⏱️ Durée estimée: 12-16 semaines

📊 Niveau: Intermédiaire

Niveau: Intermediaire Duree estimee: 12-16 semaines Prerequis: Maitrise de WordPress, bases Linux/VPS, connaissance Git

Vue d’ensemble

Ce parcours vous transformera en ingenieur WordPress Production capable de gerer des infrastructures haute performance, implementer des pipelines CI/CD avec GitHub Actions, securiser des environnements critiques et optimiser des sites a grande echelle. Vous apprendrez a integrer des workflows assistes par IA (Claude.ai, ChatGPT) pour accelerer votre productivite.

Phase 1 : Infrastructure VPS & Stack Haute Performance

Objectifs

Maitriser le deploiement d’un stack WordPress optimise sur VPS Debian
Configurer WordOps pour une gestion simplifiee
Implementer un systeme de cache multi-couches
Optimiser les performances au niveau noyau Linux

Competences techniques

1.1 Preparation VPS Debian

Technologies: Debian 11/12, SSH, UFW, Fail2Ban

Configuration initiale securisee:

# Mise a jour systeme
apt update && apt upgrade -y

# Configuration utilisateur non-root
adduser deployuser
usermod -aG sudo deployuser

# Securisation SSH
sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd

# Firewall UFW
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

Ressources:

Guide Debian Security
Documentation officielle UFW

1.2 Installation et configuration WordOps

Technologies: WordOps 3.x, Nginx, PHP 8.2/8.3, MariaDB 10.11, Redis 7.x

Installation WordOps (2025):

# Installation
wget -qO wo wops.cc && sudo bash wo

# Verification
wo --version
# WordOps 3.x.x

# Stack complet
wo stack install
wo stack install --php82 --php83
wo stack install --redis

Note importante: Des problemes d’installation ont ete reportes sur Debian 12.10 debut 2025. Verifiez le forum communautaire WordOps pour les dernieres mises a jour de compatibilite.

Creation de site optimise:

# Site WordPress avec cache Redis et Let's Encrypt
wo site create example.com --wp \
  --php83 \
  --redis \
  --letsencrypt

# Verification configuration Nginx
wo site info example.com

Caracteristiques WordOps:

TTFB < 100 ms sur VPS economiques
Support HTTP/3 QUIC integre
Optimisations noyau Linux automatiques
Certificats SSL/TLS wildcard avec validation DNS

Ressources:

1.3 Cache multi-couches : Nginx FastCGI + Redis Object Cache

A. Nginx FastCGI Cache

Le cache FastCGI permet a Nginx de servir directement le HTML genere par PHP-FPM sans solliciter WordPress, PHP ou MySQL pour les requetes suivantes.

Configuration Nginx (/etc/nginx/conf.d/fastcgi-cache.conf):

# Zone de cache
fastcgi_cache_path /var/run/nginx-cache levels=1:2
    keys_zone=WORDPRESS:100m
    inactive=60m
    max_size=500m;

fastcgi_cache_key "$scheme$request_method$host$request_uri";
fastcgi_cache_use_stale error timeout invalid_header http_500;
fastcgi_ignore_headers Cache-Control Expires Set-Cookie;

Dans votre configuration de site:

# Conditions de bypass
set $skip_cache 0;

if ($request_method = POST) {
    set $skip_cache 1;
}
if ($query_string != "") {
    set $skip_cache 1;
}
if ($request_uri ~* "/wp-admin/|/xmlrpc.php|wp-.*.php|/feed/|sitemap(_index)?.xml") {
    set $skip_cache 1;
}
if ($http_cookie ~* "comment_author|wordpress_[a-f0-9]+|wp-postpass|wordpress_logged_in") {
    set $skip_cache 1;
}

# Application du cache
fastcgi_cache_bypass $skip_cache;
fastcgi_no_cache $skip_cache;
fastcgi_cache WORDPRESS;
fastcgi_cache_valid 200 60m;
fastcgi_cache_valid 404 10m;

add_header X-FastCGI-Cache $upstream_cache_status;

Plugin WordPress recommande:

Nginx Cache Purge Preload (NPP) – Gestion directe des fichiers cache sans modules Nginx

B. Redis Object Cache

Redis reduit de jusqu’a 80% les requetes base de donnees en stockant en memoire les resultats frequemment demandes.

Configuration Redis (/etc/redis/redis.conf):

# Memoire allouee (minimum 256MB production)
maxmemory 512mb
maxmemory-policy allkeys-lru

# Persistence
save 900 1
save 300 10
save 60 10000

# Performance
tcp-backlog 511
timeout 0
tcp-keepalive 300

Configuration WordPress (wp-config.php):

define('WP_REDIS_HOST', '127.0.0.1');
define('WP_REDIS_PORT', 6379);
define('WP_REDIS_DATABASE', 0);
define('WP_REDIS_MAXTTL', 86400); // 24 heures

// Options recommandees
define('WP_REDIS_TIMEOUT', 1);
define('WP_REDIS_READ_TIMEOUT', 1);

Plugins recommandes:

Redis Object Cache (gratuit) – Supporte Predis, PhpRedis, Relay, clustering
Object Cache Pro (premium) – 1500+ tests, optimise WooCommerce, PHP 7.2-8.4

TTL recommandes (2025):

Donnees dynamiques (paniers, sessions): 60-300 secondes
Menus, options site: 3600-86400 secondes
Taxonomies, termes: 7200 secondes

Verification performances:

# Stats Redis
redis-cli INFO stats

# Monitoring en temps reel
redis-cli MONITOR

# Via WP-CLI
wp redis status
wp redis info

Cas d’usage optimaux:

E-commerce (WooCommerce)
Sites membres
Forums et communautes
Sites haute concurrence (>10000 visiteurs/jour)

Attention: Pour les petits blogs avec cache page-level efficace et trafic faible, Redis peut compliquer inutilement votre stack.

Ressources:

1.4 Optimisations serveur avancees

PHP 8.3 OPcache configuration (/etc/php/8.3/fpm/conf.d/10-opcache.ini):

opcache.enable=1
opcache.memory_consumption=256
opcache.interned_strings_buffer=16
opcache.max_accelerated_files=10000
opcache.revalidate_freq=2
opcache.fast_shutdown=1
opcache.enable_cli=0

# Performance optimale (maintenir proche de 100%)
opcache.validate_timestamps=0

Monitoring OPcache:

# Via WP-CLI
wp opcache status

Configuration PHP-FPM (/etc/php/8.3/fpm/pool.d/www.conf):

; Process manager
pm = dynamic
pm.max_children = 50
pm.start_servers = 10
pm.min_spare_servers = 5
pm.max_spare_servers = 20
pm.max_requests = 500

; Monitoring
pm.status_path = /status
ping.path = /ping

Calcul memoire par worker:

# Memoire moyenne par process PHP-FPM
ps --no-headers -o "rss,cmd" -C php-fpm8.3 | awk '{ sum+=$1 } END { printf ("%d%s\n", sum/NR/1024,"M") }'

# Formule: RAM_disponible / Memoire_par_process = pm.max_children

Optimisations noyau Linux (/etc/sysctl.conf):

# Network performance
net.core.somaxconn = 65535
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_keepalive_intvl = 30
net.ipv4.tcp_keepalive_probes = 3

# File descriptors
fs.file-max = 100000

# Application
sysctl -p

Requis materiels production (2025):

Minimum: 4vCPU / 4GB RAM / NVMe
Recommande: 8vCPU / 8GB RAM / NVMe RAID
Cache Redis: 256MB minimum, 512MB-1GB recommande
OPcache: 128MB minimum, 256MB recommande

Objectifs performance:

TTFB: < 100ms
LCP (Largest Contentful Paint): < 2.5s
FID (First Input Delay): < 100ms
CLS (Cumulative Layout Shift): < 0.1
Capacite: 500+ utilisateurs concurrents sur 2GB RAM (avec cache)

Projet pratique Phase 1

Deploiement infrastructure complete:

Provisionner un VPS Debian 11/12 (4GB RAM minimum)
Securiser le serveur (SSH, firewall, fail2ban)
Installer WordOps avec stack complet
Creer un site WordPress avec Redis et SSL
Configurer cache Nginx FastCGI + Redis Object Cache
Optimiser PHP-FPM et OPcache
Effectuer des tests de charge (ApacheBench, k6)
Documenter votre configuration et resultats de performance

