WordPress Core Architecture

Introduction to WordPress

WordPress is the world's most popular content management system (CMS), powering approximately 43% of all websites on the internet. Originally created in 2003 as a blogging platform, WordPress has evolved into a flexible, full-featured CMS suitable for building nearly any type of website—from blogs and portfolios to e-commerce stores and enterprise solutions.

The popularity of WordPress stems from several key factors:

• Open-source: WordPress is free to use, modify, and distribute under the GPL license
• Extensibility: The plugin and theme ecosystem allows for nearly unlimited customization
• Accessibility: Non-technical users can manage content without coding knowledge
• Community: A massive global community provides support, resources, and ongoing development
• Maturity: With over 20 years of development, WordPress is stable, secure, and battle-tested

At its core, WordPress balances simplicity with sophistication—making it accessible to beginners while providing powerful tools for developers. Understanding the WordPress architecture is essential for anyone looking to work with the platform beyond basic content management.

WordPress Core Components

WordPress can be viewed as a collection of integrated components that work together to create a cohesive system. Think of WordPress like a modern building with distinct but interconnected systems (electrical, plumbing, HVAC, etc.).

The main components of WordPress include:

The WordPress Database

The database is the foundation of WordPress, storing all content, settings, and structural information. A standard WordPress installation creates 12 default tables, each with a specific purpose:

WordPress uses a prefix (default "wp_") for all table names, which can be changed during installation for security purposes or to run multiple WordPress installations on a single database.

The database structure follows a flexible design pattern that allows WordPress to store diverse content types within the same tables. For example, posts, pages, and custom post types all use the wp_posts table, differentiated by the post_type field. This approach allows WordPress to maintain a relatively simple database schema while supporting complex content relationships.

WordPress File Structure

Understanding the WordPress file system organization is crucial for developers. A standard WordPress installation consists of the following directory structure:

wordpress/
├── wp-admin/          # Admin dashboard files
├── wp-content/        # User content (themes, plugins, uploads)
│   ├── plugins/       # Plugin files
│   ├── themes/        # Theme files 
│   └── uploads/       # Uploaded media files
├── wp-includes/       # Core functionality files
├── index.php          # Main entry point
├── wp-config.php      # Configuration file
└── [Other root files] # Various WordPress core files
          

This file structure follows a principle of separation: core WordPress files are kept separate from user content and customizations. This separation allows WordPress to be updated without overwriting custom themes and plugins, making the system more maintainable over time.

The WordPress Request Lifecycle

When a visitor accesses a WordPress site, a complex series of operations occurs to generate and deliver the appropriate content. Understanding this request lifecycle is essential for developers:

Here's a detailed breakdown of what happens when a WordPress page is requested:

Throughout this process, WordPress triggers numerous action and filter hooks, allowing plugins and themes to integrate with and modify every stage of content delivery. This hook-based architecture is what makes WordPress so extensible.

WordPress Core APIs

WordPress provides numerous Application Programming Interfaces (APIs) that allow developers to interact with various parts of the system. These APIs provide standardized ways to perform common operations:

// Add a function to the 'init' action hook
add_action('init', 'my_custom_init_function');

function my_custom_init_function() {
    // Code to run during WordPress initialization
    register_post_type('product', [...]);
}

// Filter content before display
add_filter('the_content', 'my_content_filter');

function my_content_filter($content) {
    // Modify $content in some way
    return $content . '<p>Thanks for reading!</p>';
}

// Get an option with a default value if it doesn't exist
$option_value = get_option('my_plugin_setting', 'default_value');

// Update an option
update_option('my_plugin_setting', 'new_value');

// Add an option (only if it doesn't already exist)
add_option('my_plugin_setting', 'initial_value');

// Get post meta with a default value if it doesn't exist
$custom_field = get_post_meta($post_id, 'custom_field_name', true);

// Add post meta
add_post_meta($post_id, 'view_count', 1, true);

// Update post meta
update_post_meta($post_id, 'view_count', $new_count);

// Make a GET request to an external API
$response = wp_remote_get('https://api.example.com/data');

// Check for errors
if (is_wp_error($response)) {
    // Handle error
} else {
    // Get response body
    $body = wp_remote_retrieve_body($response);
    $data = json_decode($body);
    // Process data
}

global $wpdb;

// Select data
$results = $wpdb->get_results(
    $wpdb->prepare(
        "SELECT * FROM {$wpdb->posts} WHERE post_type = %s AND post_status = %s",
        'post',
        'publish'
    )
);

// Insert data
$wpdb->insert(
    $wpdb->prefix . 'custom_table',
    [
        'column1' => 'value1',
        'column2' => 123
    ],
    ['%s', '%d']
);

// Register a shortcode
add_shortcode('greeting', 'greeting_shortcode_function');

function greeting_shortcode_function($atts) {
    // Parse attributes with defaults
    $atts = shortcode_atts([
        'name' => 'World'
    ], $atts);
    
    // Return the shortcode output
    return '<p>Hello, ' . esc_html($atts['name']) . '!</p>';
}

// Usage in content: [greeting name="John"]

These APIs form the backbone of WordPress development, providing standardized interfaces for common operations. By using these APIs rather than directly manipulating the database or implementing custom solutions, developers ensure that their code is compatible with future WordPress updates and works well with other plugins and themes.

The Hooks System: Actions and Filters

The WordPress hooks system is the foundation of its extensibility. Hooks allow plugins and themes to modify WordPress behavior without editing core files, enabling the customization of almost any aspect of WordPress.

