Run custom code with a real safety net under it
Set up a snippet manager WordPress sites can run PHP, CSS, JS and HTML through safely: a fatal error auto-contains itself in Safe Mode instead of taking the site down, and every snippet's visibility is a real show-if/hide-if rule, not a hardcoded check.
- A fatal PHP error triggers Safe Mode instead of a white screen.
- CSS/JS can serve as real static files, with proper ETag caching.
- Show-if/hide-if conditions with real AND/OR logic groups.
- PHP execution is off by default — an explicit opt-in setting.
Snippet manager WordPress: what does the module actually do?
This is what a snippet manager WordPress sites get with TheOneWP: TOWP_Snippet_Manager manages HTML, CSS, JS and PHP snippets, each with its own scope, position and load method. PHP execution is off by default, runs through eval() only when explicitly enabled, and is wrapped in a shutdown handler that catches a true fatal error and puts the whole snippet system into Safe Mode — a flag file, not a database row, so it still works even if the crash left the database unreachable. CSS and JS can be served as real static files with proper HTTP caching, and every snippet's visibility can be governed by a real show-if/hide-if rule with AND/OR logic, not a fixed set of toggles.
Custom code usually has no safety net at all
Pasting a PHP snippet into functions.php and getting one character wrong is a classic way to lock yourself out of your own WordPress admin with a fatal error.
A crashed site with no recovery path is a real risk
Without a safeguard, a fatal error in custom code can mean FTP access is the only way back in — a serious barrier for anyone without direct server access.
Snippet visibility often ends up hardcoded into the snippet itself
Deciding where a piece of code should run frequently means writing conditional logic directly into the code, making it harder to adjust later without editing PHP.
Contained by design, not just written carefully
The module assumes a snippet will eventually fail and builds a real recovery path for exactly that moment.
A fatal error contains itself
Safe Mode halts snippet execution site-wide the moment a true fatal error is detected — not after the site is already down for good.
Visibility as a real rule, not hardcoded logic
Show-if/hide-if conditions with AND/OR groups mean where a snippet runs is adjustable without touching its code.
PHP execution is opt-in
The riskiest snippet type simply doesn't run at all until an administrator explicitly enables it.
The complete snippet manager WordPress feature set
Every capability below is present in the class's execution, output, or admin AJAX methods.
Flag-file Safe Mode
A true fatal error from a PHP snippet writes a flag file that halts all PHP snippet execution site-wide, with a visible admin bar warning, until manually cleared.
HTML, CSS, JS and PHP
Each with its own scope (frontend/backend/login/all), position, and — for PHP — hook, shortcode or secure-URL execution.
Real static-file serving for CSS/JS
Written to disk and served directly by the web server when possible, with ETag caching and 304 support — falling back to PHP-served only if the file is missing.
Show-if/hide-if conditions with AND/OR logic
Multiple filters, each with grouped conditions, evaluated as a genuine boolean expression — not a fixed list of checkboxes.
Colored, orderable categories
Group snippets visually, drag to reorder, drag snippets between categories, and mark one as the default.
Duplicate, bulk delete, export/import
Copy a snippet as a starting point, remove several at once, or move a set of snippets between sites.
Add a snippet manager WordPress snippet in four steps
PHP snippets specifically deserve a moment of caution before enabling them.
Write or generate the snippet
Paste code directly, or use AI Snippet Generator to write one with real site context already in mind.
Set scope, position and conditions
Decide where it runs and, if needed, build a show-if/hide-if rule instead of hardcoding logic into the code.
For PHP, confirm execution is enabled
It stays off until you explicitly turn it on — a deliberate pause before anything eval()s.
Enable it and watch for Safe Mode
If something goes wrong badly enough, Safe Mode disables it automatically — check the admin bar for the warning.
Where a snippet manager beats editing theme files
The module fits any custom code that doesn't belong in a theme's functions.php.
Small CSS and JS tweaks
A one-off style fix or a tracking snippet, scoped precisely and toggled without touching a theme file.
Custom PHP functionality
A hook-based customization that survives a theme update, with a real recovery path if it ever breaks.
On-demand or shortcode-triggered code
PHP that should run only when called, not on every page load — via a shortcode or a secure token URL.
Custom code that fails safely
Every design choice in the verified code favors a recoverable failure over a hidden one.
Static when it can be, cached properly either way
The verified implementation avoids a PHP round-trip for CSS/JS whenever it genuinely can.
Written to disk, served directly
A "save as file" CSS or JS snippet becomes a real static asset the web server handles on its own, bypassing WordPress for that request.
ETag and 304 support
An unchanged request gets a 304 Not Modified response instead of the full content resent every time.
CodeMirror loaded only where it's used
The snippet editor's assets enqueue only on this module's own admin screens.
Execution treated as a decision, not a default
Every layer between "code exists" and "code runs" is deliberate.
PHP execution off until explicitly enabled
execute_php() checks a dedicated setting before it will ever call eval(), regardless of what snippets exist.
manage_options required throughout
Creating, editing, enabling, or running any snippet requires this capability, alongside a verified nonce.
