In my previous post on How WordPress Boots Up we went over half of the bootup process up to the point where WordPress wp-settings.php returns as a SHORTINIT’ed version, with the barebones of WordPress available, which, though an obscure feature, turns out to be quite useful for environments where only the very core WordPress features are required (especially the database abstraction). I encourage you to at least skim through part one, don’t worry we won’t leave without you.

With, hopefully everyone being up to speed now, let’s open up wp-settings.php in our favourite editor and continue our journey towards the WordPress response to our index request. The SHORTINIT test fails on line 96, so WordPress proceeds with loading everything else:

1. The l10n library, the code of which defines a couple of dozen functions resides in wp-includes/l10n.php. Among these functions are the well-known __() and _e() functions, which expose the power of translations throughout WordPress.
2. wp_not_installed() (defined in wp-includes/load.php) makes use of the is_blog_installed() function (defined in wp-includes/functions.php). A redirect is forced if WordPress is not installed at this point. This is where we branch off into the famous 5-minute WordPress installation, which is out of the scope of this article.
3. 36 files are included, and we’ll quickly go over each one of them:
   1. wp-includes/class-wp-walker.php – defines the Walker (no, not the Texas Ranger) class for displaying various tree-like structures.
   2. wp-includes/class-wp-ajax-response.php – defines the WP_Ajax_Response class, which returns XML responses to AJAX requests.
   3. wp-includes/formatting.php – the main WordPress Formatting API. This file contains function definitions for escaping and sanitization functions, time conversion functions, validation functions, and other useful tools that are used within WordPress, so next time you’re writing a plugin and need a tag balancing function or URL escaping function check to see if the ones defined in this file can be used instead of writing your own.
   4. wp-includes/capabilities.php – defines 3 classes: WP_Role, WP_Roles, WP_User. These combined expose the set of user and role management methods that WordPress makes use of when managing Users in your WordPress Dashboard, and in general when checking user permissions and restrictions.
   5. wp-includes/query.php – defines functions that are part of the WordPress Query API, like is_page(), is_404(), and the WP_Query class which is instantiated into the $wp_query global object, which is used by functions like the_post(), the_comment() which are also defined in this file.
   6. wp-includes/theme.php – defines lots of useful theme-related function such as get_template(), get_stylesheet_uri(), get_404_template(), add_theme_support() and others.
   7. wp-includes/user.php – defines the User API, which includes authentication functions and the WP_User_Query class.
   8. wp-includes/meta.php – defines metadata functions like get_metadata() and the WP_Meta_Query class for multiple metadata queries.
   9. wp-includes/general-template.php – defines general template functions, the most known of which are get_header(), get_footer(), get_sidebar().
   10. wp-includes/link-template.php – defines link template functions, the likes of which you most probably already know – site_url(), previous_post_link(), get_permalink() and many others.
   11. wp-includes/author-template.php – defines author-related template functions like the_author(), the_author_meta(), the_author_posts().
   12. wp-includes/post.php – defines post functions like register_post_type(), get_post(), get_post_meta() and loads of others.
   13. wp-includes/post-template.php – defines post template functions like the_ID() and the_title().
   14. wp-includes/category.php – defines category and tag functions like get_categories() and get_tags().
   15. wp-includes/category-template.php – defines category template functions like the_tags(), the_category().
   16. wp-includes/comment.php – defines functions for comment management, which include get_comments(), wp_allow_comment() when a comment is approved, pingback() and the WP_Comment_Query class (which is the basis for our last week’s Display The Number Of Comments Held For Moderation article).
   17. wp-includes/comment-template.php – defines wp_list_comments(), get_comments_number(), and many others.
   18. wp-includes/rewrite.php – home of the WP_Rewrite class which is the core class of the Rewrite API, which handles request routing. This file defines wrapper functions around the $wp_rewrite global like add_rewrite_rule(), add_rewrite_endpoint() and others. Permalinks, among other core stuff, work thanks to these exposed functions and methods.
