=== WP Coder – Insert & Manage Code Snippets ===
Contributors: Wpcalc, lobov
Donate link: https://wpcoder.pro/
Tags: code snippets, header footer, custom css, php, javascript
Requires at least: 5.3
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 5.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Add code snippets, header & footer scripts and custom HTML, CSS, JS & PHP — site-wide or by shortcode and block, no theme edits.

== Description ==

Tired of editing theme files to add custom scripts or styles?
**WP Coder** lets you insert custom HTML, CSS, JavaScript, and PHP snippets directly from your dashboard — no coding in theme files required. Gain full control and flexibility over your site.

[Documentation](https://wpcoder.pro/category/documentation/) | [WP Coder Pro](https://wpcoder.pro/pricing/)

### Why WP Coder?
- **Header & Footer Scripts:** Add Google Analytics, Tag Manager, verification meta tags or any script to every page — in `<head>`, right after `<body>`, before or after the post content, or before `</body>`.
- **Shortcodes & a Gutenberg Block:** Place a snippet anywhere with `[wp_code id="X"]` or the WP Coder block, with a live preview in the editor.
- **Reusable Snippets with Attributes:** Define fields once — text, textarea, number, range, URL, image, color, date — and fill them per shortcode or block. Use them in your code as `{{name}}`.
- **Images Done Right:** An image attribute gives you its URL, alt text, size, `srcset` and a ready `<img>` tag with WordPress lazy loading and fetch priority applied.
- **82 Ready-made Snippets:** Turn on common tweaks for security, performance, the editor, media, comments and login with one switch — and find any of them with instant search.
- **Safe by Design:** Only administrators can add code. A PHP error in a snippet is caught and logged instead of breaking the page, and Safe Mode (`?wpcoder-safe-mode=1`, for administrators) gets you back into the admin if Global PHP or an included PHP snippet ever locks you out.

### Ideal For
- **Developers:** Test snippets, hooks and PHP quickly, with a code editor that feels like home.
- **Marketers:** Insert tracking pixels, analytics and ad scripts site-wide in a minute.
- **Designers & Bloggers:** Build reusable blocks, customize layouts and styles.

### Key Features
- Tabbed editor for **HTML, CSS, JS and PHP** with syntax highlighting, linting, code folding, find & replace, full screen and `Ctrl/Cmd+S` to save.
- **Live Preview:** See your HTML and CSS rendered as you type, right next to the editor.
- Smart PHP handling: run in admin, front end, everywhere, or only where the snippet is placed.
- Include external libraries (Google Fonts, CDN scripts & styles) with `async` / `defer`.
- Minify HTML, CSS and JS, or obfuscate JavaScript.
- **Test Mode:** Preview snippets as an administrator before visitors see them.
- **Organize:** Several tags per snippet, pin the ones you use most, filter and bulk-edit the list.
- Import/Export snippets between sites.
- **Customizable Interface:** Hide unused editor tabs and add NAV comments to jump around long code.
- Lightweight — pages that do not use a snippet get no extra CSS or JavaScript.

### Included Tools:

#### Integrations
- Google Tag Manager (GTM) integration with user role controls.
- Google Analytics, Facebook Pixel, and Pinterest Pixel integration.
- Google AdSense integration with the option to disable ads for selected user roles.

#### Content & Templates
- Markdown Editor - Disables Gutenberg and TinyMCE, replacing them with a Markdown editor powered by CodeMirror.

#### Developer Tools
- Debug Log management (enable/disable and clear log).
- Show Page Debug Info - Display technical info for the current request in the Admin Bar (template, query type, object, body classes). Admins only.
- Theme Switcher -  Quickly switch between installed themes directly from the admin bar.

