PHP Testing and Profiling Tools for WordPress Developers

If you write PHP for WordPress themes or plugins, these are the tools that catch bugs before your users do and show you where your code is slow. They're grouped by job: testing, static analysis and profiling, with a short starting plan at the end.

WordPress is written in PHP and runs a large share of the web, so it's a constant target. Untested and unchecked PHP is where many of those problems start.

Testing: does the code do what it should?

PHPUnit

The standard unit-testing framework for PHP. You write small tests for individual functions and classes and run them after every change. WordPress core uses PHPUnit, and WP-CLI's wp scaffold plugin-tests my-plugin sets up a plugin test suite based on it.

Codeception

A testing toolkit that handles unit, functional and acceptance tests in one place. Pair it with wp-browser to test a WordPress site end to end: logging in, filling in forms, checking that pages show what they should.

Selenium WebDriver

Selenium drives a real browser, so you can test what users actually see and click. Codeception can use it under the hood. It earns its keep on checkout flows and anything that depends on JavaScript.

Load testing: Apache JMeter and Siege

Unit tests tell you the code is correct. Load tests tell you whether it stays fast when many people use it at once. Siege is a quick command-line tool for hitting a URL with concurrent requests. JMeter builds more realistic scenarios, with logins and multi-step journeys.

Code coverage

Code coverage measures how much of your code runs when your tests run. The usual figure is line coverage: the percentage of lines executed at least once. PHPUnit reports it when Xdebug or PCOV is installed, for example with phpunit --coverage-html coverage/. Use it to find untested code, not as a score to chase.

Run tests faster and automatically

Once a suite gets slow, ParaTest runs PHPUnit tests in parallel across CPU cores. And run your tests on every push with a CI service such as GitHub Actions, GitLab CI or Jenkins, so a broken change never reaches a live site.

Static analysis: catch problems without running the code

There are several kinds of static analysis tools. These are the ones that matter for PHP.

PHP_CodeSniffer (PHPCS) with WordPress Coding Standards

PHPCS checks your code against a coding standard. With the WordPress Coding Standards ruleset it also flags common security mistakes, such as output that isn't escaped and input that isn't sanitised.

PHPCompatibility and PHPCompatibilityWP

A PHPCS ruleset that checks your code against a range of PHP versions. For WordPress projects, use PHPCompatibilityWP. Run it before raising your plugin's minimum PHP version, or before your host upgrades PHP.

PHPStan

Finds bugs from types and logic: calling a method on something that might be null, passing the wrong argument type, unreachable code. Start at a low rule level and raise it as you clean up. The szepeviktor/phpstan-wordpress extension teaches PHPStan about WordPress functions and hooks.

PHPMD (PHP Mess Detector)

PHPMD flags unused variables, dead code and functions that have grown too complex to maintain.

PHP lint

php -l file.php checks one file for syntax errors. PHPLint runs the same check across a whole project quickly, which makes it a good first step in CI.

Profiling: where is the time going?

Query Monitor

The first thing to install when a WordPress page is slow. It shows every database query and which plugin or theme ran it, slow and duplicate queries, PHP errors, hooks, and HTTP API calls, all from the admin bar.

Xdebug

Xdebug is a PHP extension for step debugging and profiling. In profiling mode it writes cachegrind files that record how long each function took and how often it was called. It also gives much more detailed error output while you develop. Keep it off on production, because it slows PHP down noticeably.

Webgrind

Webgrind is a small web interface for reading Xdebug's profiling files. Open it in the browser, choose a profile, and sort functions by time spent or by call count. If one function dominates, that's where to look. FreePBX has a good walkthrough of profiling with Xdebug and Webgrind.

Blackfire

Blackfire is a commercial profiler with a free trial. It profiles with low overhead, compares runs before and after a change, and can run performance tests in CI. Use it on staging, or carefully on production, when Xdebug is too heavy.

Where to start

For a typical theme or plugin:

1. Add PHPCS with WordPress Coding Standards and fix what it reports.
2. Install Query Monitor on your development site and open your slowest page.
3. Write PHPUnit tests for the functions that handle money, permissions or user data.
4. Reach for Xdebug with Webgrind, or Blackfire, when Query Monitor shows the time is spent in PHP rather than the database.

If the code is fine and the site is still slow, the server is the next place to look: see how to speed up WordPress with server caching. For more on structuring plugin code, read design patterns in WordPress plugins, and for block development, fixing Gutenberg block validation errors.