All you need to know about building a webdevelopment environment on OSX
You know the drill; you add a couple of Header directives to your .htaccess (a cache-control here, an X-Frame-Options there) you reload the page, you check the response headers and… nothing. No error, no warning, no headers. Just… nothing.
Welcome to debugging something that isn’t broken. My favorite pastime! (It is not.) Continue reading “Set-up additional Apache modules in LocalWP – because sometimes, defaults aren’t good enough [A LocalWP Addon].”
Click Trust next to your site’s SSL certificate in Local. Enter your admin password like a good citizen. Watch it report success. Open https://mysite.local and… “Your connection is not private”. Click Trust again. Password again. Success again. Warning again.
Insanity, as the saying goes, is clicking the same button twice and expecting different results. Or something like that.
On modern macOS, Local’s Trust button doesn’t work. Well it does, but not for you. It shows the password prompt, appears to succeed, and changes absolutely nothing; browsers keep screaming about your .local certificate forever. And because it looks like it worked, you naturally assume the problem is elsewhere; your browser cache, your cert, your karma. It isn’t. It’s the button. Continue reading “Local’s SSL “Trust” button is BROKEN on macOS. Here’s why, and here’s the fix. [A LocalWP Addon].”
Connect a classic client (for example Sequel Pro, older Sequel Ace, older JDBC tools) to a Local site running MySQL 8 and you’re greeted with authentication errors about caching_sha2_password.
(I talked about this already, here)
The classic clients speak mysql_native_password; MySQL 8 defaults to the new plugin, and on 8.4+ the old plugin isn’t just non-default, but (and in my opinion, this is a bug of omission) it ships disabled.
Meanwhile Local’s own connections work fine, so from Local’s point of view there is no bug. From MY point of view, sitting in front of a client that can’t connect to my own database; there very much is. Continue reading “Sequel Pro can’t connect to Local’s MySQL 8? MySQL Fixes AddOn to the rescue [A LocalWP Addon].”
A vulnerability has been discovered in Contact Form 7 that allows an attacker to upload malicious scripts. The publishers of Contact Form 7 have released an update to fix the vulnerability.
Unrestricted File Upload Vulnerability…
Noooo, I’m not going to steal/copy/plagiarize this article, just read the article on CVE 2020 35489 on searchenginejournal.com.
But I do have something to add. Continue reading “This just in: Contact-Form-7 (WordPress) Vulnerability – 5 million websites at risk – CVE-2020-35489”
[Edit: This script is defunct since Local rebuilt the application and ditched the virtual machine. This script works only with the old “Local by Flywheel” and not with the “Local Lightning” app. For the latter, see my lbl script]
Local (by Flywheel) is great, but for a terminal type of person as I am, I find it way more convenient to SSH into a VM and use the WP-CLI to perform WordPress tasks. With a platform like Vagrant, one has the
![Set-up additional Apache modules in LocalWP – because sometimes, defaults aren’t good enough [A LocalWP Addon].](https://remonpel.nl/wp-content/uploads/2026/08/LocalWP-Addon-Apache-Modules.png)
![Local’s SSL “Trust” button is BROKEN on macOS. Here’s why, and here’s the fix. [A LocalWP Addon].](https://remonpel.nl/wp-content/uploads/2026/08/LocalWP-Addon-Trust-SSL-on-MacOS.png)
![Sequel Pro can’t connect to Local’s MySQL 8? MySQL Fixes AddOn to the rescue [A LocalWP Addon].](https://remonpel.nl/wp-content/uploads/2026/08/LocalWP-Addon-MySQL-Fixes.png)
vagrant sshWith Local, you can do this with the push of a button in Local, but as said, I like the terminal better.
lbf sshBut wait, there is much more ;) Continue reading “Handy script: lbf”
Working with the WordPress REST-API is HELL. There. I said it. It is powerful, it is secure, it is everything a developer needs, but for the love of [fill in your favorite deity here], WordPress, be consistent!
Using the REST-API requires authentication. Well, that’s not a problem. Just create a route to log-in and one to log-out. WordPress has functions to do that.
wp_signon()wp_logout()The first hurdle is getting the WordPress REST API to function. Oh, wait, you need a nonce ?! Well, thank you WordPress for this ‘security’-measure. For everything else in WordPress the authentication cookies you get when logging in to /wp-admin are enough, but for REST-API you need a nonce … the F why !?
Sorry, but this is just NONCE-SENSE! Pun intented. If only it were funny. Continue reading “WordPress REST-API nonce-sense.”
Quick Tip
So you have this very fast AJaX page loader (InstantClick) on your website, but you want to use Google Tag Manager and track your pageview with Analytics etc; here’s how you reset Tag Manager and re-load it after your AJaX page is loaded; Continue reading “Google Tag Manager restart after AJaX page-reload”
[UPDATE] WPML has released a new version with a permanent fix, download version 3.8.4 from wpml.org.
BREAKING NEWS … Literally!
If you experience inexplicable 404s on your WordPress site after you updated to version 4.8.3, and you are using WPML (sitepress multilingual cms) version 3.8.0 or higher, you will need a fix. (Duh!)
The cause is WPML not properly using WPDB->prepare(); [UPDATE] is too late with adding/removing the filters on the query. The priority is now fixed from 10 to -1.
A multitude of recent developments have aided me to make a choice. Some of them are
While the new Macbook Pro is quite a feet of engineering, it is hardly “Pro”. Surely intel graphics are enough for typing letters and calculating spreadsheets, it’s not Pro. A 16GB memory limit (which with the compression tech used is like 24GB for any other OS) is great for battery life, but it’s not “Pro”. The keyboard is ultra thin and has good tactile feedback, but the keys need a firm press, and travel almost nothing. Great for thinning the device, but again, not “Pro”. For the same amount of money you can buy a portable powerhouse like the Asus ROG G752vy (seen in my post about this). This one has other issues, but at least it has got awesome graphics (nVidia 980), max 64 GB RAM and a “normal” laptop keyboard.
(Yeah, I know, I KNOW, I don’t need ‘awesome graphics’ for web development, but I like to game also, and to be honest; my favorite IDE – phpStorm – DOES prefer a sturdy GPU. Don’t know why, but it runs so much better on a discrete GPU than it does on intel Graphics)
Reasons to stay with macOS are rapidly diminishing, and reasons to start using Windows again are gaining support. Since the Windows 10 Anniversary Update, Windows offers Bash and all goodness that comes with Ubuntu linux, right at your fingertips. Well, not ALL goodness, but most of it.
Hello, macOS Sierra!
macOS… that name… so… long… ago…
It has been, what?, 11 years? 12? … System 9, that was the last OS to be called macOS. The name change does not change anything regarding the update cycle, although on one of my macs, the upgrade went horrifically bad! I ended up rebooting in Recovery mode and installing macOS from there.
For getting the development enviroment back up, not much to be done!
Apache could not find the default server certificates in
/private/etc/apache2/server.crt/etc/apache2/extra/httpd-ssl.confsudo nano /etc/apache2/extra/httpd-ssl.confsudo apachectl restartAs always; feel free to comment or ask questions :)