Your site needs a feature that is not offered by WordPress, your theme or a specific extension. The question then becomes how do you modify the code of WordPress, a theme or an extension?

This kind of modification is not a simple task and should be carried out by an experienced web developer.

Your business is unique and has different needs, so it’s normal and expected to adapt the site to your needs, but it’s important to do it in the right way so as not to affect the cyber-resilience of your site.

Cyber resilience is the acceptance of future threats and the preparation to respond to them. It enables a company to respond quickly and effectively to a cyber attack, minimizing potential damage. It also ensures the continuity of business operations, even in the event of a security breach, protecting the company’s reputation and the trust of customers.

Before modifying code produced by another developer (or company), be sure to read on, as the impact could be great!

My developer needs to modify the WordPress code

Recently, a customer contacted us to ask us to warn them before updating their site via their maintenance package linked to their WordPress site.

Surprised by this request, we asked, “Why do you need to be warned?”.

Their response: “Our developer directly modifies the code of WordPress and the Gravity Forms extension to add a feature we need. The problem we run into is that when we update, we lose all the changes we’ve made”.

To be very clear about this kind of practice, here’s a warning:

Can I modify code developed by a third party?

The answer is simple, direct and to the point: NO!

But why?

Modifying the code of WordPress, or any theme or extension, can have serious and unforeseen consequences. First of all, every change you make can potentially introduce new security vulnerabilities into your site.

Then, every time WordPress, your theme or an extension is updated, there’s a risk that your changes will be overwritten and lost. The principle of updating is as follows: the update replaces the old files with the new ones. If any changes have been made to the code, they will be lost.

Finally, modifying code without a thorough understanding of its function can lead to errors and problems on your site. So before you embark on any code modifications, think about the alternatives and possible repercussions.

Is it possible to change the default behavior?

Generally speaking, the answer is YES.

Good news!

WordPress has ahook mechanism that lets you interact with the code without directly modifying it. It’s a safer, less risky way to customize your site.

Hooks are specific points in the code to which you can “hook” your own code to influence the site’s behavior.

There are two types of hooks: action hook s and filter hooks. Action hooks allow you to execute code at a specific point in time, while filter hooks allow you to modify a value before it is returned.

For example, if you want to add your own functionality to a theme or extension, you can use hooks to do so without modifying their source code. This also prevents incompatibility in future updates.

Note that it’s also possible to create custom hooks in your own code!

What if there are no hooks at the desired location?

You’ve identified a specific place to add code in WordPress, a theme or an extension, but no hook is available? It can be done.

In such a case, contact the developer to request the addition of a hook. There’s no guarantee that your request will be taken into account, but it’s worth a try. If your request is accepted, your code can be integrated into a future update, so you can continue to benefit from updates without losing your changes.

If your request is refused, you’ll have to reconsider your options and perhaps find another way of implementing your feature. This can involve replacing the solution (e.g. changing the extension) or creating your own extension to manage everything.

Conclusion

In short, modifying WordPress code, a theme or an extension developed by a third party is strongly discouraged. This can have a detrimental effect on your site’s cyber-resilience, and may even compromise its security.

With personal data protection laws (e.g. Bill 25 in Quebec or RGPD in Europe), adding risk should be taken very seriously before making a change that will prevent you from receiving updates.