How to Add Custom Code to WordPress Safely

Sooner or later every WordPress site needs a bit of custom code: a tracking script in the header, a few lines of CSS, a PHP snippet from a tutorial that changes how excerpts work. Where you put that code decides whether it survives updates, and whether one typo can take the whole site down.

The four kinds of custom code

Kind	Example	Where it runs
Header code	Analytics tag, meta tags, preconnects	Inside `<head>`
Footer code	Chat widget, a small script	Before `</body>`
CSS	Style tweaks	Page styles
PHP	Hooks and filters, e.g. change the excerpt length	On the server

HTML, CSS and JavaScript can at worst break how a page looks. PHP can break the whole site, including wp-admin, because a fatal error stops WordPress from loading. Treat PHP with the most care.

Option 1: the theme’s functions.php (avoid)

It’s the classic advice, and the most fragile place:

Edits are lost when the theme updates. At minimum use a child theme.
Switching themes silently removes your code.
A typo in the theme editor can lock you out of wp-admin, and you’ll need FTP to fix it.

Option 2: a small custom plugin

Put your PHP in its own plugin, or a must-use plugin (a .php file in wp-content/mu-plugins/, loaded automatically):

<?php
/**
 * Plugin Name: Site tweaks
 */

// Shorter excerpts on archive pages.
add_filter( 'excerpt_length', function () {
    return 30;
} );

This survives theme changes and is easy to keep in Git. It’s a good choice for developers. The downsides: you need file access (SFTP or SSH) for every change, there’s no on/off switch, and no protection against a fatal error.

Option 3: a code snippets plugin

Snippet plugins store each piece of code separately, with an on/off toggle, and let you add header/footer code without touching templates. This is the most practical option for most sites, as long as the plugin protects you from your own typos.

Rules that prevent disasters

Test on staging first, or at least at a quiet time, never on a busy production site at 5 pm on Friday.
One snippet per job, with a clear name. “Shorter excerpts” beats “misc fixes”.
Wrap code that depends on a plugin: if ( function_exists( 'get_field' ) ) { … }, so deactivating that plugin doesn’t cause a fatal error.
Load code only where it’s needed. A script for the contact page doesn’t belong on every page.
Have a way back: a backup, and a way to disable a snippet even if wp-admin is broken.

How Scripts Organizer handles this

Scripts Organizer is a code editor inside WordPress built around these rules:

One “code block”, several locations. Each code block can hold Header, Footer and PHP code (or a Shortcode) together, so related code stays in one place, for example the CSS and JavaScript of one animation.
Languages: HTML, CSS, SCSS and JavaScript for header/footer, and PHP. CSS and JS can be output inline or as generated files.
PHP isn’t stored in the database. It’s written to files in wp-content/uploads/scripts-organizer/, and it’s validated every time you save.
Safe mode. If a PHP snippet has an error, Scripts Organizer switches to safe mode and shows you the error so you can fix it. If something still goes wrong, you can force safe mode by adding ?scorg_safemode=yes to your site URL while logged in as admin.
Conditions. Run a code block everywhere, only for admins, or only on selected pages, post types or taxonomy archives, with exclusions and date/time scheduling.
Toggles and export. Switch any code block on or off from the list, and export code blocks to move them to another site.

A safe home for your custom code

Scripts Organizer: PHP, CSS, SCSS and JS in one editor, with conditions, scheduling, toggles and safe mode.

See Scripts Organizer