Bootcamp

# ===== 0-30 min: install =====
# LocalWP for a one-click install (https://localwp.com)
# Or Docker:
docker run -d -p 8000:80 \
  -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=wp -e WORDPRESS_DB_PASSWORD=wp \
  -v ./wp-content:/var/www/html/wp-content wordpress:6
# (and a MariaDB container)

# Browse http://localhost:8000 -> set up admin user

# ===== 30-60 min: theme =====
# Use a block theme; clone Twenty Twenty-Four or scaffold one:
wp scaffold _s mytheme

# Edit theme.json for brand colours + fonts (see theme-json lesson).
# Customise templates/header.html, footer.html, index.html.

# ===== 60-120 min: custom post type =====
# wp-content/plugins/cpt-portfolio/cpt-portfolio.php
<?php
/*
Plugin Name: Portfolio CPT
*/
add_action('init', function () {
    register_post_type('portfolio', [
        'label' => 'Portfolio',
        'public' => true,
        'show_in_rest' => true,
        'has_archive' => true,
        'menu_icon' => 'dashicons-portfolio',
        'supports' => ['title', 'editor', 'thumbnail', 'excerpt', 'custom-fields'],
    ]);

    register_taxonomy('portfolio_tag', 'portfolio', [
        'label' => 'Tags',
        'public' => true,
        'show_in_rest' => true,
    ]);
});

# Activate via wp-admin -> Plugins.

# ===== 120-180 min: REST API =====
# Out of the box:
# GET /wp-json/wp/v2/portfolio
# GET /wp-json/wp/v2/portfolio/<id>
# POST requires auth (basic / cookie / JWT)

# Custom endpoint:
add_action('rest_api_init', function () {
    register_rest_route('myapp/v1', '/popular', [
        'methods' => 'GET',
        'callback' => function () {
            return get_posts(['post_type' => 'portfolio', 'meta_key' => 'views', 'orderby' => 'meta_value_num', 'order' => 'DESC', 'numberposts' => 5]);
        },
        'permission_callback' => '__return_true',
    ]);
});

# ===== 180-240 min: blocks =====
# Custom block in JS:
# wp-content/plugins/my-block/src/index.js
import { registerBlockType } from '@wordpress/blocks';
import { useBlockProps, RichText } from '@wordpress/block-editor';

registerBlockType('my-app/cta', {
  title: 'CTA',
  edit({ attributes, setAttributes }) {
    const blockProps = useBlockProps();
    return (
      <div {...blockProps}>
        <RichText
          tagName="p"
          value={attributes.text}
          onChange={(text) => setAttributes({ text })}
          placeholder="Call to action..."
        />
      </div>
    );
  },
  save({ attributes }) {
    return <div><RichText.Content tagName="p" value={attributes.text} /></div>;
  },
});

# Build with @wordpress/scripts: npm run build

# ===== 240-300 min: forms + email =====
# Install Contact Form 7 or Fluent Forms; configure.
# Or roll a custom block with a REST endpoint that emails via wp_mail().

# ===== 300-360 min: deploy =====
# Pick a host:
# - WP Engine, Kinsta, SiteGround (managed, fast)
# - Cloudways (managed, BYO server)
# - Self-host on a VPS with nginx + PHP-FPM + MariaDB

# Deploy:
# - Push wp-content/ via git or rsync
# - DB sync: wp db export prod.sql + import on target
# - Test https + redirects + permalinks

# ===== 360-420 min: hardening =====
# - Disable file edit in wp-config.php: define('DISALLOW_FILE_EDIT', true);
# - Limit login attempts (plugin: Limit Login Attempts Reloaded)
# - 2FA on admin
# - HTTPS + HSTS
# - Daily backups (UpdraftPlus / hosting backups)
# - Security plugin (Wordfence / Sucuri) tuned for false positives

# ===== Patterns =====
# - Block theme + theme.json for design
# - Plugins for behaviour; never edit core
# - WP-CLI for ops automation
# - Backups + staging environment

# ===== Pitfalls =====
# - Editing core files (lost on update)
# - Plugin sprawl (security + perf)
# - Default admin credentials in production
# - No staging environment for risky updates

// 30-day plan in the lesson body.