What are WordPress custom fields and ACF?

WordPress custom fields, also called post meta, are key value pairs attached to a post, page or any custom post type. They live in the wp_postmeta table with columns meta_id, post_id, meta_key and meta_value (longtext). WordPress has supported custom fields since version 1.5 (February 2005). The native UI lives under Screen Options to enable the Custom Fields meta box, but the native interface is rarely used in practice because Advanced Custom Fields (ACF) and similar plugins give a far better editing experience. ACF was created by Elliot Condon in 2011, acquired by Delicious Brains in 2021, and acquired again by WP Engine in May 2022. As of 2025 ACF has more than 2 million active installations. ACF adds field groups, 30 plus field types (Text, Number, Email, Image, Gallery, File, Repeater, Flexible Content, Group, Relationship, Post Object, Taxonomy, User, Date Picker, Color Picker, Google Map, oEmbed, WYSIWYG), conditional logic, location rules and a clean PHP API: get_field( 'price' ), the_field( 'subtitle' ), have_rows( 'gallery' ). The free ACF includes most fields. ACF Pro (sold from advancedcustomfields.com, currently around 49 USD per year for one site to 249 USD lifetime for unlimited sites) adds Repeater, Flexible Content, Gallery, Clone, Options Pages and Block registration. ACF Blocks (since ACF 5.8, August 2019) let developers register Gutenberg blocks in PHP with ACF fields backing them. On 10.10.2024 WordPress.org removed ACF from the plugin directory after a trademark dispute with WP Engine and replaced it with a community fork called Secure Custom Fields (SCF). ACF Pro remained available from advancedcustomfields.com. As of 2025 ACF (from WP Engine) and SCF coexist as separate plugins.

What does the wp_postmeta table look like?

+-----------+---------+-----------------+---------------+
| meta_id   | post_id | meta_key        | meta_value    |
+-----------+---------+-----------------+---------------+
| 1         | 42      | _edit_lock      | 1736178921:1  |
| 2         | 42      | price           | 19.99         |
| 3         | 42      | subtitle        | Limited Edition|
| 4         | 42      | gallery_0_image | 1023          |
| 5         | 42      | _gallery_0_image| field_64ab123 |
+-----------+---------+-----------------+---------------+

Each row stores one key value pair. Repeater rows from ACF are flattened into multiple keys with index numbers (gallery_0_image, gallery_1_image). Keys prefixed with an underscore are private and not shown in the native UI.

Native WordPress custom fields

Out of the box WordPress provides a Custom Fields meta box on the edit screen. To use it:

1. Open a post or page in the editor.
2. Click the three dots in the top right, choose Preferences, Panels, and enable Custom Fields. The editor reloads with the meta box at the bottom.
3. Enter a Name (the meta_key) and a Value (the meta_value). Click Add Custom Field.
4. Retrieve in the theme with get_post_meta( $post_id, 'price', true ).

The native UI is limited to plain text values and does not support media uploaders, dropdowns, repeaters or validation. That is why almost every WordPress site uses a plugin for custom fields.

Advanced Custom Fields (ACF)

ACF is the dominant custom fields plugin. The free version (called ACF or SCF since the fork) is sufficient for most sites. ACF Pro adds the killer features:

• Repeater field: nested groups of fields that can be added or removed. E.g. an FAQ section with many Question and Answer pairs.
• Flexible Content field: choose from predefined layouts (Hero, Text, Gallery, CTA) and build page sections in any order. Used for visual page builders without committing to a builder.
• Gallery field: upload and reorder multiple images.
• Clone field: reuse a field group inside another.
• Options Pages: store site wide settings (footer text, social links, contact info) outside individual posts.
• ACF Blocks: register Gutenberg blocks with ACF fields as their attributes, rendered by a PHP template.

