Hooks

When

Functions

How

Core

What

WordPress Functions

Everyone uses them. Few understand them architecturally. Functions are the entry points — they call the engine, and the engine fires the hooks.

Core Functions The procedural API
Template Functions echo vs return
Pluggable Functions Override the core

The WordPress Execution Chain

Core

wp_insert_post()

Point of entry — triggers the chain

↓

internally calls

↓

Hook (Action)

do_action(‘save_post’)

Extension point — broadcasts to callbacks

↓

fires

↓

your_callback()
cache_clear()
send_notification()
sync_api()

Functions are points of entry. Hooks are points of extension. One call ripples through the entire system.

Core Functions

The Procedural API

WordPress core functions are the entry points into the system. They handle data, HTTP, and media — and many of them fire hooks internally.

Creates a new post or updates an existing one. Internally triggers save_post, wp_insert_post, and several other hooks — making it a prime example of how Functions call Hooks.

Plaintext 
$post_id = wp_insert_post([
    'post_title'   => 'My New Post',
    'post_content' => 'Hello World',
    'post_status'  => 'publish',
    'post_type'    => 'post',
]);
// Internally fires: do_action('save_post', $post_id, $post, $update)

wp_insert_post( array $postarr, bool $wp_error = false, bool $fire_after_hooks = true ): int|WP_Error — Docs

Retrieves a metadata field for a post from the database. One of the most called functions in WordPress — the backbone of custom fields and meta boxes.

Plaintext 
// Get a single meta value
$price = get_post_meta( $post_id, '_price', true );

// Get all meta values for a key
$all_colors = get_post_meta( $post_id, '_color', false );

Docs

Uses the WordPress HTTP API to perform a GET request. Abstracts cURL, fsockopen, and streams — always prefer this over raw cURL in WordPress.

Plaintext 
$response = wp_remote_get( 'https://api.example.com/data' );
if ( is_wp_error( $response ) ) { /* Handle error */ }
$body = wp_remote_retrieve_body( $response );
$data = json_decode( $body, true );

Docs

Registers and enqueues a script file in a way that WordPress manages dependencies and prevents duplicates. Always use this instead of raw <script> tags.

Plaintext 
add_action( 'wp_enqueue_scripts', function() {
    wp_enqueue_script( 'my-script', get_template_directory_uri() . '/js/main.js', [ 'jquery' ], '1.0.0', true );
});

Docs

Template Functions

echo vs return

Every template function has two versions. Knowing when to use which one is fundamental to clean WordPress code.

ECHO — outputs HTML

the_title()

Echoes directly to HTML output

Php 
// use in templates
<h1><?php the_title(); ?></h1>

RETURN — returns string

get_the_title()

Returns the string for use in PHP

Plaintext 
// use in logic
$val = get_the_title();
if ( strlen( $val ) > 60 ) { // truncate... }

Echo side: the_content() — Echoes processed post content. Return side: get_the_content() — Returns raw content without filters.

the_excerpt() echoes the auto-generated excerpt. get_the_excerpt() returns excerpt string.

the_permalink() echoes the post URL. get_permalink() returns the URL for use in attributes.

Rule: Use the_*() for direct output. Use get_*() when you need to manipulate.

Pluggable Functions

Advanced: Override the Core

Defined in pluggable.php, these functions can be completely replaced by plugins — but only if your code loads before WordPress does.

Javascript 
if ( ! function_exists( 'wp_mail' ) ) {
    function wp_mail( $to, $subject, $message, ... ) {
        // Your replacement runs instead of core
    }
}

The WordPress email sending function. Plugins can completely replace it — enabling custom mailers like SendGrid or Mailgun. Must be replaced before pluggable.php is loaded.

Official Docs

Handles user authentication. Being pluggable means you can swap out the entire logic — useful for SSO, LDAP, or 2FA. Replacing this incorrectly can lock everyone out.

Official Docs

Sets the WordPress authentication cookies. Can be replaced for custom session handling, JWT tokens, or single sign-on. Replacing can break logout and nonce validation.

Official Docs

Pitfalls

Functions to Avoid

These functions exist in WordPress but are widely misused. Understanding why they’re dangerous makes you a better developer.

Resets and duplicates the main query, causing pagination breaks, double queries, and template hierarchy issues.

Instead: Use WP_Query or pre_get_posts hook instead.

Plaintext 
// ❌ Never: query_posts( 'posts_per_page=5' );
// ✅ Do: add_action( 'pre_get_posts', function( $query ) {
//     if ( $query->is_main_query() && ! is_admin() ) {
//         $query->set( 'posts_per_page', 5 );
//     }
// });

Imports array keys as variables into the current scope — a security nightmare if the array contains user input.

Instead: Access array values explicitly: $var = $array[‘key’].

Often confused with wp_reset_postdata(). Using the wrong one breaks The Loop and the global $post object.

Instead: After a custom WP_Query loop, use wp_reset_postdata(), not wp_reset_query().

What’s next?

Now explore Hooks & Core

You’ve seen how Functions trigger the chain. Next: the hooks that extend it, and the engine underneath.

Explore Hooks →
Explore Core →