPress security best practices
gh-pagesFollow these high-level security recommendations for WordPress environments:
- Password Policy: Enforce strong passwords using a plugin or custom solution. Use randomly generated passwords from a password managers.
- Authentication: Use Multi-Factor Authentication (MFA) or Two-Factor Authentication (2FA) for administrator accounts. Avoid SMS-based methods due to SIM hijacking risks.
- User Management: Do not use
adminas a default username. Disable User Enumeration to prevent attackers from harvesting usernames or emails via the WordPress JSON API. - Maintenance: Keep WordPress core updated, especially minor security releases. Regularly scan your codebase and plugins for vulnerabilities using tools like wpvulndb.com.
- Attack Surface Reduction: Disable
XML-RPCto prevent brute force and DDoS attacks; use the JSON API instead. Regularly remove unused plugins and themes to reduce attack vectors.
Co-locate React component types
gh-pagesReact component types should generally be co-located within the same file as the component itself. Only hoist types to separate files to avoid circular dependencies or when a type is explicitly intended to be reused across many different components or files.Understand @wordpress/element in Gutenberg
gh-pagesIn Gutenberg development, you should use
@wordpress/elementinstead of importing React directly.@wordpress/elementis an abstraction layer built on top of React specifically for WordPress. It provides a stable API entry point that protects your components from breaking changes when the underlying React version is updated by the WordPress core team.Use Batcache for page caching
gh-pagesBatcache is a WordPress plugin that uses the object cache (like Memcached) to store and serve entire rendered pages.
Key Considerations:
- User-Specific Logic: Because HTML is cached, you cannot rely on server-side logic involving
$_SERVERor$_COOKIE. Move user-specific logic to the front-end using JavaScript. - Logged-in Users: Batcache does not cache logged-in users, which may impact performance on subscription-heavy sites like BuddyPress.
- Query Strings: Batcache treats query strings as part of the URL. Using query strings for tracking (e.g., Google Analytics) can bypass the cache and render it ineffective.
- Environment: While WordPress VIP uses Batcache, specific VIP rules apply that differ from the open-source version.
- User-Specific Logic: Because HTML is cached, you cannot rely on server-side logic involving
Manage PHP sessions in multi-server environments
gh-pagesBy default, PHP stores sessions as files on the local filesystem. In multi-server (load-balanced) environments, this prevents sessions from being shared across servers.
To ensure session persistence across all web servers, use Memcached as the session storage location. This makes sessions available to all servers in the cluster.
Use Functional Components for most React development
gh-pagesFunctional components are the recommended way to write React components. They reduce boilerplate and allow for easier reuse of stateful logic via React Hooks. They help avoid complex logic fragmentation across various lifecycle methods like
componentDidUpdateorcomponentDidMount.Use a functional component when you need to manage state, context, refs, or lifecycle effects using hooks.
import React, { useState } from 'react'; const SearchInput = () => { const [searchTerm, setSearchTerm] = useState(''); const handleClick = (e) => { setSearchTerm(e.target.value); }; return ( <div className="search-input"> <input onChange={handleClick} value={searchTerm} /> </div ); }; export default SearchInput;Use Gutenberg Higher-Order Components (HOCs)
gh-pagesGutenberg provides a library of Higher-Order Components designed to build robust editor experiences. These components handle specialized tasks like focus management and auditory messaging.
Before building custom utility functionality, check the Gutenberg HOC library to see if a solution already exists. You can find the library in the Gutenberg source under
packages/components/src/higher-order.Choose a Vue templating style
gh-pagesVue supports three main templating styles. Your choice should depend on the project type:
- HTML Templates: Using a script block or inline template in the HTML (similar to Mustache or Handlebars). This is useful when templates need to be accessible to backend technologies like PHP.
- Inline Template Strings: Using JavaScript inline template strings (similar to React). This is useful for small components that consume API data and do not need information from a WordPress template. You can pass data into these templates via
props. - External Files: Using an external
.vuetemplate file.
Mitigate potential migration side effects
gh-pagesBe aware of these common side effects and implement safeguards:
- Missing Data: Ensure scripts can handle missing items (especially media) without failing.
- SEO Impact: Mitigate via a robust redirect plan.
- Social Service Triggers: Prevent automated services (Facebook, Twitter, email) from triggering/spamming subscribers when hundreds of posts are imported. Account for this in your plan.
- Test User Pollution: If importing a SQL dump, verify that local test users are not accidentally imported into production.
- Time Overruns: Always estimate more time than strictly necessary for planning, writing, testing, and fixing.
- Data Recovery & Re-runs:
- Always keep a backup of the original data source.
- Pro-tip: Save a piece of meta with any migrated content. This allows you to identify all migrated items easily, which is useful if you need to delete them and re-run a fresh migration.
Avoid query_posts()
gh-pagesThequery_posts()function should almost never be used. It creates a newWP_Queryobject and replaces the existing main query loop, which is non-performant and can cause issues with plugins and themes that rely on the main query. UseWP_Queryor modify the main query via hooks instead.Write resilient components
gh-pagesResilient components are robust, predictable, and less prone to bugs. Following these four principles helps ensure components behave correctly even in complex environments:
- Don't stop the data flow: Maintain a clear direction for data (usually top-down).
- Always be ready to render: Components should be able to render even if data is missing or in an unexpected state.
- No component is a singleton: Design components assuming they might be instantiated multiple times simultaneously.
- Keep the local state isolated: Avoid side effects that rely on or modify external state outside of the component's controlled lifecycle.