### Included Snippets (82):

#### Editor & Content
- Remove Gutenberg Block CSS
- Add Page Slug to Body Class
- Disable Widget Blocks
- Enable Shortcode Execution in Text Widgets
- Enable Excerpt for Pages
- Open External Links in New Tab
- Disable Block Patterns
- Unsynced Patterns by Default
- Change "Read More" Text for Excerpts
- Custom Excerpt Length by Post Type
- Change Autosave Interval
- Custom Editor Styles
- Disable Gutenberg Editor

#### Admin Interface
- Disable "Screen Options" Tab
- Disable Welcome Panel
- Duplicate Posts & Pages
- Enable Search by ID
- Show ID Column
- Show Featured Image Column
- Show Last Modified Column
- Collapse Admin Notices
- Disable The WP Admin Bar

#### Login & Users
- Disable Login Page Language Switcher
- Disable Login by Email
- Disable Admin Password Reset Emails
- Change Logo on Login Page
- Change URL for Logo on Login Page
- Change Redirect After Login
- Change Redirect After Logout
- Change "Remember Me" Duration

#### Media & Embeds
- Allow SVG Uploads
- Disable Big Image Scaling
- Disable Unused Image Sizes
- Auto Alt Text from Filename
- Default Image Link to None
- Enable Lowercase Filenames for Uploads
- Add Alt Text to Avatars
- Add Featured Image to RSS Feeds
- Disable Embeds
- Limit Maximum Upload Size
- Change oEmbed Max Width and Height

#### Comments & Feedback
- Disable Comments
- Remove Website URL Field
- Disable Self Pingbacks
- Disable Trackbacks & Pingbacks
- Disable HTML in Comments
- Limit Comment Length

#### Security
- Disable XML-RPC
- Disable Theme & Plugin File Editing
- Disable Plugin & Theme Installation
- Disable Author Archives
- Email on Administrator Login
- Disable User Enumeration
- Add Security Headers
- Disable Application Passwords
- Hide Login Error Details
- Remove WordPress Version Number
- Limit Login Attempts
- Disable WordPress REST API

#### Performance
- Load Block CSS Only When Used
- Remove Global Styles & SVG Filters
- Disable Gravatar
- Remove Query Strings from Assets
- Disable Heartbeat on Front End
- Remove jQuery Migrate
- Disable Dashicons on Front End
- Disable Emojis
- Remove Shortlink Tag
- Remove Windows Live Writer Tag
- Remove RSD Link & X-Pingback
- Resource Hints
- Image Lazy Loading (force or disable)

#### Core & System
- Disable Automatic Updates
- Disable Automatic Update Emails
- Disable Admin Email Verification
- Disable Automatic Trash Emptying
- Disable Search
- Disable RSS Feeds
- Disable Attachment Pages
- Redirect 404 to Homepage
- Custom Mail From Name & Address
- Limit Post Revisions

### WP Coder Pro

Everything above stays free. [WP Coder Pro](https://wpcoder.pro/pricing/) adds:

- **Conditions:** show a snippet only on chosen posts, pages, post types and archives, for chosen user roles, devices, browsers and languages, or on a schedule.
- **More attribute types:** rich text, toggle, select, repeater, gradient, post and term pickers, icons and an image with preload, with labels, help text and live preview in the block.
- **QuickCode and Loop Logic:** live site data such as `{{post.title}}` or `{{user.name}}`, and `<If>` / `<Loop>` blocks in snippet HTML.
- **Snippet management:** revision history, Search & Replace across all snippets, filters by status and mode, and an edit lock.
- **Faster pages:** combined CSS/JS files, jQuery only when needed, dequeue unused files.
- **More tools:** WP Coder Debug Bar, Test Users, Plugin Switcher, Cron viewer, page templates, menus and sidebars, Maintenance Mode, Global Variables, icon library and an AI Assistant.

WP Coder simplifies your WordPress development workflow and makes customization safe, fast, and flexible!

Get started today and simplify your WordPress development workflow with **WP Coder**!

### Quick Start Video
https://youtu.be/BgY3R8j1uWM

### Plugin Demo:
https://youtu.be/YF4X7sU0iFY?si=327VZduhqu_mh5-N

= Support =
Need help? Ask questions and get quick answers in our [support center](https://wordpress.org/support/plugin/wp-coder).

== Installation ==

### 📌 Option 1: Install via WordPress Admin
1. Go to **`Plugins` → `Add New`** in your WordPress admin panel.
2. Search for **"WP Coder"** and click **Install Now**.
3. Click **Activate** after installation.