Benchmark attendus:

TTFB < 100ms
1000 req/s sans degradation
Taux hit cache > 90%

Phase 2 : Securite Production & Hardening

Objectifs

Implementer les techniques de hardening WordPress 2025
Configurer un WAF applicatif
Automatiser les audits de securite
Gerer les vulnerabilites et mises a jour

Contexte menaces 2025

Statistiques critiques:

7,966 vulnerabilites decouvertes dans l’ecosysteme WordPress en 2024 (+34% vs 2023)
Les plugins populaires (WooCommerce, LiteSpeed Cache, The Events Calendar) sont des cibles prioritaires
87.8% des attaques testees contournent les defenses niveau hebergeur
Le delai de mise a jour cree les degats, pas l’absence de patches

Source: Patchstack Q3 2025 Report

Competences techniques

2.1 Hardening wp-config.php

Configuration securisee complete:

<?php
/**
 * WordPress Configuration securisee - Production 2025
 */

// === CLES DE SECURITE ===
// Generees via https://api.wordpress.org/secret-key/1.1/salt/
define('AUTH_KEY',         'votre-cle-unique-generee');
define('SECURE_AUTH_KEY',  'votre-cle-unique-generee');
define('LOGGED_IN_KEY',    'votre-cle-unique-generee');
define('NONCE_KEY',        'votre-cle-unique-generee');
define('AUTH_SALT',        'votre-cle-unique-generee');
define('SECURE_AUTH_SALT', 'votre-cle-unique-generee');
define('LOGGED_IN_SALT',   'votre-cle-unique-generee');
define('NONCE_SALT',       'votre-cle-unique-generee');

// === SECURITE PRODUCTION ===
// Desactiver editeur de fichiers
define('DISALLOW_FILE_EDIT', true);
define('DISALLOW_FILE_MODS', true);

// Limiter revisions
define('WP_POST_REVISIONS', 5);
define('AUTOSAVE_INTERVAL', 300);

// Vider corbeille automatiquement
define('EMPTY_TRASH_DAYS', 7);

// Forcer SSL admin
define('FORCE_SSL_ADMIN', true);

// Bloquer requetes externes (sauf services approuves)
define('WP_HTTP_BLOCK_EXTERNAL', true);
define('WP_ACCESSIBLE_HOSTS', 'api.wordpress.org,*.github.com,*.cloudflare.com');

// === PERFORMANCE ===
define('WP_MEMORY_LIMIT', '256M');
define('WP_MAX_MEMORY_LIMIT', '512M');
define('WP_CACHE', true);

// === MODE DEBUG (DESACTIVE EN PRODUCTION) ===
define('WP_DEBUG', false);
define('WP_DEBUG_LOG', false);
define('WP_DEBUG_DISPLAY', false);
define('SCRIPT_DEBUG', false);
@ini_set('display_errors', 0);

// === BASE DE DONNEES ===
define('DB_NAME', 'database_name');
define('DB_USER', 'database_user');
define('DB_PASSWORD', 'strong_password_here');
define('DB_HOST', 'localhost');
define('DB_CHARSET', 'utf8mb4');
define('DB_COLLATE', '');
$table_prefix = 'wp_'; // Changer pour prefixe unique en production

// === SECURITE COOKIES ===
define('COOKIE_DOMAIN', 'example.com');
define('COOKIEPATH', '/');
define('SITECOOKIEPATH', '/');
define('ADMIN_COOKIE_PATH', SITECOOKIEPATH . 'wp-admin');

// === PARAMETRES AVANCES ===
define('CONCATENATE_SCRIPTS', false); // Desactive si HTTP/2 actif
define('COMPRESS_SCRIPTS', true);
define('COMPRESS_CSS', true);

/* C'est tout, ne modifiez pas ce qui suit ! Bonne publication. */
if ( ! defined( 'ABSPATH' ) ) {
    define( 'ABSPATH', __DIR__ . '/' );
}
require_once ABSPATH . 'wp-settings.php';

Rotation cles de securite (recommande tous les 3-6 mois):

# Generer nouvelles cles
curl -s https://api.wordpress.org/secret-key/1.1/salt/

2.2 Permissions fichiers et verrouillage systeme

Permissions optimales:

# Repertoires
find /var/www/example.com/htdocs -type d -exec chmod 755 {} \;

# Fichiers
find /var/www/example.com/htdocs -type f -exec chmod 644 {} \;

# wp-config.php ultra-securise
chmod 440 /var/www/example.com/htdocs/wp-config.php
chown www-data:www-data /var/www/example.com/htdocs/wp-config.php

# .htaccess
chmod 444 /var/www/example.com/htdocs/.htaccess

Verrouillage immutabilite (fichiers critiques):

# Rendre wp-config.php immuable
chattr +i /var/www/example.com/htdocs/wp-config.php

# Verification
lsattr /var/www/example.com/htdocs/wp-config.php

# Retirer l'immutabilite (pour modification)
chattr -i /var/www/example.com/htdocs/wp-config.php

Protection repertoires sensibles (Nginx):

# Bloquer acces wp-config.php
location ~* wp-config.php {
    deny all;
}

# Bloquer fichiers sensibles
location ~* \.(log|sql|conf|bak|old|git)$ {
    deny all;
}

# Limiter acces wp-login.php par IP (optionnel)
location = /wp-login.php {
    allow 203.0.113.0/24; # Votre IP
    deny all;

    include fastcgi_params;
    fastcgi_pass php;
}

2.3 Protection authentification avancee

A. Authentification a deux facteurs (2FA)

Plugins recommandes:

Two Factor Authentication (gratuit)
Wordfence Security (freemium) – Inclut 2FA + WAF
WP 2FA (premium)

Configuration via WP-CLI:

# Installer plugin 2FA
wp plugin install two-factor --activate

# Forcer 2FA pour tous les administrateurs
wp user meta update USER_ID two_factor_required 1

B. Limitation tentatives connexion

Plugin: Limit Login Attempts Reloaded

Configuration Nginx (alternative):

# Rate limiting connexions
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;

location = /wp-login.php {
    limit_req zone=login burst=2 nodelay;

    include fastcgi_params;
    fastcgi_pass php;
}

C. Renommer URL admin

Plugin: WPS Hide Login

Avantages:

Reduit drastiquement attaques brute-force automatisees
Masque /wp-admin et /wp-login.php
Configuration simple via interface

2.4 Web Application Firewall (WAF) niveau application

Solutions 2025:

1. Patchstack (Recommande)

Mitigation couche application (RapidMitigate)
Bloque 87.8%+ des exploits WordPress
Base de donnees vulnerabilites temps reel
Protection virtuelle avant patch officiel

2. Wordfence

WAF + scanner vulnerabilites
Protection brute-force integree
Monitoring temps reel

3. Cloudflare WAF (Niveau edge)

Protection DDoS
Rate limiting global
Rules personnalisables

Configuration Cloudflare Rules (exemples):

# Bloquer scanners connus
(http.user_agent contains "nikto") or
(http.user_agent contains "sqlmap") or
(http.user_agent contains "masscan")
Action: Block

# Rate limiting aggressif wp-login
(http.request.uri.path eq "/wp-login.php")
Action: Rate Limit (5 requests / 5 minutes)

# Bloquer acces xmlrpc.php
(http.request.uri.path eq "/xmlrpc.php")
Action: Block

Configuration Wordfence recommandee:

// wp-config.php
define('WFWAF_ENABLED', true);
define('WFWAF_LOG_ATTACKS', true);
define('WFWAF_STORAGE_ENGINE', 'mysqli');

2.5 Discipline mises a jour et gestion vulnerabilites

Strategie mise a jour 2025:

1. Surveillance vulnerabilites

# WP-CLI - Verifier vulnerabilites connues
wp plugin list --field=name | xargs -I {} wp plugin verify-checksums {}

# Vulnerabilite scan automatise
wp vuln check

2. Automatisation mises a jour mineures

// wp-config.php - Activer mises a jour auto securite
define('WP_AUTO_UPDATE_CORE', 'minor');

// Auto-update plugins de securite
add_filter('auto_update_plugin', '__return_true');

3. Workflow mise a jour production

Processus recommande:

Staging: Tester mise a jour sur environnement clone
Verification: Tester fonctionnalites critiques
Backup: Sauvegarde complete base + fichiers
Mise a jour production: Fenetre maintenance
Monitoring: Surveiller erreurs 24-48h