   19. wp-includes/feed.php – defines the WordPress Feed API with functions such as get_the_content_feed(), fetch_feed() and other useful stuff connected to RSS, RSS2, Atom and RDF feeds.
   20. wp-includes/bookmark.php – the Link/Bookmark API lives here, exposing functions such as get_bookmarks().
   21. wp-includes/bookmark-template.php – Link/Bookmark-related template functions reside here. The only out-of-the-box function that can be used as a template tag is wp_list_bookmarks(), which you have most probably used in your templates. Now you know where it comes from.
   22. wp-includes/kses.php – defines functions that are used to strip, normalize and filter out tags that are not wanted. These functions protect your website from persistent XSS attacks and other malicious evils. The wp_kses() function is great to filter out unwanted data from both front-end and back-end users.
   23. wp-includes/cron.php – the CRON API allows you to schedule events to be fired off within WordPress, the events are stored in the ‘cron’ entry in the options table as serialized data. Scheduling actions is done through the wp_schedule_event() and wp_schedule_single_event() functions. For more insight on how these functions can be used check out our Writing a Tweets to WordPress Posts Plugin (Part 1) article which deals with the WordPress Cron API.
   24. wp-includes/deprecated.php – this file includes functions that are deprecated and will be removed in upcoming versions of WordPress. Still using get_author_name() or is_plugin_page()? Use of these functions will throw deprecation messages for now and in the near future your scripts may not work. If you’re using a function that is deprecated open this file, find it and see how you are supposed to get by from soon on.
   25. wp-includes/script-loader.php – wp_enqueue_scripts() is defined in this file among other useful functions that allow you to insert stylesheets and javascript into the head of a WordPress page. The script uses BackPress dependencies which are defined in wp-includes/class.wp-dependencies.php which defines a parent enqueue class, wp-includes/class.wp-scripts.php, wp-includes/functions.wp-scripts.php (wp_enqueue/dequeue_script()), wp-includes/class.wp-styles.php and wp-includes/functions.wp-styles.php (wp_enqueue/dequeue_style()).
   26. wp-includes/taxonomy.php – defines the WP_Tax_Query class and provides all sorts of wrapper functions around the global $wp_taxonomies variable like get_taxonomy().
   27. wp-includes/update.php – defines a set of functions designated to update WordPress and its components. wp_version_check(), wp_update_plugins() and wp_update_themes() among a couple of others.
   28. wp-includes/canonical.php – functions used to enforce canonical URLs. If you want to find out what canonicalization is check out this article
   29. wp-includes/shortcodes.php – provides a set of functions revolving around the Shortcodes API like add_shortcode(), do_shortcode(), strip_shortcodes() and other useful ones.
   30. wp-includes/media.php – defines the WP_Embed class, and a set of functions like add_image_size(), set_post_thumbnail_size(), image_resize() which are very useful, especially when third-party image resizing plugins go wrong. Also be sure to check out our Images, Image Sizes and Post Thumbnails in WordPress article.
   31. wp-includes/http.php – defines some simple HTTP functions like wp_remote_post/get() and wp_remote_request() which can be used for some pretty neat stuff like requesting other pages.
   32. wp-includes/class-http.php – defines WP_Http, WP_HTTP_Proxy, WP_Http_Cookies and other useful classes which expose methods that allow WordPress and your plugins to manage and process HTTP requests.
   33. wp-includes/widgets.php – WP_Widget and WP_Widget_Factory classes are defined here, and functions such as dynamic_sidebar(), register_sidebar(), register_widget() and others.
   34. wp-includes/nav-menu.php – defines the register_nav_menu() function among others, which allows you to manage navigation menus.
   35. wp-includes/nav-menu-template.php – you guessed it, wp_nav_menu() is defined here, yes the one that is used in most WordPress templates out there to display navigation code.
   36. wp-includes/admin-bar.php – and last but not least, this file defines functions pertaining to the Admin bar that you see when you browse your WordPress website being logged in as an administrator.
4. Since we’re not running a multi-site (hopefully, as multi-site is out of the scope of this article) wp-settings.php proceeds to define some plugin directory constants through the wp_plugin_directory_constants() functions (defined in wp-includes/default-constants.php). Such constants as PLUGINDIR and WP_PLUGIN_URL are unpacked into the global scope.