### 📌 Option 2: Install Manually
1. **Download** the WP Coder plugin ZIP file from [WordPress.org](https://wordpress.org/plugins/wp-coder/).
2. In WordPress admin, go to **`Plugins` → `Add New`** → **Upload Plugin**.
3. Click **Choose File**, select the downloaded ZIP file, then click **Install Now**.
4. After installation, click **Activate**.

### 📌 Option 3: Install via FTP
1. **Download and unzip** the WP Coder plugin ZIP file.
2. Upload the extracted **`wp-coder`** folder to `/wp-content/plugins/` via FTP.
3. Go to **`Plugins`** in WordPress admin and click **Activate**.

### 🚀 Getting Started
1. Open **WP Coder** in your WordPress admin menu.
2. Click **Add New** to create your first snippet.
3. Add your HTML, CSS, JavaScript or PHP.
4. Choose how it appears: copy the shortcode, insert the **WP Coder** block, or set **Display: Everywhere** on the Conditions tab.
5. Click **Save** (or press `Ctrl/Cmd+S`).


== Frequently Asked Questions ==

= Does WP Coder support Network activation? =

Currently, WP Coder doesn't support network-wide activation. If you're using WordPress Multisite, activate the plugin individually on each site within your network.

= Where can I find detailed documentation? =

Visit our comprehensive [official documentation](https://wpcoder.pro/category/documentation/) for detailed guides and step-by-step instructions.

= How can I use shortcode content in HTML code? =

If you include content within the shortcode like `[wp_code id="1"]Some Text[/wp_code]`, you can insert this content into your HTML snippet using the variable `{{$shortcode_content}}`.

= Can I use shortcodes from other plugins within WP Coder snippets? =

Absolutely! WP Coder allows you to embed shortcodes from any plugin within your HTML snippet content. You can also use WP Coder’s own shortcodes, offering enhanced flexibility for customization.

= How do I add Google Analytics (or any script) to every page? =

Create a snippet, paste the code into the HTML tab and on the Conditions tab set **Display** to **Everywhere** and choose the **Location**: **In &lt;head&gt;** for analytics, Tag Manager and verification meta tags, or **Before &lt;/body&gt;** for chat widgets and other scripts. The **Integrations** tab under Tools also has ready fields for Google Analytics, Tag Manager, Facebook and Pinterest pixels and AdSense.

= My site broke after adding PHP code. What can I do? =

A PHP error inside a snippet is caught and logged, so the page keeps working. If Global PHP or a snippet whose PHP runs in the admin still locks you out, add `?wpcoder-safe-mode=1` to the admin URL: that PHP is skipped while you are in Safe Mode, so you can open the snippet and fix or deactivate it. Safe Mode works for administrators only — signed out, the login screen keeps the parameter for after you sign in. If even the login screen fails, add `define( 'WPCODER_SAFE_MODE', true );` to wp-config.php, and remove it once the snippet is fixed.

= How do attributes work? =

On the **Attributes** tab, add a name (for example `button_text`), a type and a default value. Use it in your code as `{{button_text}}`, then set a value per shortcode — `[wp_code id="1" button_text="Buy now"]` — or in the block's sidebar, where each attribute gets a matching field.

= How do tags work? =

Add one or more tags to a snippet, separated by commas. In the list each tag is a filter link, and you can export all snippets with a given tag. Pin the snippets you use most to keep them at the top.

= How do I use the link feature? =

The link field helps you track where your shortcode is placed. Enter the URL of the page where the snippet is used, and open it from the snippet with one click.

= What is the difference between WP Coder and WP Coder Pro? =

WP Coder is complete for adding code by shortcode, block or site-wide. [WP Coder Pro](https://wpcoder.pro/pricing/) adds conditions (show a snippet only on chosen pages, to chosen users, devices or on a schedule), more attribute types such as repeaters and rich text, QuickCode, revisions, Search & Replace and more tools.

= Will my snippets survive the switch to Pro? =

Yes. Both versions use the same data, so your snippets, settings, tags and attributes carry over when you activate WP Coder Pro — and back again.



