Everything below reflects the current release (v1.0.0). Install to first working snippet is about five minutes, most of it spent deciding which piece of functions.php to move first.
You need WordPress 6.0+ on PHP 7.4+ and an administrator login, plus the plugin zip and licence key from your purchase email. Two honest notes before you run anything. First, a PHP snippet runs with the same power as a plugin, so treat every one you paste in from elsewhere as code you are about to install. Second, no plugin can promise that arbitrary PHP will behave; what this one does is refuse code that will not compile, remember which snippet was running when a request died, and give you a way back in that needs no database.
Go to Plugins → Add New → Upload Plugin, choose the zip from your purchase email, install and activate. It adds a Snippet Studio item to the admin menu. Activation changes nothing on the site: it creates the snippets table and waits.
Open Snippet Studio → Licence and paste the key from your purchase email into the licence box. It is a long code starting VPC1., so paste the whole thing rather than typing it. Keys are domain-based, with no account and no phoning home.
Put define( 'WSS_SAFE_MODE', false ); in wp-config.php on the day you install, above the "stop editing" comment. Flipping false to true later takes five seconds and suspends every snippet, even with wp-admin unreachable. Finding the file for the first time while a client is on the phone takes longer.
Pick the smallest piece of custom code in your theme and move it. Set the type to PHP, paste the body without the opening tag, save, then delete it from functions.php. If the parser rejects it, the code was already broken and you have found that out at a good moment.
The note field is the point of the plugin as much as the code box. Write why the snippet exists and what breaks without it. You are writing to whoever opens this site in two years, which is often you.
Leave it at the default until two snippets touch the same hook. When they do, set the numbers yourself. A lower number runs earlier, matching how WordPress hook priorities already work.
If you keep a house set of snippets, open Snippet Studio → Import and load the JSON. Everything arrives switched off. Read each one, then turn on what this site needs.
The behaviours and safeguards you will actually live with.
Three insertion points: the header, straight after the body tag opens, and the footer. Each snippet also chooses whether it runs on the front end, in the admin, or in both. A tracking tag belongs on the front end. A dashboard tweak belongs in the admin. Loading either in both is how a site gets slower for no reason.
HTML, CSS, JavaScript, PHP and plain text. The type controls how the snippet is handled: CSS is output as CSS, JavaScript as JavaScript, PHP is executed. Choose the type that matches the code rather than wrapping everything in HTML and hoping the browser sorts it out.
Set a snippet to run as a shortcode and it stops running on every request. You get a shortcode to drop into a page, a post or a widget, and the code runs when that content renders. Use it for a calculator on one page, a formatted block of data, or an embed the block editor refuses to keep.
Save a PHP snippet and the code goes through the real PHP parser first. If it will not compile, the save is refused and you get the error and the line. Code that cannot compile never reaches the database, so the most common way to white-screen a site is closed before you can make the mistake.
Syntax is the easy half. Before a snippet executes, the plugin records which snippet is about to run, then clears the record once the snippet finishes. If PHP dies inside it, that record survives the crash. The next request reads it, switches that snippet off, and leaves a notice in wp-admin naming the snippet and the error. This is verified against memory exhaustion, which PHP cannot catch. The site was serving normally on the following request.
A toggle in settings for when you can reach the admin. A secret URL key you append to an admin URL for when pages still load. And define( 'WSS_SAFE_MODE', true ); in wp-config.php for when nothing loads at all. Each one suspends every snippet. The wp-config version needs no login and no database, which is the situation you are in when it matters. Remove the line once you have fixed the snippet.
A user needs manage_options plus either edit_plugins or unfiltered_html. Adding PHP to a site is the same level of trust as installing a plugin, so it asks for the same permission. If wp-config.php sets DISALLOW_FILE_EDIT, PHP snippets are blocked for everybody, no exceptions, because that constant is how a host or an agency says nobody edits code here. The other four types stay available.
In the plugin's own database table. Plugins that store snippets as a custom post type put executable code in the posts table, where the REST API, the search index, feeds, sitemaps and any plugin that walks posts can reach it. A dedicated table keeps snippet code out of all of that. It also means a snippet cannot be exposed by a plugin that never knew it existed.
Target a snippet at page contexts (front page, singular, archive), post types, specific post IDs, URL paths, user roles, device type, or logged-in state. Conditions narrow where the snippet runs, so a checkout script stops loading on the blog and a fix for one page stops running site-wide.
Tracking tags, security hardening and housekeeping snippets, each with its code shown in full. Everything arrives switched off. Open it, read the code, decide, then activate. A library that goes live the moment you click add is how sites end up running code nobody agreed to.
Export the whole set as JSON for a backup or for the next build. Imported snippets always arrive inactive whatever the file says, so a JSON file from a colleague, a client or a download cannot start executing when you load it. Review the set, then switch on what you want.
Deactivate the plugin and every snippet stops having an effect at once, because nothing was ever written into a theme file or anywhere else on disk. There is no cleanup pass and no orphaned code left behind in the theme.