---
title: "Code Snippets"
description: "Code Snippets free or Pro: strengths, limitations, pricing, recommended settings, safe mode and patched vulnerabilities, to add PHP without the risk."
language: "en"
locale: "en-US"
type: "plugin-sheet"
canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/code-snippets/"
published: "2026-11-04T08:00:00+00:00"
modified: "2026-11-05T21:03:33+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/code-snippets/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/code-snippets/index.md"
  es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/code-snippets/index.md"
  de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/code-snippets/index.md"
  it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/code-snippets/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/code-snippets/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/code-snippets/index.md"
---

# Code Snippets

Code Snippets adds a menu for writing PHP and HTML snippets in the admin area, without touching your theme’s functions.php. Our take on the free and Pro versions, the settings that keep your site from breaking, safe mode and the patched vulnerabilities.

## The essentials

- Best for adding PHP functions to WordPress without editing your theme or building a plugin.
- Main caveat: CSS and JavaScript snippets, revisions and display conditions require Pro.
- Free; Pro starts at $39 per year for one site, or $299 per year for unlimited sites.

## What Code Snippets does in your WordPress site

Code Snippets adds a Snippets menu to the admin area where you write small pieces of code instead of pasting them into your theme’s functions.php file. Each snippet gets a name, a description, tags and an on/off switch, so you can activate or deactivate them one at a time. Snippets live in their own database table (`wp_snippets` with the default prefix), separate from the theme: switching themes or updating WordPress doesn’t remove them.

The free version handles two snippet types. PHP snippets come with a run scope (everywhere, admin area only, front end only, or a single run you confirm by hand), and HTML snippets are inserted into your content with a shortcode. Before it activates a PHP snippet, the plugin checks the syntax and runs the code once; if that fails, the snippet is saved but stays inactive. You also get a safe mode, import and export between sites, export of PHP snippets to a plain PHP file, search of the community Code Snippets Cloud library, locking for sensitive snippets and multisite support.

Shea Bunge created the plugin and released it on wordpress.org in 2012; it is now published by Code Snippets B.V. The paid edition, Code Snippets Pro, adds CSS and JavaScript snippets, an AI agent that writes code, revisions, display conditions, form-based code blueprints, role-based permissions and syncing with a Cloud account.

![Diagram: Code Snippets works on visitors and bots, wordpress, database and files. Public traces: no known public trace.](https://www.wp-masquerade.com/media/wpm-sheets/code-snippets/diagram-en.svg?v=ba3aab00)

## Which sites Code Snippets is a good fit for

Code Snippets earns its place whenever you add PHP to a site without wanting to build a plugin:

- **Sites that follow WordPress tutorials**: the filters and actions you find in documentation go into a named snippet that survives theme updates.
- **Freelancers running several sites**: one export file carries the same tweaks from site to site, and the PHP export lets you move them into a child theme later.
- **Multisite networks**: network-wide snippets from Network Admin, plus separate snippets for each site.

It’s the wrong pick if you mainly want to add CSS, JavaScript or a tracking code for free: those snippet types require Pro, while [WPCode](https://www.wp-masquerade.com/features/camouflaged-plugins/wpcode/) handles them in its free version. If your code is versioned in Git and deployed automatically, a custom plugin stays easier to trace.

## Code Snippets strengths and limitations

### Strengths

- **A test before activation.** A PHP snippet that throws a syntax or runtime error is saved inactive instead of taking the site down.
- **Lockable snippets.** A locked snippet can’t be edited or deleted by accident, which protects critical code.
- **Clear exit routes.** Export snippets to a PHP file, roll the plugin back to an earlier version from its settings, and recover with safe mode.
- **Easy migration.** Imports from Header Footer Code Manager, Insert Headers and Footers and Insert PHP Code Snippet.

### Limitations

- **Only PHP and HTML for free.** CSS and JavaScript snippets, with their Gutenberg and Elementor integrations, require Pro.
- **No history for free.** Revisions are a Pro feature: an edit overwrites the old code with no way back.
- **No display conditions for free.** Limiting a snippet to certain pages means writing the condition in PHP, or using the Pro visual editor.
- **Uneven translations.** In several languages, newer screens such as the settings tabs still show in English.