== Screenshots ==
1. All Codes – tags, pinned snippets, shortcodes and status at a glance.
2. Conditions – show a snippet by shortcode or block, or everywhere, and choose its Location on the page.
3. Attributes – define fields once and use them in your code as {{name}}.
4. WP Coder block – attribute fields and live preview in the block editor.
5. CSS tab – syntax highlighting, inline or file output and minification.
6. PHP tab – run PHP where the snippet is placed, in admin, on the front end or everywhere.
7. Snippets – 82 ready-made tweaks in 8 groups with instant search.
8. Tools – Google Analytics, Tag Manager, pixels and AdSense integrations.
9. Global PHP – site-wide PHP in one place.
10. Import / Export – move snippets between sites.

== Changelog ==

= 5.0 =
* Added: Snippets – the full set from WP Coder Pro, now 82 snippets in 8 groups, with a new Security group and instant search across all of them. Your existing snippet settings are kept; the few renamed options are migrated automatically.
* Added: Code editor – code folding, highlighting of matching words, Ctrl/Cmd+S to save, find & replace, select next occurrence, go to line, full screen (F11), a shortcuts reference, and a warning before leaving with unsaved code.
* Added: Display Everywhere – a snippet can now be added to every page automatically, without a shortcode, at the Location you choose: in <head>, after <body> opens, before or after the post content, or before </body>. Ideal for analytics, verification meta tags and site-wide scripts. Existing snippets stay shortcode-only until you change this on the Conditions tab.
* Added: Attributes – define values each shortcode or block fills in, used in the code as {{name}}. Types: text, textarea, number, range, URL, image, color and date; the block shows a matching field for each. An image attribute also gives {{name_url}}, {{name_alt}}, {{name_srcset}}, {{name_html}} and more. Attributes from WP Coder Pro keep working.
* Added: Several tags per snippet – separate them with a comma; each tag in the list is its own filter link, and export by tag includes every snippet carrying it. Existing tags are kept.
* Added: Pin snippets – keep the ones you return to at the top of the list, with a pin icon on each row and Pin/Unpin bulk actions.
* Added: Snippet note – a private note under the Link field of the snippet editor, shown under the title in All Codes; it is never printed on the site.
* Added: Snippets & Tools settings export / import – on the Import / Export page, download which Snippets and Tools items are switched on, with their options, and import the file on another site. It replaces those settings on the receiving site; files move between WP Coder and WP Coder Pro.
* Added: Descriptions of WP Coder Pro features on the Attributes and Conditions tabs and on the Tools page.
* Improved: Conditions tab – Display (Shortcode or block only / Everywhere) is now set here, in the same place as in WP Coder Pro, with Pro's page rules listed greyed out in the same menu. Location moved there too, right under Display, and appears when Display is Everywhere.
* Improved: Admin interface restyled to match WP Coder Pro.
* Improved: "Disable Gutenberg Editor" can keep the block editor on chosen post IDs; "Disable REST API" can apply to logged-out visitors only.
* Improved: "Redirect 404 to Homepage" now uses a temporary (302) redirect, so a page published at that URL later still works.
* Improved: Activating WP Coder deactivates WP Coder Pro wherever it is installed, and a notice says so; your snippets and settings, Pro's included, are kept for when Pro is active again.
* Improved: A `<?php` pasted at the start of Global PHP or of a snippet's PHP code is removed on save – the file already starts with it, and a second one stopped all of the code from running.
* Changed: Security – PHP code is checked before it runs, as in WP Coder Pro: a snippet's PHP, an included PHP snippet or Global PHP that calls eval(), exec(), system(), shell_exec(), passthru(), popen(), proc_open(), pcntl_exec(), assert(), create_function() or base64_decode(), or uses backticks, is not run. Its HTML still shows, and the block is written to the debug log (for Global PHP and included snippets, also shown as an admin notice). If your code uses one of these functions, it stops running after this update.
* Fixed: Security – Safe Mode (`?wpcoder-safe-mode=1`) now works for administrators only. Any visitor could add it to a URL and switch off Global PHP and included PHP snippets for their own request. If even the login screen fails, add `define( 'WPCODER_SAFE_MODE', true );` to wp-config.php instead, and remove it once the snippet is fixed.
* Fixed: Safe Mode now also skips the PHP code of snippets shown on the page, so a broken snippet can no longer take down the page you open to fix it.
* Fixed: What a snippet's PHP code prints now appears where the shortcode or block stands, not above the post content.
* Fixed: An attribute holding HTML (e.g. Rich text, from WP Coder Pro) used inside an HTML attribute of the snippet – title="{{name}}", alt="{{name}}" – no longer breaks the rest of the page in a block.
* Fixed: Editing a snippet created in WP Coder Pro (or imported from it) erased its attributes, display rules and conditions; they are now kept for when Pro is active again.
* Fixed: Shortcode and block attribute values are escaped when the post's author may not publish raw HTML (e.g. a Contributor), and a "]" in a block attribute no longer cuts the snippet short.
* Fixed: The WP Coder block preview in the editor now shows the snippet's CSS (the editor content is in an iframe, and the styles were added outside it).
* Fixed: The "title" and "id" values of a shortcode reached {{title}} / {{id}} unescaped when the post's author may not publish raw HTML.
* Fixed: Clearing a snippet's PHP code did not stop it – with "Run everywhere / admin / frontend" selected, the old code kept running on every request. Files left over from earlier saves are cleaned up on update.
* Fixed: "Inline" CSS broke child selectors (".card > .title" was written as "&gt;").
* Fixed: Deleting a snippet now also deletes its CSS, JS and PHP files.
* Fixed: A CSS or JS file recreated after the uploads folder was cleared ignored the Minify/Obfuscate setting.
* Fixed: SVG uploads are sanitized – scripts, event handlers and javascript: links are removed, and a file that is not valid SVG is rejected.
* Fixed: A PHP error in a snippet no longer breaks the whole page; the snippet's output is skipped and the error is logged.
* Fixed: A placeholder such as {{name}} that refers to an array no longer causes a fatal error on PHP 8.
* Fixed: HTML minification no longer joins words separated by a line break, and leaves <pre>, <textarea>, <script> and <style> untouched.
* Fixed: Minified and obfuscated JavaScript without trailing semicolons no longer breaks.
* Fixed: "Disable HTML in Comments" applied to every site, even with the snippet off.
* Fixed: "Limit Comment Length" counted bytes instead of characters, cutting non-Latin comments at half the limit.
* Fixed: "Duplicate Posts" lost backslashes in the copied content.
* Fixed: A JavaScript error on the Global PHP page.
* Fixed: A bulk action run right after clicking a row's ON/OFF toggle was applied to that one snippet instead of the ticked ones.