Script backup pre-update:

#!/bin/bash
SITE="example.com"
DATE=$(date +%Y%m%d_%H%M%S)
BACKUP_DIR="/backups/$SITE"

# Backup base de donnees
wp db export "$BACKUP_DIR/db_$DATE.sql" --path=/var/www/$SITE/htdocs

# Backup fichiers
tar -czf "$BACKUP_DIR/files_$DATE.tar.gz" -C /var/www/$SITE htdocs

# Garder 7 derniers backups
find "$BACKUP_DIR" -name "*.sql" -mtime +7 -delete
find "$BACKUP_DIR" -name "*.tar.gz" -mtime +7 -delete

echo "Backup complete: $DATE"

4. Monitoring post-update

# Verifier erreurs PHP
tail -f /var/log/php8.3-fpm.log

# Verifier erreurs Nginx
tail -f /var/log/nginx/error.log

# Monitoring WordPress
wp core verify-checksums

2.6 Headers de securite HTTP

Configuration Nginx (/etc/nginx/common/wpcommon.conf):

# Security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# CSP (Content Security Policy) - Adapter a votre site
add_header Content-Security-Policy "default-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.example.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self'; frame-ancestors 'self';" always;

# HSTS (HTTP Strict Transport Security) - Attention: preload permanent
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# Permissions Policy
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

Verification headers:

curl -I https://example.com | grep -E "(X-Frame|X-Content|Strict-Transport)"

Outils audit:

Projet pratique Phase 2

Audit et hardening securite complet:

Auditer site existant avec WPScan et Wordfence
Implementer toutes configurations hardening wp-config.php
Configurer permissions fichiers optimales
Installer et configurer 2FA pour tous admins
Deployer WAF (Wordfence ou Patchstack)
Configurer headers securite HTTP
Mettre en place processus backup pre-update
Tester tentatives intrusion et verifier blocages
Documenter toutes procedures securite

Livrable: Documentation securite complete + rapport audit avant/apres

Ressources:

Phase 3 : CI/CD avec GitHub Actions

Objectifs

Maitriser Git workflows pour WordPress
Implementer pipelines CI/CD automatises
Deployer automatiquement via GitHub Actions
Integrer tests automatises

Competences techniques

3.1 Structure repository Git pour WordPress

Architecture recommandee:

mon-site-wordpress/
├── .github/
│   ├── workflows/
│   │   ├── deploy-production.yml
│   │   ├── deploy-staging.yml
│   │   └── code-quality.yml
├── wp-content/
│   ├── themes/
│   │   └── mon-theme/
│   ├── plugins/
│   │   └── mon-plugin/
│   └── mu-plugins/
├── config/
│   ├── wp-config-production.php
│   ├── wp-config-staging.php
│   └── nginx/
│       └── site.conf
├── scripts/
│   ├── deploy.sh
│   └── backup.sh
├── tests/
│   ├── phpunit/
│   └── e2e/
├── .gitignore
├── composer.json
├── package.json
└── README.md

.gitignore optimise WordPress:

# WordPress core
/wp-admin/
/wp-includes/
wp-*.php
xmlrpc.php
readme.html
license.txt

# Configuration
wp-config.php
.htaccess

# Uploads et cache
wp-content/uploads/
wp-content/cache/
wp-content/upgrade/

# Plugins et themes tiers (geres via composer)
wp-content/plugins/*
!wp-content/plugins/mon-plugin/
wp-content/themes/*
!wp-content/themes/mon-theme/

# Dependencies
/vendor/
/node_modules/

# OS et IDE
.DS_Store
Thumbs.db
.idea/
.vscode/
*.swp

# Backups
*.sql
*.sql.gz
*.tar.gz

composer.json pour dependencies:

{
    "name": "example/mon-site",
    "description": "Site WordPress production",
    "type": "project",
    "require": {
        "php": ">=8.2",
        "composer/installers": "^2.0",
        "wpackagist-plugin/redis-cache": "^2.5",
        "wpackagist-plugin/wordfence": "^7.11"
    },
    "require-dev": {
        "phpunit/phpunit": "^10.0",
        "squizlabs/php_codesniffer": "^3.7",
        "phpstan/phpstan": "^1.10"
    },
    "repositories": [
        {
            "type": "composer",
            "url": "https://wpackagist.org"
        }
    ],
    "extra": {
        "installer-paths": {
            "wp-content/plugins/{$name}/": ["type:wordpress-plugin"],
            "wp-content/themes/{$name}/": ["type:wordpress-theme"]
        }
    }
}

3.2 GitHub Actions workflow – Deploiement Staging

.github/workflows/deploy-staging.yml:

name: Deploy to Staging

on:
  push:
    branches:
      - develop

env:
  SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
  SSH_USER: ${{ secrets.STAGING_SSH_USER }}
  SSH_PORT: ${{ secrets.STAGING_SSH_PORT }}
  DEPLOY_PATH: /var/www/staging.example.com/htdocs

jobs:
  deploy:
    name: Deploy to Staging Server
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          extensions: mbstring, xml, zip
          tools: composer:v2

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install Composer dependencies
        run: |
          composer install --no-dev --optimize-autoloader --no-interaction

      - name: Install NPM dependencies and build
        run: |
          npm ci
          npm run build

      - name: Run PHP CodeSniffer
        run: |
          vendor/bin/phpcs --standard=PSR12 wp-content/themes/mon-theme
          vendor/bin/phpcs --standard=WordPress wp-content/plugins/mon-plugin

      - name: Run PHPStan
        run: vendor/bin/phpstan analyse wp-content/themes/mon-theme wp-content/plugins/mon-plugin

      - name: Setup SSH key
        uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ secrets.STAGING_SSH_PRIVATE_KEY }}

      - name: Add server to known hosts
        run: |
          mkdir -p ~/.ssh
          ssh-keyscan -p $SSH_PORT -H $SSH_HOST >> ~/.ssh/known_hosts

      - name: Deploy via rsync
        run: |
          rsync -avz \
            --delete \
            --exclude='.git' \
            --exclude='.github' \
            --exclude='node_modules' \
            --exclude='tests' \
            --exclude='wp-config.php' \
            --exclude='wp-content/uploads' \
            --exclude='wp-content/cache' \
            -e "ssh -p $SSH_PORT" \
            ./ $SSH_USER@$SSH_HOST:$DEPLOY_PATH/

      - name: Run post-deployment commands
        run: |
          ssh -p $SSH_PORT $SSH_USER@$SSH_HOST << 'ENDSSH'
            cd ${{ env.DEPLOY_PATH }}

            # Composer autoload
            composer dump-autoload --optimize --no-dev

            # WP-CLI operations
            wp cache flush --allow-root
            wp rewrite flush --allow-root

            # Permissions
            find . -type f -exec chmod 644 {} \;
            find . -type d -exec chmod 755 {} \;

            # Redis cache clear
            wp redis cli FLUSHDB --allow-root

            echo "Deployment complete!"
          ENDSSH

      - name: Notify deployment
        if: always()
        run: |
          echo "Staging deployment finished: ${{ job.status }}"
          # Integration Slack/Discord possible ici

3.3 GitHub Actions workflow – Deploiement Production

.github/workflows/deploy-production.yml:

name: Deploy to Production

on:
  push:
    branches:
      - main
  workflow_dispatch: # Permet declenchement manuel

env:
  SSH_HOST: ${{ secrets.PROD_SSH_HOST }}
  SSH_USER: ${{ secrets.PROD_SSH_USER }}
  SSH_PORT: ${{ secrets.PROD_SSH_PORT }}
  DEPLOY_PATH: /var/www/example.com/htdocs

jobs:
  test:
    name: Run Tests
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          extensions: mbstring, xml, zip, mysql

      - name: Install dependencies
        run: composer install --no-interaction

      - name: Run PHPUnit tests
        run: vendor/bin/phpunit tests/

      - name: Run PHP CodeSniffer
        run: vendor/bin/phpcs --standard=WordPress wp-content/themes/ wp-content/plugins/

      - name: Run PHPStan
        run: vendor/bin/phpstan analyse --level=5 wp-content/themes/ wp-content/plugins/

  backup:
    name: Backup Production
    runs-on: ubuntu-latest
    needs: test

    steps:
      - name: Setup SSH key
        uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ secrets.PROD_SSH_PRIVATE_KEY }}