Non-fatal errors auto-disable just the one snippet
A caught exception disables that snippet and records the message and line, without needing a full Safe Mode event.
Fatal errors trigger a DB-independent safeguard
Safe Mode is signaled by a flag file specifically because it must work even if a crash left the database connection unusable.
Hooks into the exact points WordPress expects
The supplied code outputs through WordPress's own standard hooks rather than a custom injection point. No compatibility claim beyond the verified implementation is assumed.
wp_head, wp_footer, admin_head, admin_footer, login_head, login_footer
CSS and JS output through the same hooks any theme or plugin would use for the same purpose.
5 execution hooks
plugins_loaded, after_setup_theme, init, wp_loaded, and wp — the same hook set AI Snippet Generator writes into a generated snippet's configuration.
TOWP_Audit_Log
Every PHP execution — successful or failed — is recorded, alongside a rejected run when PHP execution is disabled entirely.
TheOneWP versus common alternatives
Compare a real snippet manager WordPress implementation with pasting code into functions.php or a typical dedicated snippets plugin.
| Capability | TheOneWP Snippet Manager | Other common solutions |
|---|---|---|
| Fatal error recovery | Flag-file Safe Mode, works even without database access | functions.php offers no recovery at all |
| Snippet targeting | Real AND/OR show-if/hide-if rule engine | Often a flat list of toggles, or hardcoded logic |
| CSS/JS delivery | Real static files with ETag caching when possible | Usually always served through PHP |
| PHP execution default | Off until explicitly enabled | Varies; some tools run PHP by default |
| On-demand execution | Shortcode or secure URL, in addition to hooks | Usually hook-triggered only |
| Administration | One TheOneWP screen, submenu or standalone | May require a separate plugin and its own settings |
Run custom code without gambling on it
A few habits keep the safety net doing its job.
Test a new PHP snippet on staging first
Safe Mode is a recovery mechanism, not a reason to skip testing before it's needed.
Use conditions instead of hardcoded checks
The show-if/hide-if system exists specifically so targeting stays adjustable without touching code.
Check the admin bar after enabling something new
The Safe Mode warning icon is the fastest way to know something went wrong.
Use categories to keep a growing snippet list organized
Colored, ordered categories make a dozen-plus snippets far easier to manage than one flat list.
Avoid assumptions the code does not support
The module has a defined, verified scope — a few assumptions outside it cause confusion.
Expecting a PHP snippet to run without enabling execution first
It fails silently by design — check the allow_php_execution setting if a PHP snippet never seems to fire.
Assuming Safe Mode turns itself back off
It stays on until an administrator explicitly disables it — a deliberate pause, not a self-clearing state.
Expecting "save as file" to work with no configuration at all
It requires the uploads folder to actually be writable — if it isn't, the snippet still works, just served through PHP instead.
Snippet Manager FAQ
These answers come directly from the verified class and its execution logic.
What happens if a PHP snippet has a fatal error?
A shutdown handler registered before every execution catches it and writes a flag file — not a database row, so it works even if the fatal error left the database connection unusable — which puts the entire snippet system into Safe Mode, halting all PHP snippet execution site-wide until an administrator turns it back off.
Does one broken snippet take the whole site down?
Not for long. The faulty snippet is automatically disabled and its error message recorded, and if the error was severe enough to be fatal, Safe Mode stops every other PHP snippet from running too until you've had a chance to look at it.
Is PHP execution enabled by default?
No. execute_php() checks an explicit allow_php_execution setting before ever calling eval() — PHP snippets are opt-in, not on by default.
How does a CSS or JS snippet actually get delivered to the browser?
If "save as file" is enabled, it's written to a real static file in the uploads folder and served directly by the web server — with proper ETag caching and a 304 response for unchanged requests — bypassing WordPress entirely for that request. If the file is missing, it falls back to being served through PHP instead.
What are the actual rules a snippet's visibility can depend on?
A real show-if/hide-if filter engine with AND/OR logic groups — not just a flat list of toggles. Multiple filters can each require a different combination of conditions to be true, evaluated as a genuine boolean expression rather than a fixed set of checkboxes.
Which hooks can a PHP snippet run on?
Five: plugins_loaded, after_setup_theme, init, wp_loaded, or wp — chosen per snippet, matching the same hook-timing options the AI Snippet Generator module writes into a generated snippet's configuration.
Can a PHP snippet be triggered manually instead of running automatically?
Yes, two ways: as a WordPress shortcode you place in content, or through a secure token URL that runs it on demand — alongside the default of running automatically on its configured hook.
Can I tell which HTML on a page came from a snippet?
Yes. Every HTML snippet's output is wrapped in an identifying comment showing its ID, visible in the page source — useful for tracing exactly which snippet produced a given block of markup.
Stop risking a white screen.Run custom code with a real way back.
Use a snippet manager WordPress sites can experiment with confidently: Safe Mode containment, real conditional targeting, and PHP execution that's opt-in by design.