WordPress snippets you actually need, and how to add them safely

Some WordPress annoyances don’t deserve a whole plugin. The admin email screen that interrupts your login every six months. The inbox full of “Some plugins were automatically updated”. The one plugin you’d rather keep on the version that works. The SVG logo WordPress refuses to upload. Each one is fixed by a few lines of PHP. Here are those lines, tested, and the safe way to add them.

Why a snippet manager, and not functions.php

The classic advice is to paste code at the end of your theme’s functions.php. It works, but it comes with two problems. Update the theme and your code is gone (unless you made a child theme). And a single typo in that file takes the whole site down, admin included, so you end up fixing it over FTP.

A snippet manager keeps each piece of code on its own, with a name, stored in your database instead of your theme. Change themes, update everything, your snippets stay. And any of them can be switched off in one click. We use our own, Code Engine. functions.php is still the right place for code that truly belongs to a theme you built yourself.

How to add a snippet with Code Engine

1. Install Code Engine from the WordPress plugin directory. The free version is all you need for everything in this article.
2. Open Meow Apps → Code Engine and click Add.
3. Give it a name you’ll still understand in six months, and paste the code. You can leave out the opening <?php tag.
4. Keep the type on Global (All), the default. The front-only and admin-only types would miss these snippets: the login page and the background update jobs aren’t part of the admin, and the block editor uploads files through the REST API.
5. Save. A new snippet is active right away, so go check the thing it changes.

When a snippet goes wrong

Code Engine reads your PHP with a real parser before saving it. A missing semicolon or bracket is flagged in the editor, and the snippet won’t save until it’s fixed.

If a snippet still crashes while it loads (calling a function that doesn’t exist, or declaring one that already does), Code Engine notes which snippet it was. On the next page load, it switches that snippet off and tells you why on its dashboard. Your site comes back by itself, no FTP needed.

One honest limit: that safety net covers the moment the snippet loads. Most snippets, like the four below, hand a small function to WordPress that runs later (at login, after an update, during an upload), and an error in there happens outside the net. That’s why each snippet here was tested on a live site, and why it’s worth checking the result right after you save one of your own. If something misbehaves, flip the snippet’s toggle off in the Code Engine list.

Stop the administration email verification

Every six months, WordPress interrupts an administrator’s login with this screen, asking if the site’s admin email is still correct:

It arrived in WordPress 5.3 (the discussion is here), and the intent is good: that address receives the important notices, like auto-update reports and the recovery link WordPress sends when a fatal error takes the site down. But if you run several sites, or log in to client sites all day, it gets old fast.

To turn it off completely:

add_filter( 'admin_email_check_interval', '__return_zero' );

Prefer a gentler reminder? This one asks once a year instead. It takes effect after the next time you confirm the address.

add_filter( 'admin_email_check_interval', function () {
  return YEAR_IN_SECONDS;
} );

With the check off, nobody will remind you anymore, so take ten seconds now to make sure the address in Settings → General is one you actually read.

Only get auto-update emails when something fails

Since WordPress 5.5, any plugin or theme can update itself (that’s the Enable auto-updates link in the Plugins list). After each round, WordPress emails the site admin: “Some plugins were automatically updated”. On a site with many plugins, that’s a lot of emails saying everything is fine.

This snippet keeps the useful part. When every update worked, no email. When at least one failed, you get the usual email, with everything listed.

// Only send the auto-update email when something failed.
$only_failures = function ( $enabled, $update_results ) {
  foreach ( (array) $update_results as $update ) {
    if ( true !== $update->result ) {
      return $enabled;
    }
  }
  return false;
};
add_filter( 'auto_plugin_update_send_email', $only_failures, 10, 2 );
add_filter( 'auto_theme_update_send_email', $only_failures, 10, 2 );

Updates of WordPress itself send their own emails, through a separate filter (auto_core_update_send_email). This snippet leaves those alone.