      - name: Create backup
        run: |
          ssh -p $SSH_PORT $SSH_USER@$SSH_HOST << 'ENDSSH'
            BACKUP_DIR="/backups/example.com"
            DATE=$(date +%Y%m%d_%H%M%S)

            # Database backup
            wp db export "$BACKUP_DIR/pre-deploy_$DATE.sql" \
              --path=${{ env.DEPLOY_PATH }} \
              --allow-root

            # Files backup
            tar -czf "$BACKUP_DIR/files_$DATE.tar.gz" \
              -C ${{ env.DEPLOY_PATH }} \
              wp-content/themes/mon-theme \
              wp-content/plugins/mon-plugin

            echo "Backup created: $DATE"
          ENDSSH

  deploy:
    name: Deploy to Production
    runs-on: ubuntu-latest
    needs: backup
    environment:
      name: production
      url: https://example.com

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Build assets
        run: |
          composer install --no-dev --optimize-autoloader
          npm ci
          npm run build:production

      - name: Setup SSH key
        uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ secrets.PROD_SSH_PRIVATE_KEY }}

      - name: Enable maintenance mode
        run: |
          ssh -p $SSH_PORT $SSH_USER@$SSH_HOST << 'ENDSSH'
            wp maintenance-mode activate --allow-root \
              --path=${{ env.DEPLOY_PATH }}
          ENDSSH

      - name: Deploy files
        run: |
          rsync -avz \
            --delete \
            --exclude='.git' \
            --exclude='node_modules' \
            --exclude='wp-config.php' \
            --exclude='wp-content/uploads' \
            -e "ssh -p $SSH_PORT" \
            ./ $SSH_USER@$SSH_HOST:$DEPLOY_PATH/

      - name: Post-deployment tasks
        run: |
          ssh -p $SSH_PORT $SSH_USER@$SSH_HOST << 'ENDSSH'
            cd ${{ env.DEPLOY_PATH }}

            # Database migration (si necessaire)
            # wp migrate --allow-root

            # Clear all caches
            wp cache flush --allow-root
            wp rewrite flush --allow-root

            # Redis flush
            wp redis cli FLUSHDB --allow-root

            # Nginx cache purge
            rm -rf /var/run/nginx-cache/*

            # OPcache reset
            wp opcache reset --allow-root

            # Permissions
            find wp-content/themes/mon-theme -type f -exec chmod 644 {} \;
            find wp-content/plugins/mon-plugin -type f -exec chmod 644 {} \;

            echo "Post-deployment complete"
          ENDSSH

      - name: Disable maintenance mode
        if: always()
        run: |
          ssh -p $SSH_PORT $SSH_USER@$SSH_HOST << 'ENDSSH'
            wp maintenance-mode deactivate --allow-root \
              --path=${{ env.DEPLOY_PATH }}
          ENDSSH

      - name: Health check
        run: |
          RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" https://example.com)
          if [ $RESPONSE -ne 200 ]; then
            echo "Health check failed! HTTP $RESPONSE"
            exit 1
          fi
          echo "Health check passed: HTTP $RESPONSE"

      - name: Notify deployment success
        if: success()
        run: echo "Production deployment successful!"

      - name: Notify deployment failure
        if: failure()
        run: echo "Production deployment failed! Rolling back..."

3.4 Workflow qualite code

.github/workflows/code-quality.yml:

name: Code Quality Checks

on:
  pull_request:
    branches:
      - develop
      - main

jobs:
  code-quality:
    name: Code Quality
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          coverage: xdebug

      - name: Install dependencies
        run: composer install --no-interaction

      - name: PHP CodeSniffer
        run: |
          vendor/bin/phpcs \
            --standard=WordPress \
            --extensions=php \
            --ignore=vendor \
            wp-content/

      - name: PHPStan Static Analysis
        run: vendor/bin/phpstan analyse --level=6 wp-content/

      - name: PHPUnit with Coverage
        run: vendor/bin/phpunit --coverage-text tests/

      - name: Check WordPress Coding Standards
        run: |
          composer require --dev wp-coding-standards/wpcs
          vendor/bin/phpcs --config-set installed_paths vendor/wp-coding-standards/wpcs
          vendor/bin/phpcs --standard=WordPress-Core wp-content/themes/
          vendor/bin/phpcs --standard=WordPress-Extra wp-content/plugins/

3.5 Configuration secrets GitHub

Secrets a configurer dans GitHub (Settings > Secrets and variables > Actions):

Staging:

STAGING_SSH_HOST: staging.example.com
STAGING_SSH_USER: deployuser
STAGING_SSH_PORT: 22
STAGING_SSH_PRIVATE_KEY: Cle SSH privee (format PEM)

Production:

PROD_SSH_HOST: example.com
PROD_SSH_USER: deployuser
PROD_SSH_PORT: 22
PROD_SSH_PRIVATE_KEY: Cle SSH privee (format PEM)

Generation paire cles SSH pour deploiement:

# Sur votre machine locale
ssh-keygen -t ed25519 -C "github-actions-deploy" -f ~/.ssh/github_deploy_key

# Copier cle publique sur serveur
ssh-copy-id -i ~/.ssh/github_deploy_key.pub deployuser@example.com

# Copier cle privee dans GitHub Secrets
cat ~/.ssh/github_deploy_key

3.6 Deploiement avec Deployer.org (alternative)

Installation Deployer:

composer require --dev deployer/deployer

deploy.php configuration:

<?php
namespace Deployer;

require 'recipe/common.php';

// Configuration
set('application', 'mon-site-wordpress');
set('repository', 'git@github.com:username/mon-site.git');
set('keep_releases', 3);
set('writable_mode', 'chmod');
set('writable_chmod_mode', '0755');

// Serveurs
host('production')
    ->setHostname('example.com')
    ->setRemoteUser('deployuser')
    ->setDeployPath('/var/www/example.com')
    ->set('branch', 'main')
    ->set('http_user', 'www-data');

host('staging')
    ->setHostname('staging.example.com')
    ->setRemoteUser('deployuser')
    ->setDeployPath('/var/www/staging.example.com')
    ->set('branch', 'develop')
    ->set('http_user', 'www-data');

// Fichiers partages entre deploiements
set('shared_files', [
    'wp-config.php',
    '.htaccess'
]);

set('shared_dirs', [
    'wp-content/uploads',
    'wp-content/cache'
]);

// Fichiers a exclure
set('writable_dirs', [
    'wp-content/uploads',
    'wp-content/cache'
]);

// Tasks personnalisees
desc('Clear WordPress cache');
task('wp:cache:clear', function () {
    run('cd {{release_path}} && wp cache flush --allow-root');
    run('cd {{release_path}} && wp redis cli FLUSHDB --allow-root');
});

desc('Clear Nginx FastCGI cache');
task('nginx:cache:clear', function () {
    run('rm -rf /var/run/nginx-cache/*');
});

desc('Backup database before deploy');
task('wp:db:backup', function () {
    $date = date('Ymd_His');
    run("wp db export /backups/{{application}}/db_$date.sql --path={{deploy_path}}/current --allow-root");
});

// Workflow deploiement
desc('Deploy WordPress');
task('deploy', [
    'deploy:prepare',
    'wp:db:backup',
    'deploy:vendors',
    'deploy:publish',
    'wp:cache:clear',
    'nginx:cache:clear',
    'deploy:cleanup'
]);

after('deploy:failed', 'deploy:unlock');

GitHub Actions avec Deployer:

- name: Deploy with Deployer
  run: |
    vendor/bin/dep deploy production \
      --branch=main \
      -vvv

Projet pratique Phase 3

Mise en place CI/CD complete:

Initialiser repository Git avec structure recommandee
Configurer .gitignore et composer.json
Creer workflows GitHub Actions (staging + production)
Configurer secrets GitHub
Implementer tests PHPUnit basiques
Configurer PHP CodeSniffer avec standards WordPress
Tester deploiement sur staging via push develop
Tester deploiement production via push main
Implementer rollback automatique en cas d’echec
Documenter processus deploiement

Livrable: Repository Git fonctionnel + documentation CI/CD + captures deploys reussis

Ressources:

Phase 4 : Performance a Grande Echelle

Objectifs

Optimiser pour sites haute concurrence (10000+ visiteurs/jour)
Implementer CDN et optimisations edge
Maitriser monitoring et observabilite
Gerer bases de donnees volumineuses

