<!-- skill: WordPress Site | version: 1.0.0 | description: Build WordPress sites — install, themes, plugins, child themes, launch | category: Web -->

## Instructions
- Stack: PHP 8+, MySQL/MariaDB, web server (Apache/Nginx). On the Pi, Apache + MariaDB via apt is the easy path.
- Install: download latest zip → `wp-config.php` (unique salts!) → famous 5-minute install. Delete `readme.html`, rename default admin, limit login attempts.
- Child theme for ALL custom CSS/PHP — never edit the parent theme or updates wipe your work.
- Plugins: minimum viable set (backup, security, caching, SEO). Each plugin is attack surface + speed cost — audit yearly.
- Backups before every change (files + database dump). Test restores, not just backups.
- Go-live: permalinks on, HTTPS (certbot), caching plugin, submit sitemap.

## Examples
- Portfolio: theme + child theme tweaks + gallery plugin + contact form.
- Small shop: WooCommerce + payment gateway sandbox first, then live keys.

## Workflows
1. Server + DB + PHP installed; create DB + user.
2. WordPress install, admin hardening, permalink structure.
3. Theme + child theme; build pages (Home, About, Contact minimum).
4. Plugins (backup/security/cache/SEO), configure each, test.
5. Backups verified → SSL → launch → uptime check.

## Templates
```php
<?php
// child-theme/functions.php — enqueue parent + child styles correctly
add_action('wp_enqueue_scripts', function () {
    wp_enqueue_style('parent-style', get_template_directory_uri() . '/style.css');
    wp_enqueue_style('child-style', get_stylesheet_uri(), ['parent-style']);
});
```
```bash
# backup — files + database in one go
tar -czf site-$(date +%F).tar.gz /var/www/html --exclude=wp-content/cache
mysqldump -u wpuser -p wordpress > db-$(date +%F).sql
```

## Tools
- SARAH `shell_run` for installs/dumps; `file_write` for child-theme PHP/CSS.
- `sudo apt install apache2 mariadb-server php php-mysql` on the Pi.

## Advanced
- Hardening checklist: delete `readme.html` + `wp-config-sample.php`, block `xmlrpc.php` (unless Jetpack needs it), enforce 2FA for admins, `DISALLOW_FILE_EDIT`, limit login attempts, change the table prefix on fresh installs.
- Speed: page cache (object cache with Redis if traffic warrants), image WebP + lazy-load, minimal plugin count, database `wp_options` autoload audit yearly.
- Staging: duplicate to subdomain for risky updates (core/major plugin), test, push live. WP-CLI for everything scriptable (`wp plugin update --all`, `wp db export`, `wp search-replace` for domain moves).
- White-screen protocol: enable `WP_DEBUG` + debug.log → read the fatal → bisect plugins (rename `plugins/` folders one by one) → theme to Twenty-* → restore backup if stuck.
- SEO foundations: one H1 per page, meta via SEO plugin, XML sitemap submitted, 301s for every moved URL, Search Console from day one.

## Documentation
- WP docs: https://wordpress.org/documentation
- Child themes: https://developer.wordpress.org/themes/advanced-topics/child-themes