## The Code Snippets settings we recommend

These settings exist in the current free version, under Snippets > Settings and in each snippet’s editor.

| Setting | Recommended value | Why |
| --- | --- | --- |
| **Scope** of a PHP snippet Snippets > Add New | “Only run in administration area” or “Only run on site front-end” rather than “Run everywhere” | Code that serves only one side of the site has no reason to run on the other. |
| **Activate by Default**  Snippets > Settings > Running | Off on a production site | When on, the main button saves and activates the snippet in one go; when off, you activate each snippet on purpose. |
| **Enable File-Based Execution**  Same screen | Off (default), unless you have a specific need | Snippets then run from files on disk; handy for version control, but one more surface to keep an eye on. |
| **Enable Admin Bar Menu**  Snippets > Settings > Interface | On (default) | The admin bar gives quick access to your snippets and to safe mode. |
| **Hide Upgrade Notices**  Same screen | On for client sites | Removes the prompts to upgrade to Pro, with no effect on how snippets run. |
| **Complete Uninstall**  Snippets > Settings > Advanced | Off (default) | When on, deleting the plugin also erases every snippet and setting. |
| **Enable Feedback Reporter**  Same screen | Off (default) | Reports include your site address, your contact details and the list of active plugins. |

- Write down how to reach safe mode: add `?snippets-safe-mode=1` to an admin URL to open the dashboard without running your snippets.
- Test every new PHP snippet on a staging copy before you activate it in production.
- Export your snippets (the Export bulk action on the list) and keep the file with your backups.
- If you’re locked out of the admin, setting the `CODE_SNIPPETS_SAFE_MODE` constant to true in wp-config.php stops all snippets: remove it once the broken snippet is fixed.

## Code Snippets and security: direct access to PHP on the server

Code Snippets runs whatever code you give it: an account that manages snippets can execute any PHP on the server. By default only the `manage_options` capability (administrators) gets access; Pro lets you delegate rights by role. The most notable published vulnerabilities:

- **CVE-2025-13035, fixed in 3.9.2**: a contributor account could run PHP through the `[code_snippet]` shortcode and php://filter chains, provided file-based execution was enabled and a content snippet was active (CVSS 8.0).
- **CVE-2026-1785, fixed in 3.9.5**: with no nonce check, a forged request could make a logged-in administrator download or update Cloud snippets (CVSS 4.3).
- **CVE-2020-8417, fixed in 2.14.0**: a CSRF flaw on the import screen let an attacker make a logged-in administrator import a PHP snippet, leading to [remote code execution](https://www.wp-masquerade.com/glossary/remote-code-execution/).

Turn on automatic updates for Code Snippets (see our guide to automatic plugin updates) and keep the number of administrators low, as our article on WordPress roles and capabilities explains. Apart from the snippets you publish yourself, Code Snippets leaves few traces in public pages; the box below shows what WP Masquerade covers for it.

## Code Snippets frequently asked questions

**Will I lose my snippets if I switch themes?**

No: they’re stored in the database, apart from the theme. A snippet that relies on a function from the old theme may stop working, though, and will need adjusting.

**What should I do if a PHP snippet breaks my site?**

Add `?snippets-safe-mode=1` to the admin URL, deactivate the faulty snippet, then fix it. If you can’t log in at all, add the `CODE_SNIPPETS_SAFE_MODE` constant to wp-config.php while you repair it.

**Can I add CSS or JavaScript with the free version?**

Not as a dedicated snippet type: the free version handles PHP and HTML. You can print a style or script tag from a PHP snippet hooked to `wp_head`, but the CSS and JavaScript types are Pro only.

**How much does Code Snippets Pro cost?**

The pricing page lists $39 per year for one site, $79 for 10 sites, $149 for 100 sites and $299 for unlimited sites. There are also monthly plans (from $3.90 a month) and lifetime plans (from $137), with a refund available within 14 days of your first purchase.

## Key facts

- Category: Utilities
- Vendor: Code Snippets B.V.
- Price: Free; Code Snippets Pro from $39 per year for one site
- Active installations (wordpress.org): 1 000 000+
- Version: 4.0.0
- Official page: https://wordpress.org/plugins/code-snippets/

## What WP Masquerade hides

- Handled by the free version of WP Masquerade