Fallback subtitle
``` Do not delete useful fallback markup. If the source is missing, disabled, or returns no usable value, a stable fallback makes the content more portable. ## Supported attributes in WordPress 7.1 Core's default list is: | Block | Attributes | |---|---| | `core/paragraph` | `content` | | `core/heading` | `content` | | `core/list-item` | `content` (added in 7.1) | | `core/image` | `id`, `url`, `title`, `alt`, `caption` | | `core/button` | `url`, `text`, `linkTarget`, `rel` | | `core/post-date` | `datetime` | | `core/navigation-link`, `core/navigation-submenu` | `url` | Query the truth with `get_block_bindings_supported_attributes( $block_type )`; do not freeze this table into plugin logic. For a custom block or deliberately supported attribute, extend the list narrowly: ```php add_filter( 'block_bindings_supported_attributes_acme/card', static function ( array $attributes ): array { $attributes[] = 'title'; return array_values( array_unique( $attributes ) ); } ); ``` Only expose attributes whose render pipeline correctly consumes the bound value. A filter entry alone cannot repair custom rendering that ignores parsed attributes. ## Editor registration is a separate concern PHP registration makes frontend/server rendering work. Register the same source in the editor when users need previews, editing, or the binding picker. The editor contract can provide `getValues`, `setValues`, `canUserEditValue`, and, since 6.9, `getFieldsList`. Use `useBlockBindingsUtils()` from `@wordpress/block-editor` to update or remove `metadata.bindings`; do not hand-mutate nested block attributes. Keep the source name and argument schema identical in PHP and JavaScript. Read [references/editor-and-security.md](references/editor-and-security.md) before implementing editable bindings. ## Core sources Prefer an existing Core source when it fits, notably `core/post-meta`, `core/post-data`, `core/term-data`, or `core/pattern-overrides`. For post meta, register the field correctly and expose it to REST/editor contexts as required. Protected meta is not made public merely because a block references it, but your custom callback can accidentally leak it if it skips authorization and context checks. ## Performance rules Binding callbacks can run once per bound attribute for every rendered block. - Never issue an uncached remote request per callback. - Cache repeated lookups within the request by source arguments and object ID. - Prime metadata/object caches for repeated objects where appropriate. - Keep callbacks deterministic for the same render context; randomness breaks page caches and editor/frontend parity. - Avoid writes, analytics events, or other side effects in `get_value_callback`. ## Security checklist - Treat `args` and block markup as attacker-controlled input. - Check the current object/site context; do not trust a `postId` supplied in args. - Never return secrets or private metadata to public frontend output. - Enforce capabilities in editor write paths and REST endpoints, not only in UI predicates. - Sanitize for storage in the write API; escape at the final block output context. - Do not return raw HTML for a plain string attribute unless that block's rendering contract safely handles it. ## Verification 1. Assert source registration after `init` with `get_block_bindings_source()`. 2. Render bound markup through `do_blocks()` and check the exact output. 3. Test unknown args, missing object context, deleted source, and `null` return. 4. Test editor preview separately from frontend rendering. 5. Measure query/request counts across a post with many bound blocks. 6. On 7.1, verify `core/list-item` content bindings and backward compatibility for older supported Core versions. ## Related skills - `wordpress/wp-metadata-api` for registered post, user, term, and comment meta. - `wordpress/wp-rest-api` for authorized editor write endpoints. - `wordpress/wp-html-api` for safe rendered-markup changes. - `wordpress/wp-interactivity-api` when the bound output also needs reactive frontend behavior. ## References - Read `references/editor-and-security.md` for editor registration, editing callbacks, permission and caching detail. - Miscellaneous block editor changes in WordPress 7.1 (List Item binding):