Competences techniques

4.1 Core Web Vitals et optimisation 2025

Metriques critiques Google (impact SEO):

LCP (Largest Contentful Paint): < 2.5s (bon)
FID (First Input Delay): < 100ms (bon)
CLS (Cumulative Layout Shift): < 0.1 (bon)
TTFB (Time to First Byte): < 600ms (bon), < 200ms (excellent)
INP (Interaction to Next Paint): < 200ms (remplace FID en 2024)

Impact business:

1 seconde de delai = -7% conversions
53% utilisateurs mobiles abandonnent si chargement > 3s
Attention moyenne utilisateur: 8.25 secondes (2025)

Source: 15 WordPress Performance Tips 2025 – Odd Jar

4.2 Optimisation images moderne

A. Formats modernes (2025)

AVIF (recommande):

Support WordPress Core natif (depuis WP 6.5)
Compression superieure a WebP (-30% vs WebP, -50% vs JPEG)
Support navigateurs: Chrome 85+, Firefox 93+, Safari 16+

WebP (fallback):

Support universel navigateurs modernes
-25-35% taille vs JPEG qualite equivalente

Configuration serveur Nginx:

# Servir AVIF si supporte
location ~* \.(jpg|jpeg|png)$ {
    set $avif_suffix "";
    if ($http_accept ~* "image/avif") {
        set $avif_suffix ".avif";
    }
    add_header Vary Accept;
    try_files $uri$avif_suffix $uri.webp $uri =404;
}

B. Plugins optimisation images

Recommandes 2025:

Imagify (freemium) – Compression intelligente multi-format
ShortPixel (freemium) – AVIF + WebP + lazy loading
Smush (freemium) – Compression sans perte qualite

Configuration via WP-CLI:

# Installer Imagify
wp plugin install imagify --activate

# Configuration API
wp option update imagify_settings '{"api_key":"YOUR_KEY","optimization_level":1,"auto_optimize":1,"resize_larger":1,"resize_larger_w":1920}'

# Optimiser bibliotheque existante (batch)
wp imagify optimize --path=/var/www/example.com/htdocs

C. Lazy loading natif WordPress

// Actif par defaut depuis WP 5.5
// Desactiver si conflit avec plugin tiers
add_filter('wp_lazy_loading_enabled', '__return_false');

D. Responsive images (srcset)

WordPress genere automatiquement srcset. Verification:

// functions.php - Ajouter tailles personnalisees
add_image_size('hero-desktop', 1920, 1080, true);
add_image_size('hero-tablet', 1024, 768, true);
add_image_size('hero-mobile', 640, 480, true);

// Regenerer vignettes existantes (WP-CLI)
wp media regenerate --yes

4.3 Optimisation frontend avancee

A. Minification et concatenation

Plugin recommande: Autoptimize

Configuration optimale:

// wp-config.php
define('AUTOPTIMIZE_ENABLED', true);

// Via filtre
add_filter('autoptimize_filter_js_exclude', function($exclude) {
    return $exclude . ', jquery.js, analytics.js';
});

Alternative: Asset CleanUp (controle granulaire par page)

B. Eliminer render-blocking

Defer JavaScript:

// functions.php
function defer_parsing_js($url) {
    if (is_admin()) return $url;
    if (strpos($url, '.js') === false) return $url;
    if (strpos($url, 'jquery.js')) return $url; // Exclure jQuery
    return str_replace(' src', ' defer src', $url);
}
add_filter('script_loader_tag', 'defer_parsing_js', 10);

Preload critical resources:

// functions.php
function preload_critical_assets() {
    echo '<link rel="preload" href="/wp-content/themes/mon-theme/assets/fonts/main.woff2" as="font" type="font/woff2" crossorigin>';
    echo '<link rel="preconnect" href="https://fonts.googleapis.com">';
    echo '<link rel="dns-prefetch" href="//cdn.example.com">';
}
add_action('wp_head', 'preload_critical_assets', 1);

C. Critical CSS

Plugin: WP Rocket (premium) – Generation automatique

Manuel (technique avancee):

# Installer criticalcss
npm install -g criticalcss

# Generer CSS critique
criticalcss https://example.com > critical.css

Inline critical CSS:

// functions.php
function inline_critical_css() {
    echo '<style>' . file_get_contents(get_template_directory() . '/critical.css') . '</style>';
}
add_action('wp_head', 'inline_critical_css', 1);

// Charger CSS complet async
function async_load_css() {
    echo '<link rel="preload" href="' . get_stylesheet_uri() . '" as="style" onload="this.onload=null;this.rel=\'stylesheet\'">';
}
add_action('wp_head', 'async_load_css', 2);

D. Speculation Rules API (2025)

WordPress Core supporte desormais Speculation Rules pour pre-chargement instantane:

// functions.php - Activer prefetch liens
function add_speculation_rules() {
    ?>
    <script type="speculationrules">
    {
        "prerender": [
            {
                "where": {"href_matches": "/*"},
                "eagerness": "moderate"
            }
        ],
        "prefetch": [
            {
                "urls": ["/produits/*", "/blog/*"],
                "requires": ["anonymous-client-ip-when-cross-origin"]
            }
        ]
    }
    </script>
    <?php
}
add_action('wp_footer', 'add_speculation_rules');

Resultat: Chargement quasi-instantane pages suivantes

4.4 CDN et optimisations edge

A. Configuration Cloudflare (recommande)

Plan Pro minimum pour:

Polish (optimisation images automatique)
Mirage (lazy loading intelligent)
Argo Smart Routing (acceleration -30% TTFB)
Workers (edge computing)

Settings optimaux Cloudflare:

Speed > Optimization:
- Auto Minify: ON (HTML, CSS, JS)
- Brotli: ON
- Early Hints: ON
- Rocket Loader: OFF (conflit WordPress)
- HTTP/3 (with QUIC): ON

Caching:
- Caching Level: Standard
- Browser Cache TTL: Respect Existing Headers
- Always Online: ON

Page Rules (example.com/*):
- Cache Level: Cache Everything
- Edge Cache TTL: 1 month
- Browser Cache TTL: 4 hours

Plugin WordPress: Cloudflare (officiel) – Purge cache automatique

B. Cloudflare Workers pour optimisations edge

Worker HTML minification:

addEventListener('fetch', event => {
  event.respondWith(handleRequest(event.request))
})

async function handleRequest(request) {
  const response = await fetch(request)
  const contentType = response.headers.get('content-type')

  if (contentType && contentType.includes('text/html')) {
    let html = await response.text()

    // Minification basique
    html = html.replace(/\s+/g, ' ')
               .replace(/>\s+</g, '><')

    return new Response(html, {
      headers: response.headers,
      status: response.status
    })
  }

  return response
}

C. Configuration headers cache

Nginx configuration:

# Cache statique agressif
location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
    access_log off;
}

# HTML - cache court avec revalidation
location ~* \.html$ {
    expires 1h;
    add_header Cache-Control "public, must-revalidate";
}

WordPress headers cache:

// functions.php
function set_cache_headers() {
    if (!is_user_logged_in() && !is_admin()) {
        header('Cache-Control: public, max-age=3600, must-revalidate');
        header('Expires: ' . gmdate('D, d M Y H:i:s', time() + 3600) . ' GMT');
    }
}
add_action('send_headers', 'set_cache_headers');

4.5 Base de donnees haute performance

A. Configuration MariaDB 10.11 optimisee

my.cnf pour serveur 8GB RAM:

[mysqld]
# Performance schema
performance_schema = ON

# InnoDB settings
innodb_buffer_pool_size = 4G        # 50% RAM disponible
innodb_log_file_size = 512M
innodb_flush_log_at_trx_commit = 2  # Performance (risque perte 1s data)
innodb_flush_method = O_DIRECT
innodb_file_per_table = 1

# Query cache (deprecated MySQL 8+, ok MariaDB)
query_cache_type = 1
query_cache_size = 256M
query_cache_limit = 2M

# Connections
max_connections = 200
thread_cache_size = 50

# Temp tables
tmp_table_size = 256M
max_heap_table_size = 256M

# Logs
slow_query_log = 1
slow_query_log_file = /var/log/mysql/slow-query.log
long_query_time = 2
log_queries_not_using_indexes = 1