5. wp_cookie_constants() is called, unpacking cookie path and name constants. This function call is followed by a similar wp_ssl_constants() call which defines only two constants: FORCE_SSL_ADMIN and FORCE_SSL_LOGIN.
6. wp-include/vars.php is loaded into the scope. This file creates common globals that are accessible from within WordPress and its components. These globals include the $pagenow global, simple browser detection globals ($is_lynx, $is_gecko, $is_winIE and others), and web-server detection globals ($is_IIS, $is_apache, “nope no nginx detection”).
7. create_initial_taxonomies() (defined in wp-includes/taxonomy.php) is called, which sets up all the initial taxonomies used in WordPress: category, post_tag, nav_menu, link_category and post_format.
8. create_initial_post_types() is similarly called (defined in wp-includes/post.php). Here the following post types are registered: post, page, attachment, revision, nav_menu_item. The following post statuses are registered: publish, future, draft, pending, private, trash, auto-draft, inherit.
9. register_theme_directory() providing the get_theme_root() as an argument, yes you guessed it, registered the theme directory.
10. wp_get_active_and_valid_plugins() retrieves the list of all active plugin files for loading and includes them. This is the point where your plugin code gets executed, functions, classes defined, etc.
11. Includes wp-includes/wp-pluggable.php and wp-includes/wp-pluggable-deprecated.php which include functions (and deprecated functions) that can be redefined by plugins. Like wp_mail() for more advanced mailing, wp_authenticate() for alternative authentication methods, etc.
12. wp_set_internal_encoding() is called to set the internal encoding according to the blog_charset option.
13. wp_cache_postload() is called if object caching is enabled.
14. At this point a plugins_loaded action is fired. This is the very first action (after muplugins_loaded fired before loading the non-multi-site WordPress plugins) that you can hook into, it comes before the init because WordPress has not been initialized yet, at least not fully.
15. wp_functionality_constants() defines AUTOSAVE_INTERVAL, EMPTY_TRASH_DAYS, and WP_POST_REVISIONS constants.
16. wp_magic_quotes() adds magic quotes to POST and GET requests and merges them into the $_REQUEST global.
17. The $wp_query global object is instantiated from the WP_Query class.
18. The $wp_rewrite global object is instantiated from the WP_Rewrite class.
19. The $wp global object is instantiated from the WP class. Hurray!
20. The $wp_widget_factory is instantiated from the WP_Widget_Factory class.
21. At this point your setup_theme hooks are executed, followed by template constant definitions from wp_templating_constants() and default localization text-domain loading load_default_textdomain().
22. The $locale variable is defined and the wp-content/languages/ folder is searched for to require the necessary WordPress localization files.
23. wp-include/locale.php is loaded defining the WP_Locale class and it is instantiated as a $wp_locale global.
24. Theme function files (functions.php) are loaded at this point for both the parent and the child themes.
25. do_action('after_setup_theme') is fired to denote the end of theme setup.
26. If the current theme supports post-thumbnails the wp-include/post-thumbnail-template.php is loaded which defines template tags such as get_the_post_thumbnail().
27. A shutdown function is registered called shutdown_action_hook (defined in wp-includes/load.php). This function simply fires the shutdown action for plugins to hook into before the WordPress script’s execution is almost completed.
28. $wp->init() is called which initializes WordPress. This init process involves wp_get_current_user() (defined in wp-includes/pluggable.php), which hydrates the global $current_user variable.
29. The init action is fired.
30. The wp_loaded action is fired.

Here's a summary chart of all the above. Click the image for full size.

What a long process, and that’s not the end of it. Remember how wp-settings.php is included into wp-config.php, which by this time has no more code to execute, so the calling wp-load.php, which also has finished executing its code, so its callee wp-blog-header.php which has to continue booting up WordPress, to ultimately return the HTTP request with the necessary HTML code.

Finally, after submerging into some really deep waters we can have a quick gulp of air and continue exploring more WordPress Internals in our third and final part of how WordPress boots up. So, stay tuned, follow our Twitter feed for WordPress tips, tricks, development and design articles, and be sure to let me know if I messed some of this WordPress loading up. exit().