### Helpful Links ###
- [Website](https://wpcoder.pro)
- [Documentation](https://wpcoder.pro/category/documentation/)
- [Upgrade to Pro!](https://wpcoder.pro/)

= 4.5.2 =
* Fixed: Security – the WP Coder admin pages and all save handlers (Global PHP, snippets with PHP code, tools, import/export, debug log) are now restricted to administrators (`manage_options` together with `unfiltered_html`). Previously, users with the Editor role on single-site installs could save and execute arbitrary PHP. Thanks to Ayush Srivastava for responsibly reporting this issue.

= 4.5.1 =
* Fixed: Security – restricted the Gutenberg block REST endpoints (snippet preview and attributes) to logged-in users with the `edit_posts` capability, preventing unauthenticated access.

= 4.5 =
* Added: Lazy load option for images
* Added: Google Tag Manager integration in Tools & Integrations
* Fixed: Snippet **Open External Links in New Tab** now correctly identifies internal links

= 4.4 =
* Added: **Gutenberg block** – insert and manage WP Coder snippets directly inside the WordPress block editor with live preview.

= 4.3.1 =
* Fixed: includes css to Live preview

= 4.3 =
* Added: **Markdown Editor** in Tools for writing with Markdown syntax.
* Added: **Debug Tools** section in Tools, including:
  - Show Page Debug Info
  - Theme Switcher
  - Plugin Switcher
* Improved: Tools page layout – tools are now grouped into sections for easier navigation.

= 4.2 =
* Added: Debug Log page in WP Coder admin menu with options to enable/disable logging and clear log.
* Added: Admin bar indicator with link to Debug Log when entries are present.