# Character set
character_set_server = utf8mb4
collation_server = utf8mb4_unicode_ci

B. Optimisation tables WordPress

Nettoyage regulier:

-- Supprimer revisions anciennes (garder 5 dernieres)
DELETE FROM wp_posts
WHERE post_type = 'revision'
AND ID NOT IN (
    SELECT ID FROM (
        SELECT ID FROM wp_posts
        WHERE post_type = 'revision'
        ORDER BY post_modified DESC
        LIMIT 5
    ) tmp
);

-- Vider corbeille
DELETE FROM wp_posts WHERE post_status = 'trash';

-- Supprimer transients expires
DELETE FROM wp_options WHERE option_name LIKE '_transient_%';

-- Optimiser tables
OPTIMIZE TABLE wp_posts, wp_postmeta, wp_options, wp_comments, wp_commentmeta;

Automatisation via WP-CLI:

# Script cron hebdomadaire
#!/bin/bash
wp transient delete --all --path=/var/www/example.com/htdocs --allow-root
wp post delete $(wp post list --post_status=trash --format=ids --path=/var/www/example.com/htdocs --allow-root) --force --allow-root
wp db optimize --path=/var/www/example.com/htdocs --allow-root

C. Index personalises haute performance

Requetes lentes communes WordPress:

-- Trouver requetes lentes
SELECT * FROM mysql.slow_log ORDER BY query_time DESC LIMIT 10;

-- Index meta_key pour postmeta (requetes custom fields)
CREATE INDEX meta_key_value ON wp_postmeta(meta_key, meta_value(20));

-- Index recherche commentaires
CREATE INDEX comment_approved_post_id ON wp_comments(comment_approved, comment_post_ID);

Plugin recommande: Query Monitor – Identification requetes lentes temps reel

D. Read replicas et load balancing (tres haute volumetrie)

Configuration HyperDB (multi-DB):

// db-config.php
$wpdb->add_database(array(
    'host'     => '192.168.1.10', // Master
    'user'     => 'wp_user',
    'password' => 'password',
    'name'     => 'wordpress_db',
    'write'    => 1,
    'read'     => 1,
));

$wpdb->add_database(array(
    'host'     => '192.168.1.11', // Replica 1 (read-only)
    'user'     => 'wp_user',
    'password' => 'password',
    'name'     => 'wordpress_db',
    'write'    => 0,
    'read'     => 1,
));

$wpdb->add_database(array(
    'host'     => '192.168.1.12', // Replica 2 (read-only)
    'user'     => 'wp_user',
    'password' => 'password',
    'name'     => 'wordpress_db',
    'write'    => 0,
    'read'     => 1,
));

4.6 Monitoring et observabilite

A. Monitoring serveur avec Netdata

Installation:

# Installation one-liner
bash <(curl -Ss https://get.netdata.cloud/kickstart.sh)

# Acces: http://votre-ip:19999

Metriques surveillees:

CPU, RAM, I/O disque temps reel
Nginx connections et requests/s
PHP-FPM pools et memoire
MySQL queries et slow queries
Redis memory et ops/s

B. Application Performance Monitoring (APM)

New Relic (recommande):

# Installer agent PHP
wget -O - https://download.newrelic.com/548C16BF.gpg | apt-key add -
echo 'deb http://apt.newrelic.com/debian/ newrelic non-free' > /etc/apt/sources.list.d/newrelic.list
apt update
apt install newrelic-php5

# Configuration
newrelic-install install

# Redemarrer PHP-FPM
systemctl restart php8.3-fpm

Plugin WordPress: New Relic Reporting

C. Monitoring WordPress avec Query Monitor

# Installation
wp plugin install query-monitor --activate --allow-root

Fonctionnalites:

Requetes base de donnees + temps execution
Hooks WordPress executes
Scripts et styles charges
Erreurs PHP et notices
HTTP API calls

D. Uptime monitoring externe

Services recommandes:

UptimeRobot (gratuit) – Check toutes les 5min
Pingdom (premium) – Monitoring multi-regions
Hetrix Tools (freemium) – Monitoring serveur + blacklist

Configuration webhook alertes:

# Script alerte Slack
#!/bin/bash
SLACK_WEBHOOK="https://hooks.slack.com/services/YOUR/WEBHOOK/URL"

MESSAGE="ALERT: Site example.com DOWN!"

curl -X POST -H 'Content-type: application/json' \
  --data "{\"text\":\"$MESSAGE\"}" \
  $SLACK_WEBHOOK

E. Logs centralises

Configuration rsyslog vers service central:

# /etc/rsyslog.d/50-wordpress.conf
# Envoyer logs Nginx/PHP vers serveur centralise
*.* @logs.example.com:514

Alternative cloud: Logtail, Papertrail, Datadog Logs

Projet pratique Phase 4

Optimisation site haute performance complete:

Auditer site existant (GTmetrix, PageSpeed Insights, WebPageTest)
Implementer formats images modernes (AVIF + WebP)
Configurer CDN Cloudflare avec settings optimaux
Implementer critical CSS et defer JS
Activer Speculation Rules API
Optimiser configuration MariaDB selon RAM disponible
Creer index base de donnees personnalises
Installer et configurer monitoring (Netdata + Query Monitor)
Effectuer tests charge avant/apres (k6, Apache Bench)
Documenter gains performance (screenshots audits)

Objectifs mesurables:

PageSpeed Score > 90 (mobile et desktop)
TTFB < 200ms
LCP < 2s
1000+ req/s soutenus
Capacite 500+ utilisateurs concurrents

Ressources:

Phase 5 : Workflows Assistes par IA

Objectifs

Integrer Claude.ai et ChatGPT dans workflow developpement
Accelerer developpement plugins/themes avec IA
Automatiser taches repetitives avec IA
Debugger et optimiser code avec assistance IA

Competences techniques

5.1 Claude Code pour developpement WordPress

A. Configuration environnement local + Claude Code

Contexte 2025: Claude Code est devenu l’outil de reference pour le developpement WordPress assiste par IA grace a son contexte 200K tokens permettant d’analyser des codebases completes.

Setup recommande:

Local by Flywheel ou Laravel Herd pour environnement local
Claude Pro (20 $/mois) ou **Claude Max** (100$ /mois) – Usage illimite recommande
VS Code avec extension Claude (si disponible)

Workflow « Vibe Coding » (methode 2025):

Wireframe ASCII – Visualiser sans coder
Requirements – Definir specifications
Rules – Etablir contraintes techniques
Execution – Laisser Claude generer code

Exemple session Claude Code:

/wordpress-local

[Claude analyse automatiquement votre environnement WordPress local]

Vous: Je veux creer un plugin de gestion d'inventaire pour WooCommerce
avec les fonctionnalites suivantes:
- Alertes stock bas
- Import CSV produits
- Dashboard avec graphiques
- API REST pour integration tierce

Utilise:
- WordPress Coding Standards
- React pour dashboard
- Chart.js pour graphiques
- WP-CLI pour commandes

Claude: [Genere architecture complete + code en 15-20 minutes]

Source: How I Vibe Code WordPress Plugin in 50min – Nathan Onn

B. Custom instructions pour Claude (contexte WordPress)

Fichier .claude-instructions (racine projet):

# WordPress Development Context

## Environment
- WordPress Version: 6.7+
- PHP Version: 8.3
- Database: MariaDB 10.11
- Server: Nginx + PHP-FPM

## Coding Standards
- Follow WordPress Coding Standards (WPCS)
- Use WordPress functions over native PHP when possible
- Sanitize inputs, escape outputs
- Use prepared statements for database queries
- Add nonce verification for forms
- Use wp_enqueue_script/style for assets

## Naming Conventions
- Plugin prefix: `yawc_`
- Text domain: `your-awesome-wordpress-course`
- Hook prefix: `yawc_`

## Security Requirements
- Validate and sanitize all inputs
- Escape all outputs
- Use nonces for form submissions
- Check user capabilities
- Prepare database queries

## Performance
- Minimize database queries
- Use transients for caching
- Enqueue scripts in footer when possible
- Conditional loading (only load when needed)

## Preferred Patterns
- Object-oriented for plugins
- Singleton pattern for main plugin class
- Action/Filter hooks over direct function calls
- WP-CLI commands for admin tasks

C. Prompts efficaces pour developpement WordPress

Generation plugin complet:

Cree un plugin WordPress "Advanced Contact Form" avec:

Architecture:
- Namespace: AdvancedContactForm
- Classe principale singleton
- Separation concerns (Admin, Frontend, API)

Fonctionnalites:
1. Shortcode [acf_form]
2. Gutenberg block
3. Validation AJAX
4. Stockage submissions en CPT
5. Export CSV admin
6. API REST endpoint
7. Hooks pour extensions

Requirements techniques:
- WordPress 6.4+
- PHP 8.2+
- Coding Standards WordPress
- Inline documentation PHPDoc
- Internationalisation complete
- Uninstall cleanup

Genere structure complete avec tous fichiers.