How to use ACF (typical workflow)

1. Install Advanced Custom Fields from the wordpress.org directory (the SCF fork) or download ACF Pro from advancedcustomfields.com.
2. Go to Custom Fields, Add New, give the field group a name like Product Details.
3. Add fields: Text Subtitle, Number Price, Image Hero Image, Repeater FAQs (Sub Fields: Text Question, Textarea Answer).
4. Set Location: Show this field group if Post Type is equal to product.
5. Publish. The field group now appears on Product edit screens.
6. In the theme template (single-product.php or a block template) read the fields:

<?php
$subtitle = get_field( 'subtitle' );
$price    = get_field( 'price' );
$hero     = get_field( 'hero_image' ); // returns an array with url, alt, sizes
?>

<h1><?php the_title(); ?></h1>
<p class="subtitle"><?php echo esc_html( $subtitle ); ?></p>
<span class="price"><?php echo esc_html( number_format( $price, 2 ) ); ?> USD</span>
<img src="<?php echo esc_url( $hero['sizes']['large'] ); ?>" alt="<?php echo esc_attr( $hero['alt'] ); ?>">

<?php if ( have_rows( 'faqs' ) ) : ?>
  <dl class="faq">
    <?php while ( have_rows( 'faqs' ) ) : the_row(); ?>
      <dt><?php the_sub_field( 'question' ); ?></dt>
      <dd><?php the_sub_field( 'answer' ); ?></dd>
    <?php endwhile; ?>
  </dl>
<?php endif; ?>

The ACF/SCF fork (October 2024)

On 27.09.2024 WordPress.org and WP Engine entered a public dispute. On 10.10.2024 Matt Mullenweg removed Advanced Custom Fields from the wordpress.org plugin directory and replaced its entry with a community fork called Secure Custom Fields (SCF). Sites that automatically update plugins from wordpress.org received SCF in place of ACF. Key implications:

• The free ACF plugin continues development at advancedcustomfields.com and on GitHub by the WP Engine team.
• The free SCF plugin is maintained by the WordPress security team and stays under the ACF API (get_field, etc.).
• ACF Pro is sold by WP Engine and was not affected by the takedown.
• For users who installed ACF before October 2024 and want the original plugin: download from advancedcustomfields.com and uninstall SCF before installing.

Alternatives to ACF

Custom fields and the REST API

By default custom fields are not exposed on the REST API. To expose them:

• Register the meta key with register_post_meta() and show_in_rest => true. The field then appears under meta on /wp-json/wp/v2/<post-type>/<id>.
• ACF Pro adds REST API support automatically. ACF fields appear under an acf property on the post.
• For WPGraphQL there is the WPGraphQL for ACF extension that adds field group types to the GraphQL schema.

This matters for headless WordPress. A headless frontend reads custom fields the same way as a PHP theme but via JSON instead of get_field().

Custom fields and performance

• Each get_post_meta() call without arguments loads ALL meta rows for a post and caches them. After the first call, subsequent reads are free.
• Querying posts by a meta_key in WP_Query is slow at scale because meta_value is a longtext column and not indexed. For more than 50,000 posts, consider denormalizing to a custom table or using ElasticPress.
• The native Custom Fields meta box in the editor loads a dropdown of all distinct meta_keys site wide. On sites with thousands of meta keys this dropdown can stall the editor. Disable the dropdown with add_filter( 'postmeta_form_keys', '__return_false' ).
• ACF stores a reference key alongside each field value (e.g. _subtitle with value field_64ab123) so it can map values back to the field definition. This doubles the row count compared to plain custom fields but enables consistent updates when field keys change.

Common patterns

• Site wide options: use ACF Options Pages or an Options custom post type that you query as a singleton.
• Page builders without a builder: ACF Flexible Content gives editors building blocks (Hero, Two Column, Gallery) without the lock in of Elementor or WPBakery.
• Related posts: ACF Post Object or Relationship field to link a CPT entry to another.
• Reusable content sections: ACF Clone field references one field group inside another to avoid duplication.
• Conditional fields: hide fields based on the value of another (e.g. show Stripe Account ID only if Payment Method is Stripe).

What InspectWP checks

InspectWP detects ACF, SCF and similar custom field plugins by scanning loaded scripts, body classes and REST API endpoints. The report identifies headless setups that consume the ACF REST extension and flags publicly exposed meta fields that may leak internal data.