Create a Simple WordPress Shortcode with a Safe PHP Snippet

If PHP pasted into a post, page, or widget is not working, the safest fix is to move that logic into a small site-specific plugin and expose it with a shortcode. WordPress shortcodes are meant for this job: editors place a tag in content, while PHP stays in a controlled file.

Quick Checks Before Adding Code

Confirm these first:

• You have SFTP, hosting file manager, or a trusted plugin editor workflow available.
• You can remove or rename the snippet if it breaks the site.
• You are not placing PHP directly inside the WordPress editor. WordPress documents shortcodes in the official Shortcode API guide as a way to add dynamic output inside content.
• You know the exact shortcode name you want to use. Avoid generic names such as [button] or [notice], because another plugin may already use them.

For the example below, the shortcode will be:

[bugwp_notice text="Shipping delay: orders may take two extra days."]

Safest Fix Order

Use a site-specific plugin when possible. It keeps the shortcode separate from the theme, so the shortcode does not disappear when you switch or update themes.

1. Back up the site or confirm your host has a recent restore point.
2. Open SFTP or your hosting file manager.
3. Go to wp-content/plugins/.
4. Create a folder named bugwp-simple-shortcode.
5. Inside it, create bugwp-simple-shortcode.php.
6. Add this PHP:

<?php
/**
 * Plugin Name: BugWP Simple Shortcode
 * Description: Adds the [bugwp_notice] shortcode.
 * Version: 1.0.0
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

function bugwp_simple_notice_shortcode( $atts ) {
	$atts = shortcode_atts(
		array(
			'text' => 'This is a short notice.',
		),
		$atts,
		'bugwp_notice'
	);

	return '<p class="bugwp-notice">' . esc_html( $atts['text'] ) . '</p>';
}
add_shortcode( 'bugwp_notice', 'bugwp_simple_notice_shortcode' );

1. In wp-admin, go to Plugins and activate BugWP Simple Shortcode.
2. Add the shortcode to a post, page, or block that supports shortcode text:

[bugwp_notice text="Shipping delay: orders may take two extra days."]

The WordPress Shortcode API expects shortcode handlers to return content, not print it directly. The snippet also escapes the visible text with esc_html() so visitor-controlled shortcode text is not rendered as raw HTML.

If You Prefer a Snippet Plugin

A code-snippet plugin can also work if your site already uses one and it has a recovery mode or safe deactivation option. A site-specific plugin is still the cleaner default for this issue because the shortcode lives in a normal plugin folder that can be renamed or removed through SFTP if PHP fails. Add only the function and add_shortcode() line there, not the plugin header.

Avoid putting this in a parent theme’s functions.php. Theme updates can overwrite it, and a PHP mistake in functions.php can take down both the front end and wp-admin.

How to Confirm It Worked

Open the page where you placed the shortcode and check for the notice text.

If the page still shows the literal shortcode, such as [bugwp_notice text="..."], check these points:

• The plugin is active.
• The shortcode name in the content exactly matches bugwp_notice.
• The shortcode is in normal post/page content or a block that processes shortcodes.
• No caching plugin or host cache is serving an older page.

If the page loads but the text is wrong, simplify the shortcode temporarily:

[bugwp_notice]

That should show the default message from the snippet. If it does, the shortcode is registered and the issue is probably the attribute text you entered.

Roll Back Safely

If the site shows a fatal error after adding the file, do not keep refreshing wp-admin. Use SFTP or your hosting file manager and rename the plugin folder:

bugwp-simple-shortcode-disabled

That deactivates the plugin because WordPress can no longer find it at the original folder name.

If you need more detail, enable WordPress debugging only long enough to inspect the problem. WordPress documents WP_DEBUG and WP_DEBUG_LOG in its official debugging guide, and those logs are usually more useful than guessing from a blank screen.

When to Contact Hosting Support

Contact your host if you cannot access SFTP or the file manager, the file cannot be removed, or the site still shows a fatal error after the plugin folder is renamed. Ask them to disable the plugin folder you just created and check the PHP error log for the exact fatal error line.