Debugging assistance:

J'ai cette erreur WordPress:

[Error log content]

Context:
- Plugin: [nom]
- Fonction: [fonction]
- Action declenchante: [action]

Analyse l'erreur, identifie la cause racine et propose solution + code corrige.

Optimisation performance:

Analyse cette fonction WordPress et optimise-la pour performance:

[Code a optimiser]

Focus sur:
- Reduction requetes DB
- Utilisation caching
- Optimisation boucles
- N+1 queries

Fournis version optimisee + explication changements.

5.2 ChatGPT pour taches rapides et repetitives

Comparaison ChatGPT vs Claude (WordPress 2025):

Claude Pro:

Architecture et planification
Analyse codebase large (200K tokens)
Debugging complexe
Refactoring

ChatGPT Pro:

Code generation rapide
Taches repetitives
Snippets code
Documentation

Source: ChatGPT Pro vs Claude Pro WordPress Development – Varun Dubey

Approche hybride recommandee (2025):

Planning/Architecture → Claude Pro
Implementation rapide → ChatGPT Pro + GitHub Copilot
Debugging complexe → Claude Code
Documentation → ChatGPT

B. ChatGPT pour generation code snippets

Prompt template efficace:

Cree un snippet WordPress pour [fonctionnalite]

Contraintes:
- Compatible WordPress 6.4+
- Suit WordPress Coding Standards
- Inclut sanitization/validation
- Ajoute comments inline
- Gere erreurs

Format: Code pret a copier-coller dans functions.php ou plugin

Exemples use cases:

Custom post type:

Cree un CPT "Portfolio" avec:
- Taxonomies: Type (hierarchique), Tags (non-hierarchique)
- Supports: title, editor, thumbnail, excerpt
- Archive publique
- REST API enabled
- Icone dashicons-portfolio
- Rewrite slug: /projets/

Custom REST endpoint:

Cree endpoint REST WordPress:

GET /wp-json/myapi/v1/stats

Response:
{
  "total_posts": int,
  "total_users": int,
  "popular_tags": array
}

Securite: Accessible seulement admin
Cache: 1 heure via transients

C. GitHub Copilot integration

Installation VS Code:

# Extension GitHub Copilot
code --install-extension GitHub.copilot

Settings optimaux WordPress (settings.json):

{
  "github.copilot.enable": {
    "*": true,
    "yaml": true,
    "plaintext": false,
    "markdown": true,
    "php": true
  },
  "github.copilot.advanced": {
    "language": {
      "php": {
        "completions": {
          "wordpress": true
        }
      }
    }
  }
}

Workflow recommande:

Developpement general → GitHub Copilot (inline suggestions)
Questions complexes → Claude Code (browser tab ouvert)
Snippets rapides → ChatGPT (second ecran)

Source: 7 Smart Ways to Use AI in WordPress – Kinsta

5.3 Automatisation workflows avec IA

A. Uncanny Automator + OpenAI/Claude

Plugin: Uncanny Automator Pro (integration OpenAI et Anthropic Claude)

Use cases automatisation:

1. Moderation commentaires intelligente:

Trigger: Nouveau commentaire soumis
Action: Envoyer a Claude API
Prompt: "Analyse ce commentaire et determine s'il est:
- Spam
- Inapproprie
- Legitime

Commentaire: {{comment_content}}
Auteur: {{comment_author}}"

Condition:
- Si "spam" ou "inapproprie" → Marquer spam
- Si "legitime" → Approuver

2. Generation descriptions produits WooCommerce:

Trigger: Nouveau produit publie sans description
Action: Envoyer a ChatGPT API
Prompt: "Genere description produit SEO-optimisee (150-200 mots) pour:

Nom: {{product_name}}
Categorie: {{product_category}}
Attributs: {{product_attributes}}

Ton: Professionnel, persuasif
Focus: Benefices client"

Action: Mettre a jour post_content du produit

3. Reponses emails personnalisees:

Trigger: Soumission formulaire contact
Action: Envoyer a Claude API avec historique client
Prompt: "Genere reponse personnalisee basee sur:

Message client: {{form_message}}
Historique: {{user_purchase_history}}
Categorie question: {{form_category}}

Ton: Amical, professionnel
Longueur: 100-150 mots"

Action: Envoyer email + ajouter tag CRM

B. WP-CLI + IA pour maintenance automatisee

Script analyse securite avec Claude API:

#!/bin/bash
# audit-security-ai.sh

SITE_PATH="/var/www/example.com/htdocs"
CLAUDE_API_KEY="your-api-key"

# Generer rapport WPScan
wpscan --url https://example.com --format json > /tmp/wpscan-report.json

# Envoyer a Claude pour analyse
REPORT=$(cat /tmp/wpscan-report.json)

RESPONSE=$(curl -s https://api.anthropic.com/v1/messages \
  -H "x-api-key: $CLAUDE_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d "{
    \"model\": \"claude-3-5-sonnet-20241022\",
    \"max_tokens\": 2048,
    \"messages\": [{
      \"role\": \"user\",
      \"content\": \"Analyse ce rapport WPScan et fournis recommandations priorisees pour securiser le site. Focus sur vulnerabilites critiques et actions immediates.\n\nRapport:\n$REPORT\"
    }]
  }")

# Extraire recommandations et envoyer par email
echo "$RESPONSE" | jq -r '.content[0].text' | mail -s "Audit Securite IA - $(date)" admin@example.com

C. Generation contenu avec IA + publication automatique

Plugin: AI Engine + WP Cron

Workflow blog automatise:

// functions.php - Generer article hebdomadaire

add_action('ai_weekly_post_generation', 'generate_ai_weekly_post');

function generate_ai_weekly_post() {
    // Topics pre-definis
    $topics = get_option('ai_blog_topics', [
        'WordPress performance optimization',
        'Security best practices',
        'Plugin development tutorials'
    ]);

    $random_topic = $topics[array_rand($topics)];

    // API OpenAI
    $prompt = "Ecris article blog 800-1000 mots sur: $random_topic

    Structure:
    - Introduction accrocheuse
    - 3-4 sections avec sous-titres H2
    - Exemples concrets
    - Conclusion avec CTA

    Ton: Expert mais accessible
    SEO: Inclure mot-cle naturellement 5-7 fois";

    $response = openai_completion([
        'model' => 'gpt-4-turbo',
        'messages' => [
            ['role' => 'system', 'content' => 'Tu es expert WordPress et redacteur technique.'],
            ['role' => 'user', 'content' => $prompt]
        ],
        'max_tokens' => 2000
    ]);

    $content = $response['choices'][0]['message']['content'];

    // Creer brouillon
    $post_id = wp_insert_post([
        'post_title'   => "AI Generated: $random_topic",
        'post_content' => $content,
        'post_status'  => 'draft',
        'post_author'  => 1,
        'post_category'=> [get_cat_ID('AI Content')]
    ]);

    // Notifier admin pour review
    wp_mail(
        get_option('admin_email'),
        'Nouveau brouillon IA genere',
        "Article genere sur: $random_topic\nReview: " . get_edit_post_link($post_id)
    );
}

// Scheduler hebdomadaire
if (!wp_next_scheduled('ai_weekly_post_generation')) {
    wp_schedule_event(time(), 'weekly', 'ai_weekly_post_generation');
}

5.4 Cas d’usage avances IA WordPress

A. Refactoring legacy code avec Claude

Prompt structure:

Refactore ce code WordPress legacy vers modern standards:

[Ancien code]

Requirements:
- PHP 8.3 compatible
- Object-oriented
- WordPress Coding Standards
- Type hints strict
- Error handling robuste
- PHPDoc complete
- Backward compatibility optionnelle

Explique changements majeurs et rationale.