= 4.1 =
* Added: Export snippets by tags
* Added: Export selected snippets
* Added: Option to use CSS files only in Live Preview without loading them on the site

= 4.0.3 =
* Added: duplicate button for each item
* Improved: Live Preview block behavior and rendering

= 4.0.2 =
* Improved: Reorganized method order in DBManager class for better readability and maintenance
* Improved: Minor SQL formatting for consistency
* Cleaned: Minor code style improvements according to WordPress Coding Standards (WPCS)

= 4.0.1 =
* Improved: Added `matchBrackets: true` option for the JavaScript editor to highlight matching brackets when editing code.

= 4.0 =
* Improved: Refreshed interface for better user experience.
* Added: "Open External Links in New Tab" snippet.
* Added: "Redirect 404 to Homepage" snippet.
* Added: "Limit Comment Length" snippet.
* Added: "Disable HTML in Comments" snippet.
* Added: "Disable Trackbacks & Pingbacks" snippet.
* Added: Live preview feature for HTML & CSS snippets.

= 3.6.1 =
* Fixed: Security issue in escaping within list files.

= 3.6 =
* Added: Custom locations for PHP snippet inclusion.
* Added: Option to hide tabs in settings.
* Fixed: Admin style compatibility for Safari browser.

= 3.5.2 =
* Fixed: Minor admin style improvements.
* Fixed: Various minor bugs.

= 3.5.1 =
* Changed: Adjusted user permissions to use the plugin.

= 3.5 =
* Added: "Tracking Code Manager" tool for easy integration of analytics pixels.
* Added: "Google AdSense" integration tool.
* Added: User roles support for "Disable WP Admin Bar" snippet.
* Improved: Updated back-link functionality.

= 3.4 =
* Added: Pre-set popular snippets page.

= 3.3 =
* Added: Button to insert images in HTML snippets.
* Added: HTML Minification tool.
* Improved: Enhanced CSS Minification tool.

= 3.2.1 =
* Fixed: Minor database issue.

= 3.2 =
* Added: "Add New" and "All Codes" buttons in editor.
* Fixed: Improved admin styling.

= 3.1.1 =
* Fixed: Database save issue.

= 3.1 =
* Added: Global PHP snippet feature.
* Added: Content handling inside shortcodes.
* Added: Copy shortcode button.
* Improved: More flexible file inclusion management.
* Changed: Shortcode updated to `[wp_code]`.

= 3.0.5 =
* Fixed: Minor update bug and admin notifications.

= 3.0.4 =
* Fixed: Updated datatable handling.

= 3.0.3 =
* Fixed: Inline scripts/styles management.

= 3.0.2 =
* Fixed: Execution order for scripts and styles.

= 3.0.1 =
* Fixed: Updating and saving snippets.
* Fixed: Admin capability adjustments.

= 3.0 =
* Added: Test Mode and snippet Status.
* Added: Tagging and Link options.
* Added: Inline and Minified options for CSS.
* Added: JavaScript optimization options.
* Added: Export/Import feature.
* Improved: Updated database and admin interface.

= 2.5.6 =
* Fixed: Minor bug in snippet list.

= 2.5.5 =
* Fixed: General minor fixes.

= 2.5.4 =
* Fixed: Security enhancements.

= 2.5.3 =
* Fixed: Additional security improvements.

= 2.5.2 =
* Fixed: Minor issues on main plugin page.

= 2.5.1 =
* Fixed: General minor fixes.

= 2.5 =
* Added: Alternative shortcode option.
* Added: Shortcode processing within HTML snippets.

= 2.4 =
* Fixed: Handling of `<textarea>` tags in HTML.
* Fixed: Shortcode functionality.

= 2.3.2 =
* Fixed: Snippet deletion and database saving issues.

= 2.3 =
* Fixed: Minor bug fixes.

= 2.2 =
* Fixed: Improved script/style loading order.

= 2.1 =
* Fixed: Database save issue resolved.

= 2.0 =
* Added: CodeMirror integration.
* Optimized: Improved file storage efficiency.
* Improved: Admin interface styling.

= 1.1 =
* Fixed: Shortcode display issue in content.

= 1.0 =
* Initial release.

== Upgrade Notice ==

= 5.0 =
Major update: refreshed interface, site-wide Display, attributes, multiple tags, pinning and 82 snippets. Your snippets and settings are migrated automatically. Please read the changelog: a few long-standing behaviours were fixed.
