Meta Box Generator

<?php
/**
 * The "Article Details" meta box.
 */

/**
 * Adds the box to the editor screen.
 */
function my_plugin_add_meta_box() {
	add_meta_box(
		'my_plugin_details',
		__( 'Article Details', 'my-plugin' ),
		'my_plugin_render_meta_box',
		'post',
		'side',
		'default'
	);
}
add_action( 'add_meta_boxes_post', 'my_plugin_add_meta_box' );

/**
 * Registers the meta keys.
 *
 * Doing this means the value is sanitised and permission checked wherever it
 * is written from, not only through this box.
 */
function my_plugin_register_meta() {
	register_post_meta(
		'post',
		'_my_plugin_subtitle',
		array(
			'type'              => 'string',
			'single'            => true,
			'show_in_rest'      => false,
			'sanitize_callback' => 'sanitize_text_field',
			'auth_callback'     => 'my_plugin_can_edit_meta',
		)
	);
	register_post_meta(
		'post',
		'_my_plugin_featured',
		array(
			'type'              => 'string',
			'single'            => true,
			'show_in_rest'      => false,
			'sanitize_callback' => 'sanitize_text_field',
			'auth_callback'     => 'my_plugin_can_edit_meta',
		)
	);
}
add_action( 'init', 'my_plugin_register_meta' );

/**
 * Decides who may write these keys outside the editor.
 *
 * @param bool   $allowed Current decision.
 * @param string $key     Meta key.
 * @param int    $post_id Post ID.
 * @return bool
 */
function my_plugin_can_edit_meta( $allowed, $key, $post_id ) {
	return current_user_can( 'edit_post', $post_id );
}

/**
 * Prints the fields.
 *
 * @param WP_Post $post The post being edited.
 */
function my_plugin_render_meta_box( $post ) {
	wp_nonce_field( 'my_plugin_save_meta', 'my_plugin_nonce' );

	$value = get_post_meta( $post->ID, '_my_plugin_subtitle', true );

	echo '<p>';
	printf(
		'<label class="components-base-control__label" for="%1$s">%2$s</label>'
			. '<input type="text" class="widefat" id="%1$s" name="%1$s" value="%3$s" />',
		esc_attr( '_my_plugin_subtitle' ),
		esc_html__( 'Subtitle', 'my-plugin' ),
		esc_attr( $value )
	);
	echo '<span class="description">' . esc_html__( 'Shown under the title in the archive.', 'my-plugin' ) . '</span>';
	echo '</p>';

	$value = get_post_meta( $post->ID, '_my_plugin_featured', true );

	echo '<p>';
	printf(
		'<label><input type="checkbox" name="%1$s" value="1"%2$s /> %3$s</label>',
		esc_attr( '_my_plugin_featured' ),
		checked( $value, '1', false ),
		esc_html__( 'Feature this article', 'my-plugin' )
	);
	echo '</p>';
}

/**
 * Saves the fields.
 *
 * Every check here has a reason: the nonce proves the request came from this
 * form, the autosave and revision checks stop empty values overwriting real
 * ones, and the capability check stops someone editing a post they cannot.
 *
 * @param int $post_id The post being saved.
 */
function my_plugin_save_meta( $post_id ) {
	if ( ! isset( $_POST['my_plugin_nonce'] ) ) {
		return;
	}

	$nonce = sanitize_text_field( wp_unslash( $_POST['my_plugin_nonce'] ) );

	if ( ! wp_verify_nonce( $nonce, 'my_plugin_save_meta' ) ) {
		return;
	}

	if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
		return;
	}

	if ( wp_is_post_revision( $post_id ) ) {
		return;
	}

	if ( ! current_user_can( 'edit_post', $post_id ) ) {
		return;
	}

	if ( empty( $_POST['_my_plugin_subtitle'] ) ) {
		delete_post_meta( $post_id, '_my_plugin_subtitle' );
	} else {
		update_post_meta(
			$post_id,
			'_my_plugin_subtitle',
			sanitize_text_field( wp_unslash( $_POST['_my_plugin_subtitle'] ) )
		);
	}

	if ( empty( $_POST['_my_plugin_featured'] ) ) {
		delete_post_meta( $post_id, '_my_plugin_featured' );
	} else {
		update_post_meta( $post_id, '_my_plugin_featured', '1' );
	}
}
add_action( 'save_post_post', 'my_plugin_save_meta' );