B. Generation tests unitaires automatique

Prompt ChatGPT:

Genere tests PHPUnit pour cette classe WordPress:

[Code classe]

Coverage requise:
- Tous methodes publiques
- Edge cases
- Error handling
- WordPress integration (use Brain\Monkey)

Format: PHPUnit 10+ compatible

C. Optimisation requetes base de donnees

Prompt Claude:

Analyse ces logs Query Monitor et optimise les requetes problematiques:

[Query logs]

Focus:
- Eliminer N+1 queries
- Ajouter index appropries
- Utiliser WP_Query efficacement
- Implementer object caching

Fournis:
1. SQL index a creer
2. Code optimise
3. Impact performance estime

D. Creation documentation automatique

Script avec ChatGPT API:

#!/bin/bash
# generate-docs.sh

# Extraire tous fichiers PHP plugin
PLUGIN_DIR="/var/www/example.com/htdocs/wp-content/plugins/mon-plugin"
PHP_FILES=$(find "$PLUGIN_DIR" -name "*.php")

# Concatener code source
CODE=""
for file in $PHP_FILES; do
    CODE+="=== $file ===\n"
    CODE+=$(cat "$file")
    CODE+="\n\n"
done

# Generer documentation via ChatGPT
curl -s https://api.openai.com/v1/chat/completions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
    \"model\": \"gpt-4-turbo\",
    \"messages\": [{
      \"role\": \"user\",
      \"content\": \"Genere documentation technique complete pour ce plugin WordPress. Inclus: architecture, hooks disponibles, exemples utilisation, API reference.\n\nCode:\n$CODE\"
    }],
    \"max_tokens\": 4000
  }" | jq -r '.choices[0].message.content' > "$PLUGIN_DIR/DOCUMENTATION.md"

echo "Documentation generee: $PLUGIN_DIR/DOCUMENTATION.md"

Projet pratique Phase 5

Integration IA complete dans workflow:

Configurer Claude Pro + ChatGPT Pro
Installer GitHub Copilot dans VS Code
Creer plugin WordPress complet avec assistance Claude (30-60min)
Generer tests unitaires automatiques avec ChatGPT
Implementer automatisation Uncanny Automator + OpenAI
Creer script maintenance assiste IA (audit securite, optimization)
Generer documentation automatique projet
Mesurer gains productivite (temps avant/apres IA)

Livrable:

Plugin fonctionnel genere avec IA
Documentation complete auto-generee
Scripts automatisation
Rapport gains productivite (estimation 40-60% reduction temps developpement)

Ressources:

Projet Final : Deploiement Infrastructure Production Complete

Objectif

Deployer une infrastructure WordPress production complete integrant toutes competences acquises.

Specifications techniques

Infrastructure:

VPS Debian 12 (8GB RAM, 4vCPU, NVMe)
WordOps stack optimise
Multi-environnements (staging + production)
Monitoring complet

Performance:

Cache Nginx FastCGI + Redis Object Cache
CDN Cloudflare configure
Optimisations images (AVIF/WebP)
Score PageSpeed > 90

Securite:

Hardening complet wp-config.php
WAF niveau application
2FA tous administrateurs
Headers securite HTTP
SSL A+ rating

CI/CD:

Repository Git structure
GitHub Actions pipelines (staging + production)
Tests automatises (PHPUnit, PHPCS, PHPStan)
Deploiements automatiques
Rollback automatique si echec

Monitoring:

Netdata metriques serveur
New Relic APM
Query Monitor WordPress
Uptime monitoring externe
Alertes Slack/Email

IA Integration:

Workflows assistes Claude/ChatGPT
Automatisations Uncanny Automator
Scripts maintenance IA

Livrables

Documentation technique complete:
- Architecture infrastructure
- Procedures deploiement
- Runbooks incidents
- Guide maintenance
Repository Git:
- Code source organise
- Workflows CI/CD fonctionnels
- Tests automatises
- Documentation inline
Dashboards monitoring:
- Screenshots Netdata
- Rapports New Relic
- Audits performance (GTmetrix, PageSpeed)
Rapport performance:
- Benchmarks charge (k6, Apache Bench)
- Metriques Core Web Vitals
- Capacite utilisateurs concurrents
- TTFB, LCP, FID, CLS
Audit securite:
- Rapport WPScan
- Scan headers (SecurityHeaders.com)
- SSL Labs rating
- Procedures incident response

Criteres evaluation

Performance: TTFB < 200ms, PageSpeed > 90, 500+ utilisateurs concurrents
Securite: Zero vulnerabilites critiques, A+ SSL, tous headers securite
CI/CD: Deploiement automatique < 5min, tests passes 100%
Monitoring: Alertes fonctionnelles, metriques collectees
Documentation: Complete, claire, reproductible

Ressources Complementaires

Documentation officielle

Outils performance

Outils securite

Communautes

Formation continue

Conclusion

Ce parcours intermediaire vous a equipe des competences essentielles pour gerer des infrastructures WordPress production haute performance. Vous maitrisez desormais:

Le deploiement et l’optimisation de stacks VPS avec WordOps
L’implementation de caches multi-couches (Nginx FastCGI + Redis)
Les techniques de hardening securite 2025 (face a 7966+ vulnerabilites annuelles)
L’automatisation complete CI/CD avec GitHub Actions
L’optimisation performance grande echelle (Core Web Vitals, CDN, database)
L’integration workflows IA pour accelerer productivite 40-60%

Prochaines etapes: Parcours Avance – Architecture haute disponibilite, Kubernetes WordPress, scaling horizontal, disaster recovery.

Duree moyenne realisation: 12-16 semaines a raison de 15-20h/semaine.

Bon courage dans votre apprentissage!

Version: 1.0 Derniere mise a jour: Decembre 2025 Auteur: You Are Welcome Community License: CC BY-SA 4.0

Sources

Ce parcours s’appuie sur des donnees verifiees et des guides techniques publies en 2025:

Vue d’ensemble

Phase 1 : Infrastructure VPS & Stack Haute Performance

Objectifs

Competences techniques

1.1 Preparation VPS Debian

1.2 Installation et configuration WordOps

1.3 Cache multi-couches : Nginx FastCGI + Redis Object Cache

1.4 Optimisations serveur avancees

Projet pratique Phase 1

Phase 2 : Securite Production & Hardening

Objectifs

Contexte menaces 2025

Competences techniques

2.1 Hardening wp-config.php

2.2 Permissions fichiers et verrouillage systeme

2.3 Protection authentification avancee

2.4 Web Application Firewall (WAF) niveau application

2.5 Discipline mises a jour et gestion vulnerabilites

2.6 Headers de securite HTTP

Projet pratique Phase 2

Phase 3 : CI/CD avec GitHub Actions

Objectifs

Competences techniques

3.1 Structure repository Git pour WordPress

3.2 GitHub Actions workflow – Deploiement Staging

3.3 GitHub Actions workflow – Deploiement Production

3.4 Workflow qualite code

3.5 Configuration secrets GitHub

3.6 Deploiement avec Deployer.org (alternative)

Projet pratique Phase 3

Phase 4 : Performance a Grande Echelle

Objectifs

Competences techniques

4.1 Core Web Vitals et optimisation 2025

4.2 Optimisation images moderne

4.3 Optimisation frontend avancee

4.4 CDN et optimisations edge

4.5 Base de donnees haute performance

4.6 Monitoring et observabilite

Projet pratique Phase 4

Phase 5 : Workflows Assistes par IA

Objectifs

Competences techniques

5.1 Claude Code pour developpement WordPress

5.2 ChatGPT pour taches rapides et repetitives

5.3 Automatisation workflows avec IA

5.4 Cas d’usage avances IA WordPress

Projet pratique Phase 5

Projet Final : Deploiement Infrastructure Production Complete

Objectif

Specifications techniques

Livrables

Criteres evaluation

Ressources Complementaires

Documentation officielle

Outils performance

Outils securite

Communautes

Formation continue

Conclusion

Sources

Performance WordPress

CI/CD et GitHub Actions

WordOps et VPS

Securite WordPress

Cache et Performance

IA et WordPress

Articles similaires

Une remarque, un retour ?

Parcours : Remplacer les services cloud, chez soi

Parcours : Administrer son homelab avec un assistant IA

Parcours d’Apprentissage : Homelab Proxmox sur Minisforum MS-01