Super coool.

Day off, and it's Halloween. I spent it playing with the WooCommerce product page on Purple. 🎃

Default blocks, a few lines of CSS, and a pinch of JS. Pick a color, and the whole page follows it.

shameemreza.com/customize-purp…

This is the default WooCommerce Product Collection block on the Purple theme, with its own settings and a few lines of CSS. No JS at all.

When a post in your feed reads perfectly polished, do you assume AI wrote it now?

I have 105 skills in Claude Code, and not one sets disable-model-invocation or user-invocable.

disable-model-invocation: true means only you can run it with /name. Claude won't load it on its own.

user-invocable: false is the reverse. Claude can still load it, but it's gone elease and bug-fix workflows belong in the first group.

In a Git test repo, I fetched a commit from a second clone without pulling it in, the way an editor's auto-fetch does. Then I ran git push --force-with-lease.

It went through. That commit was gone from the remote, and the output looked like any other successful push. That's the part that got me.

Add --force-if-includes and Git refuses the same push. If you ever force push, type both flags.

After a workshop, I try to use what I learned. A few days in, if the work around me still runs the old way, I'm back there too.

A Reddit thread said it well: the course isn't the problem, and neither is the person.

When training worked but nothing changed, what was the cause?

Most useful extension I've installed this year: Feedfence.

YouTube without Shorts. Facebook without Reels and Stories. X without the For you tab.

Free, no account, nothing to set up: chromewebstore.google.com/detail/feedfen…

Today the PHP project released security updates addressing two critical "PHP2Shell" vulnerabilities.

If your site is hosted on @wordpressdotcom, @WordPressVIP, @wpcloudofficial, @Pressable, @tumblr, or any Automattic infrastructure, you’re already protected.

Managing PHP yourself? Here’s what to do: automattic.com/2026/10/21/you…

New case study on our blog for @WooCommerce. We audited 43 extensions for #a11y. Teams at @automattic and @Fueled remediated and we published #Accessibility Conformance Reports. ~500 accessibility issues were resolved + now merchants have much more transparency when comparing plugins. equalizedigital.com/woocommerce-ex…

If the code is already on the user's site, it has to work. That's the trialware line for the WPORG plugins directory, Guideleine 5. My second video walks through it with real example: youtube.com/watch?v=ljNlc0…

Almost every week a plugin company messages me: "Can you help us? Our plugin got closed." When I look, it's nearly always trialware.

So my first YouTube video covers that and the 7 other mistakes I flag most in plugin review, each with the fix.

Watch it here: youtube.com/watch?v=uO5M7w…

My own views from reviewing for WordPress.org and the WooCommerce.com Marketplace. Nothing private, just public guidelines and patterns I keep seeing.

Shipped it. The HappyAccess update I started in React a few days ago is now live on WordPress.org: wordpress.org/plugins/happya…

More security, more features, and it does three jobs now: temporary access for support, login with an email code, and two-step login.

So happy with how it came out.

First time building a plugin admin in React. Revamping my HappyAccess plugin settings to give even more user-friendly options to generate access for your users or support people: wordpress.org/plugins/happya…

WooCommerce 11.6 (February 2027) will bump the minimum PHP requirement to 8.1. We'll start showing a dismissible admin notice to affected stores in WooCommerce 11.3.

Thanks to the @DevelopWoo community for giving us your thoughts and feedback.

developer.woocommerce.com/2026/09/29/php…

I keep seeing maintenance mode plugins in the review queue. Search "maintenance mode" on WordPress.org, and you'll get 1,300+ results, so a new one rarely gets found. Pick a problem that teaches you something instead. The skills you grow there are worth more than the listing.