A quiet inbox only makes sense if you can roll back. An update can succeed and still break something (a new version that doesn’t get along with another plugin), and that won’t send you an email. Make sure your site has a daily backup, or keep auto-updates off for the plugins your site can’t live without.

Keep one plugin on its current version

Sometimes one plugin should stay put. A premium plugin you decided not to renew, a version you know works while the new one has a bug, or a site you’re about to retire. There’s no need for a plugin to manage your plugins, this does it:

add_filter( 'site_transient_update_plugins', function ( $value ) {
  // The plugins to keep on their current version.
  $frozen = [ 'plugin-folder/plugin-file.php' ];
  if ( is_object( $value ) && ! empty( $value->response ) ) {
    foreach ( $frozen as $plugin ) {
      unset( $value->response[ $plugin ] );
    }
  }
  return $value;
} );

Replace plugin-folder/plugin-file.php with the plugin’s folder and main file. To find it, hover the plugin’s Deactivate link in the Plugins list: the link contains something like plugin=akismet%2Fakismet.php, and %2F is the slash, so that one is akismet/akismet.php. To freeze several, separate them with commas.

WordPress then stops offering updates for those plugins, and auto-updates skip them too, since both read the same list.

Keep in mind that updates are how security fixes reach you. A frozen plugin stays frozen even when a vulnerability is found in it, so treat this as temporary. Write down why you froze it (the snippet’s description in Code Engine is perfect for that) and check on it now and then.

Allow SVG uploads, for trusted users only

WordPress accepts JPEG, PNG, WebP and plenty more, but it refuses SVG. Many tutorials treat that as an oversight and hand you a snippet that opens SVG to everyone. Please don’t use those.

An SVG isn’t pixels, it’s code (XML). It can carry a <script> tag or an onload attribute, and that code runs when someone opens the file in a browser, on your domain. Open SVG uploads to everyone and any author, contributor or customer account can plant JavaScript on your site. That’s a stored XSS, and it’s exactly why WordPress says no. 😶

The safe version follows a rule WordPress already uses. HTML and JavaScript files can only be uploaded by users with the unfiltered_html capability, the users who can already put any code they like in a post. This snippet gives SVG the very same rule:

add_filter( 'upload_mimes', function ( $mimes, $user ) {
  // Same rule WordPress uses for HTML files: only users trusted with unfiltered HTML.
  $trusted = $user ? user_can( $user, 'unfiltered_html' ) : current_user_can( 'unfiltered_html' );
  if ( $trusted ) {
    $mimes['svg'] = 'image/svg+xml';
  }
  return $mimes;
}, 10, 2 );

On a regular site, that means Administrators and Editors. On a multisite network, only Super Admins. If your wp-config.php sets DISALLOW_UNFILTERED_HTML, nobody has it and SVG stays blocked. Everyone else keeps the normal list, so an SVG from their account is still refused. Note the type: image/svg+xml, not image/svg as some older tutorials say.

Two things stay true. The snippet doesn’t clean the files: an SVG downloaded from a random icon site can still hide a script, so only upload SVGs you made or trust. And WordPress still checks what’s inside each file, so an SVG the server doesn’t recognise as one is refused anyway.

If other people need to upload SVG, or you’d like every file cleaned on upload, use Safe SVG instead of this snippet. It sanitizes each SVG as it’s uploaded. Either way, it’s worth it for logos and icons: an SVG stays razor sharp at any size, on any screen, and is often lighter than the PNG it replaces.

Quick answers

Keep your snippets tidy

• One job per snippet. “Stop admin email check” beats “misc fixes” the day something breaks.
• Say why it exists in the description, especially for a plugin you froze.
• Toggle, don’t delete. When you wonder if a snippet causes a problem, switch it off first. Turning it back on takes a click.

And when you want more than little fixes, Code Engine goes much further: Callable snippets become functions your AI Engine chatbot or an AI agent can call, and Scheduled ones run once a day on their own. Have a look 🙂