Think of hooks as events or interception points throughout the WordPress code. When WordPress runs, it reaches different points where it says, "If anyone wants to add or modify something here, now's your chance." Plugins and themes can register functions to run at these specific points.

There are two types of hooks in WordPress:

// Register a function to run after a post is saved
add_action('save_post', 'my_function_after_save', 10, 3);

function my_function_after_save($post_id, $post, $update) {
    // Do something after a post is saved
    if ($update && $post->post_type == 'post') {
        // This is an update to an existing post
        update_post_meta($post_id, 'last_edited_time', time());
    }
}

// Modify post content before display
add_filter('the_content', 'my_content_filter');

function my_content_filter($content) {
    // Add a call-to-action at the end of each post
    if (is_single() && !is_admin()) {
        $content .= '<div class="cta">Thanks for reading! Please subscribe to our newsletter.</div>';
    }
    return $content; // Always return the modified value
}

Common WordPress Hooks

WordPress includes hundreds of action and filter hooks. Here are some of the most commonly used:

The hooks system exemplifies WordPress's philosophy of extensibility. By providing hooks at virtually every significant point in the system's operation, WordPress allows developers to modify its behavior without touching core code. This makes updates safer, reduces conflicts between plugins, and allows for a modular approach to adding functionality.

Content Types and Taxonomies

WordPress provides a flexible content architecture that allows for various types of content to be managed through the same interface. This is achieved through post types and taxonomies:

// Register a custom post type for Events
function create_event_post_type() {
    register_post_type('event',
        array(
            'labels' => array(
                'name' => __('Events'),
                'singular_name' => __('Event')
            ),
            'public' => true,
            'has_archive' => true,
            'supports' => array('title', 'editor', 'thumbnail', 'excerpt'),
            'menu_icon' => 'dashicons-calendar',
            'rewrite' => array('slug' => 'events'),
        )
    );
}
add_action('init', 'create_event_post_type');

// Register a custom taxonomy for Event Types
function create_event_type_taxonomy() {
    register_taxonomy(
        'event_type',
        'event',
        array(
            'labels' => array(
                'name' => __('Event Types'),
                'singular_name' => __('Event Type')
            ),
            'hierarchical' => true, // Like categories
            'rewrite' => array('slug' => 'event-types'),
            'show_admin_column' => true,
        )
    );
}
add_action('init', 'create_event_type_taxonomy');

The post type and taxonomy system in WordPress provides a structured yet flexible way to manage content. This architecture allows WordPress to handle everything from simple blogs to complex content-driven websites with specialized content types and organizational systems.

Security Architecture

WordPress includes several built-in security features and follows security best practices in its architecture:

global $wpdb;
$results = $wpdb->get_results(
    $wpdb->prepare(
        "SELECT * FROM $wpdb->posts WHERE post_type = %s AND post_status = %s",
        'post',
        'publish'
    )
);

global $wpdb;
// NEVER do this!
$status = $_GET['status']; // User input
$results = $wpdb->get_results(
    "SELECT * FROM $wpdb->posts WHERE post_status = '$status'"
);

// In a form:
wp_nonce_field('delete_post_' . $post_id, 'security');

// When processing the form:
if (!isset($_POST['security']) || !wp_verify_nonce($_POST['security'], 'delete_post_' . $_POST['post_id'])) {
    die('Security check failed');
}

// Check if user can edit posts
if (current_user_can('edit_posts')) {
    // Show edit link
}

// Check if user can edit a specific post
if (current_user_can('edit_post', $post_id)) {
    // Show edit link for this post
}

// Process form data safely
$name = sanitize_text_field($_POST['name']);
$email = sanitize_email($_POST['email']);
$content = wp_kses_post($_POST['content']); // Allow only safe HTML

// Output data safely
echo '<a href="' . esc_url($url) . '" title="' . esc_attr($title) . '">';
echo esc_html($name);
echo '</a>';

These security features are built into the WordPress core architecture, providing a foundation for secure web applications. However, security is a shared responsibility: plugin and theme developers must follow these practices in their own code, and website administrators must keep WordPress, plugins, and themes updated to protect against known vulnerabilities.

Practical Activity: Exploring WordPress Core

Let's solidify your understanding with a hands-on activity that explores the WordPress core architecture:

Summary and Key Takeaways

• WordPress is a mature, extensible content management system built on PHP and MySQL
• The WordPress database uses a relational structure with tables for posts, users, terms, and metadata
• WordPress files are organized into core files (wp-admin, wp-includes) and customizable content (wp-content)
• The request lifecycle involves bootstrapping WordPress, determining content, and loading appropriate templates
• The hooks system (actions and filters) allows for extending and modifying WordPress behavior
• WordPress provides numerous APIs for standard operations like options management, metadata, and HTTP requests
• The content architecture uses post types and taxonomies to organize different kinds of content
• Security features like prepared statements, nonces, and data sanitization are built into the WordPress architecture

Understanding these core architectural concepts provides the foundation for effective WordPress development. In our next session, we'll explore how WordPress manages content through the post and page system.

Further Resources

• WordPress Developer Resources
• WordPress Code Reference
• WordPress Database Description
• WordPress Hooks Database
• WordPress Core Contributor Handbook
• "Professional WordPress Plugin Development" by Brad Williams, Justin Tadlock, and John James Jacoby
• "Professional WordPress: Design and Development" by Brad Williams and David Damstra