Coywolf Custom Blocks — PHP Templates

Companion for Coywolf Custom Blocks that executes PHP inside block templates. Install it alongside the main plugin and any <?php … ?> in a block's Custom HTML or Preview HTML runs on the server at render time — exactly as it did when this mechanism was built into the main plugin (≤ 1.0.69).

• Version: 1.0.2
• Requires WordPress: 6.0 or later
• Requires PHP: 7.0 or later
• Requires plugin: Coywolf Custom Blocks 1.0.70 or later
• License: GPL-2.0-or-later

Description

Coywolf Custom Blocks renders block templates authored in the WordPress admin. Templates written as plain HTML — including {{field}} substitution, {{#if}} / {{#each}} logic, scripts, and iframes — render through the main plugin alone. Templates containing PHP need this companion: the main plugin detects a PHP open tag in the admin-authored template and hands the substituted markup to this plugin's executor through the coywolf_custom_blocks_execute_php_template filter. Without the companion, those blocks render an explanatory HTML comment instead.

Why a separate plugin? The WordPress.org plugin directory forbids executing user-supplied code stored in the database, in any form. Splitting the executor out keeps the main plugin eligible for the directory while sites that want in-admin PHP templates — the same trust level WordPress itself grants administrators through Appearance → Theme File Editor — install this companion from GitHub.

How it executes: the substituted template is written to a content-hashed cache file under wp-content/uploads/coywolf-custom-blocks/templates/ (protected by a Deny from all .htaccess and an index.php) and included with output buffering. Identical templates share one cache file; editing a template produces a new hash; stale files are pruned after 30 days and the whole cache is removed on uninstall.

Installation

1. Install and activate Coywolf Custom Blocks 1.0.70 or later.
2. Go to the latest release of this plugin and download coywolf-custom-blocks-php-templates.zip under Assets.
3. In WordPress, go to Plugins → Add New → Upload Plugin, upload the zip, and click Activate.

Once installed, updates surface on Dashboard → Updates through the built-in GitHub self-updater (downloads restricted to GitHub-owned hosts).

Frequently Asked Questions

Who can write PHP templates?

Editing a coywolf_custom_block post requires manage_options — the same capability that gates Appearance → Theme File Editor. Field values entered by post authors pass through wp_kses_post() and cannot introduce PHP; only the admin-authored template itself executes.

What happens if I deactivate or delete this plugin?

Nothing breaks destructively: blocks whose templates contain PHP render an HTML comment explaining the companion is needed, and everything else renders normally. Block definitions live in the main plugin's data. Reinstalling the companion restores PHP rendering immediately. Uninstalling deletes this plugin's release-cache transients and the compiled-template cache directory.

Will this ever be on WordPress.org?

No — executing database-stored PHP is precisely what the directory disallows. This companion exists so the main plugin can be compliant while this capability remains available from GitHub.

Privacy

No analytics, no tracking, no data gathering. The only outbound request is GET api.github.com/repos/coywolf-llc/custom-blocks-php-templates/releases/latest for update checks.

Changelog

1.0.2

• Harden executor cache: direct-access guard + memoize cache dir (#4).

1.0.1

• Updater: run GitHub release checks in the background so the Updates screen never hangs (#3).

1.0.0

• Initial release: the PHP-template executor moved here from Coywolf Custom Blocks ≤ 1.0.69, hooked to the main plugin's coywolf_custom_blocks_execute_php_template filter. Same cache location, same trust model, same output.