1. No “cowboy coding”

All code and design changes are carried out on a testing server first before implementing on a live website. CSS to be clearly marked up with commented sections and table of contents.

1. Use the client’s staging server.
2. If the client does not have a staging server, clone the client’s website on the PENNInk Productions VPS as a transferrable install.
3. If the site is too large to clone, use the PENNInk Productions VPS to create a transferable install, then just drop in client’s theme and plugins to test.

2. Themes

List of Approved Themes

All website themes must be Genesis child themes or Dynamik skins.

• Genesis
• Genesis Dynamik Website Builder
• Themedy
• ZigZagPress

3. Plugins

List of Approved Plugins*

Please seek approval before adding a plugin that is not on this list. (*We will add to and grow this list.)

Never modify a plugin directly. Use functions.php in the theme or create a custom plugin. 

• Ad Code Manager
• Advanced Code Editor
• Advanced Custom Fields
• Akismet
• All in One SEO Pack Pro (premium plugin)
• Anti-Spam by CleanTalk
• bbPress
• bbPress Genesis Extend
• Backup Buddy (premium plugin)
• Beaver Builder Standard (premium plugin)
• Beaver Lodge Modules (premium plugin)
• Better Font Awesome
• Blogger 301 Redirect
• Blogger Importer Extended
• Blogger to WordPress
• Bulk Creator
• Bulk Move
• Calls to Action
• Click to Tweet
• Comments Evolved for WordPress
• Co-Authors Plus
• Cookie Consent
• Cookies for Comments
• CoSchedule by Todaymade
• Display Widgets
• Disqus Conditional Load
• Duplicate/Clone Pages and Posts
• Duplicate Menu
• Duplicate Widget
• Easy Custom Fields
• Easy Forms for MailChimp by YIKES
• Easy Smooth Scroll Links
• Edit Flow
• Embedly
• Enhanced Text Widget
• Events Manager
• Events Manager Pro (premium plugin)
• Frontend Uploader
• Genesis 404
• Genesis Connect for WooCommerce
• Genesis Dambuster
• Genesis Extender (premium plugin)
• Genesis Favicon Uploader
• Genesis Featured Page Advanced
• Genesis Featured Widget Amplified
• Genesis Footer Builder
• Genesis Grid
• Genesis Latest Tweets
• Genesis Print Style Plus
• Genesis Responsive Slider
• Genesis Sandbox Featured Content Widget
• Genesis Simple Hooks
• Genesis Widgetized Footer
• Gravity Forms (premium plugin)
• Gravity Forms No CAPTCHA reCAPTCHA
• Gravity Perks (premium plugin)
• HTML Editor Syntax Highlighter
• Icegram
• iiRE Social Icons
• Image Widget
• iQ Block Country
• iThemes Security
• Jetpack by WordPress.com
• LayerSlider
• Lazy Load
• Link Manager
• List Category Posts
• Login/Logout Menu
• MailChimp for WordPress
• MCE Table Buttons
• Multiple Featured Images
• Nav Menu Roles
• NextGen Gallery
• NextGen Plus (displays only, premium plugin)
• NextGen Pro (displays and ecommerce, premium plugin)
• Page Links To
• Page-list
• Paid Memberships Pro
• Paid Memberships Pro - bbPress Add On
• Portfolio Post Type
• Pre-Publish Post Checklist
• Redirection
• Remove query strings from static resources
• Safe Redirect Manager
• SeedProd Coming Soon Pro (premium plugin)
• Simple Footnotes
• Simple Page Ordering
• Simple Social Icons
• Slick Sitemap
• SlickNav Mobile Menu
• SSL Insecure Content Fixer
• Sucuri Security
• SumoMe
• Super Socializer
• Swifty Bar
• Table of Contents Plus
• Testimonials Widget Premium (premium plugin)
• Theme Check
• TinyMCE Advanced
• TrackDuck Visual Feedback
• Tracking Code Manager
• Twitter's Bootstrap Shortcodes Ultimate
• Twitter Widget Pro
• Video User Manuals (premium plugin)
• W3 Total Cache
• White Label CMS
• Widgetkit
• WP Google Analytics
• WP Help
• WooCommerce
• WooCommerce Customizer
• WooCommerce Product Carousel Slider
• WordFence Security
• WordPress SEO
• WP Fastest Cache
• WP Google Maps
• WP Google Maps Pro (premium plugin)
• WP Mobile Detect
• WP Rollback
• WP Security Audit Log
• WP Smush
• WP User Manager
• WPML (premium plugin)
• YouTube Advanced Embed
• Zoninator

4. Custom Coding

We adhere to WordPress best practices broadly defined in the WordPress Codex:

• Working with WordPress
• Developer Documentation

Additionally:

• All code should be compatible with the latest version of WordPress.
• Follow the WordPress Coding Standards.
• Data must be validated and sanitised on input and escaped on output.
• Avoid direct calls to PHP scripts in your theme and do not try to load the WordPress environment on your own.
• Ensure code will be both backward-compatible and future-proof using the WordPress Core APIs.
• Encapsulate all code within a theme and plugins
  • Do not scatter scripts or other assets in other locations.
• Use standard WordPress theme development practices.
  • Avoid overriding the native theming engine with a third party engine (e.g. Mustache or Smarty) or an unusual framework.
• Avoid modifying the server side page rendering based on visitor or other one-off properties for unauthenticated visitors.
  • Imperative in environments with page caching enabled.
• Avoid interacting with cookies on the server side.
  • Client side interaction (JavaScript) is fine.
• Avoid direct interaction with database tables (SQL queries).
  • Strongly avoid scripts that alter the database structure by, for example, adding or altering database fields, and creating new tables.
• Clean up after yourself.
  • Remove unused files and directories and any unused code fragments or debugging comments.
• Adhere to a consistent coding style.

Under no circumstances should you ever edit WordPress core files or plugin files directly.

If you need to modify a plugin, hook from the theme’s functions.php or create a custom plugin.

5. Database

Avoid direct interaction with database tables (SQL queries)

• In reality, 9 out of 10 times, the same result can be accomplished by using an official WordPress function or API, which often include sophisticated caching while ensuring forwards compatibility.

Strongly avoid scripts that alter the database structure

• These include, for example, adding or altering database fields, and creating new tables.
• In most cases, WordPress’s sophisticated custom post types, taxonomies, options, and meta data API’s can accomplish the same result with superior security and performance (especially in cache-enabled environments).
• Scripts that alter the database structure require significantly more time to audit, review, and test.

Database manipulation functions

• In the event that database interaction is truly essential, WordPress provides a class of functions for all database manipulations.
• The class is called wpdb and is loosely based on the ezSQL class written and maintained by Justin Vincent.
• Learn more about the $wpdb object in the class reference.

6. Validation and Sanitisation

Input Validation

To validate is to ensure the data you’ve requested of the user matches what they’ve submitted. There are several core methods you can use for input validation; usage obviously depends on the type of fields you’d like to validate.

• More information: Validating: Checking User Input (WordPress Codex)

Escape Output

For security on the other end of the spectrum, we have escaping. To escape is to take the data you may already have and help secure it prior to rendering it for the end user.

• More information: Escaping: Securing Output (WordPress Codex)