11 October 2026

📌 Sunday night in Gourock, Altered State by TesseracT in the headphones, and a list of small jobs for the Bottega. One of them started as a question about a plugin and ended with the plugin gone. This is the note about that one.

is it still useful?

The Bottega's WordPress has been losing plugins since it moved to its own server. Every few weeks I open the list, pick one and ask the same question: is it still useful today? Most of the time the honest answer is "it does one small thing, and it brought friends".

Sunday's candidate was WP Post Author. It draws the box you see under an article - the photo of whoever published it, a couple of lines of bio, links to their profiles, a button to their other posts. Nobody in the collective ever asked for it to go away, and nobody will notice that it did, which is the point.

Before removing anything I wanted to know what the plugin was holding. So we went looking: its settings, its widgets, shortcodes pasted in old posts, custom tables, the extra fields it adds to every user profile.

The answer was almost embarrassing. No tables of its own. No widget in use. No shortcode in any of the posts. And across the 59 accounts of the blog, the profile fields it manages contained exactly one social link and one uploaded photo. Everybody else's face comes from Gravatar, and everybody else's links were never filled in.

A whole plugin, with its settings pages and its update cycle, to store two values.

what came with it

The plugin ships with the Freemius SDK inside. Freemius is a company that sells licensing, payments and "insights" to plugin developers, and its SDK is the piece that lets a free plugin phone home. You can see it without reading a line of code, because it registers its own scheduled job:

fs_data_sync_wp-post-author

That is a cron event, sitting in the Bottega's queue, whose name says what it is for. Next to it, in the options table, a handful of fs_* rows where the SDK keeps its state.

I have to be precise here, because this is the part where it is easy to say more than I know. I did not capture what that job sent, or whether it sent anything at all. I had saved the rows before deleting them, then tidied up the server and deleted the backup too, so I cannot even tell you what was in them. What I can say is narrower: a plugin whose job is to draw a box under an article had installed, on our server, the machinery to synchronise data with a third party, and had scheduled it to run.

For a site that had just replaced a third-party cookie banner with one of its own, that is reason enough.

delete is not uninstall

Removing the plugin took one command. Removing what it left behind took rather longer.

wp plugin delete removes the files and nothing else - the plugin's own cleanup routine does not run. What stayed in the database, after the folder was gone: 3 options of the plugin, 5 options of Freemius, 9 different keys scattered in the user metadata, and the cron event above, still scheduled, now pointing at code that no longer existed.

It was not the first time. Three weeks ago I removed a feed plugin that nobody remembered installing, and it had left 13 options behind, with names like these:

feedzy_usage
feedzy_log_stats
feedzy_rss_feeds_crash_data

And the cron queue still had events from plugins removed months ago - a security scanner, a statistics plugin, the feed one. A WordPress that has lived for years is a house where every tenant left a box in the attic.

So the order matters. First find out what the plugin wrote and where. Then copy the values you want to keep (two, in this case). Then delete the plugin. Then delete the rows, one family at a time, checking that a prefix like fs_ is not shared with something still alive - one of those rows belonged to another plugin, and it stayed.

a box is a box

The replacement is one PHP file in mu-plugins, about 13 KB. It hooks the article content, and on single posts it appends the box:

add_filter('the_content', function ($contenuto) {
    if (!is_singular(bottega_autore_tipi()) || !in_the_loop() || !is_main_query()) return $contenuto;
    if (is_feed() || doing_filter('get_the_excerpt') || post_password_required()) return $contenuto;
    // Preview mode: while WP Post Author is still active, only administrators see this box,
    // so the two can be compared without readers getting both.
    if (class_exists('WP_Post_Author') && !current_user_can('manage_options')) return $contenuto;
    return $contenuto . bottega_autore_box(get_post());
}, 20);

The comment in the middle is how the switch was done. For a while both boxes were live, one under the other, but only I could see the new one. When they looked the same - same photo, same name, same button, now in Italian - the old plugin was turned off and readers never saw a gap.

The rest is small. Profile links are a few extra fields in the WordPress user profile. The icons are SVG paths written into the file (from Simple Icons, which are CC0), so the page asks nothing to anyone. The photo is either Gravatar, as before, or an image from the media library. No JavaScript, no settings page, no external request, nothing scheduled.

It is in the Bottega's public repository with the other mu-plugins, GPLv3.

and then...

Once the icons were there, a second file borrowed one of them: a "share" box under each article, which is a single link to the share page of a Mastodon instance. No counters, no script from anyone's CDN.

The list of active plugins is down to five. I will open it again in a few weeks and ask the same question.

Of Matter is starting again.