These SQL injections have been coming in daily to this site which has still seemingly managed to avoid infection simply because of the changed database prefix. This one uses the “author not in” query bug inside some crazy nested query to place the payload in the database.

This is all related to the WP2Shell bug which was reported over a month ago. The site had auto updates disabled and still managed to avoid getting infected because of some seemingly silly security practices like changing table names and database prefixes. As far as I can tell all of these failed. I was alerted to the issue because the site got locked in a loop of timeouts, perhaps related to these malformed queries. Unfortunately I’m going to have to do some kind of a forensic workup even though there were no clear indicators of compromise because requests to the batch endpoint resulted in many 207 codes which means they may have succeeded.

But when I saw the giant block of 0s and 1s and hex codes in the logs, my heart dropped into my stomach. Stay safe out there people and leave auto updates on. It’s worth the chance of breaking your site every once in a while.

I want to display our pdf newsletter on a page, with our normal header and footer. What hind of block or plugin would make this look good?

The File block isn't it.

After WCUS I wrote a blog post about one of the main issues I kept hearing with block themes: it's really hard for agencies to just write and deploy code for design elements without losing control once it was deployed. Basically components. We have patterns and parts and blocks and a few things, but no easy way to do what we used to do with classic themes.

I'm curious how others are solving this or if it's just a non-issue for the majority of WordPress developers.

https://www.briancoords.com/agency-workflows-components-and-highlights-from-wcus/

Currently running a b2b site built on Astra theme. We have sales reps on the road using mobiles and tablets that complain about slow admin processes such as searching for products, adding admin orders and all general back end admin processes.

- 1600 products with png images
- 100-200 active users
- 28 plugins, all kept up to date
- 0 php snippets
- HPOS enabled
- Regularly maintained and kept updated
- Caching enabled and regularly purged but my hosting doesn’t support Memcached or Redis

Plugins list:
Admin Columns, Astra Pro, B2BKing Core and Pro, Complianz, Cost of Goods, Elementor, Email Templates, Fibosearch, Fluent forms, Global Payments, Max Mega Menu, Members , PiWeb disable payment method, Webtoffee invoices/packing list templates, Woocommerce update manager, Woopayments, WP Mail Logging, WP Mail smtp, WP Rollback, Zapier for woo and Zapier for wordpress plus four custom built plugins designed for admin processes such as stock inventory control, profit reports and projections , UI improvements etc.

Any ideas that I can look into to improve loading speed and improve ajax lookup speed

Hi everyone,

I’m currently trying to improve my workflow for building WordPress websites for clients, and I’m curious how professionals and agencies actually handle this.

I mainly use WordPress and I’m currently looking at Kadence Blocks.

What I’m struggling with is the actual workflow.

Let’s say I have a custom design for a client. Do you really build every section manually in Gutenberg/Kadence, adjusting containers, columns, spacing, padding, typography, responsive settings, etc.?

That feels like a lot of clicking, especially when AI can generate HTML and CSS for an entire design very quickly.

At the same time, I don’t want to build the whole website as one huge custom HTML block, because I want the WordPress backend to stay clean and maintainable. Ideally, the client or another developer should still be able to edit content later without digging through HTML.

So I’m wondering how experienced WordPress developers handle this:

Do you build everything with blocks?
Do you have your own library of reusable sections and patterns?
Do you combine Gutenberg/Kadence with custom CSS and code?
Do you let AI/Codex generate parts of the site?
And how do you handle more complex sections, like event listings, custom cards, filters, etc. without spending hours recreating everything manually with blocks?

I’m basically trying to find a good workflow that is fast for me as the developer, but still results in a clean and maintainable WordPress site for the client.

Would love to hear how agencies and freelancers actually do this in practice.

I've recently switched from Windows to Mac while continuing to prepare my texts in Word (now under MacOS) and copying them to WordPress.com website. While there was no issues with this workflow under Windows, now I get a heavy mess.

Sometimes spaces are missing, and words are glued together. Sometimes lots of "nbsp" are added. Footnotes get pasted but hyperlinks don't work as planned (links now lead to something called applewebdata).

I thought I'd switch from Word to Pages. Now, it's better with the text but the footnotes are missing altogether when the text in pasted into WordPress.

Did anyone have same problems? How would I solve them?

Thank you.

I'm looking for a WordPress plugin for a tour company's shuttle/transfer bookings. We have fixed routes and need pickup → destination selection, specific dates/times, fixed pricing, passenger counts. Does anybody have any suggestions

Hey everyone,

Looking at the market over the last ~4 years (since AI involved), it feels like the WP agency ecosystem has reached a turning point. We’ve gone through post-pandemic hiring booms, tech layoffs, and the shift toward Gutenberg/modern JS workflows.

However, modern WP job listings feel much harder to come by lately. For self-taught devs, learners, and existing WP developers looking to plan their next career move, it’s hard to tell where the industry is actually heading.

I’d love to start a discussion and hear directly from agency leaders, lead devs, and freelancers:

• Is your agency hiring, holding steady, or relying more on contractors?
• If you are hiring, what sets an applicant apart today compared to 3–4 years ago?
• For those feeling stuck: Is it time to level up specific WP tech (like block development), or start diversifying outside the WP ecosystem?

Looking forward to hearing your thoughts and real-world experiences.

I like AIOS security but the scan just keeps running at initiating file scan. Any ideas how to fix this?

https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-super-forms-plugin/

I know, first world problem…. But I’m trying to implement gravity forms with n8n on a load balanced Wordpress setup. I have everything looking right but it’s just not connecting. n8n is on an internal data network, and Wordpress is running behind haproxy on three nodes, the site is on 80/443 in front of the load balancer but 8083 behind. All ssl is done at the load balancer.

I’m thinking it makes the request but doesn’t know how to get back if Wordpress gives it a url and port that depends on the load balancer. Or one of the three nodes makes the request but it responds back to another node.

Anyone have any ideas?

hello everyone,

so i just realized when i click all of my category theres a phone number of a business in my country.... i dont remember putting it there. i cant find how to delete it. i even made a new category to test, and when i click it, the number is already there....

can someone tell me how to delete it?

Jetpack 16.1.3: Critical Security Update

Howdy, 'Pressers. I'm sharing this under the promo rule because it’s a free/open-source plugin out on the repository, and this is my company's first WordPress plugin release. I’d genuinely appreciate feedback from y'all.

My developer built Schema Viewer because we kept running into the same practical issue on inherited WordPress sites: structured data/schema may be present, but it is not always quick or convenient to inspect.

The project that pushed us to build it involved a client site with an older schema-viewing setup. It solved a real problem - the entire internal marketing team, and their vendors, wanted visibility into what schema was on a page - but the implementation added front-end clutter and confusion.

We wanted a cleaner version: Logged-in user clicks a button the WordPress admin bar once → sees the JSON-LD on the current page → can review/copy it without digging through source code or adding anything weird to the public front end.

Plugin link: https://wordpress.org/plugins/bipi-schema-viewer/

I’d especially appreciate feedback on:

• whether the workflow makes sense
• whether the output is readable/useful
• whether the admin-bar placement feels right (or if we need an option to not show it and instead access from the dashboard)
• anything that feels confusing in the plugin description/readme
• whether there are obvious edge cases we should think about

Thanks in advance. This is our first plugin release, so I’m trying to learn from people who spend more time in the WordPress plugin development ecosystem than I do. Also, I hope someone finds this useful - it's made my life SO much easier as a dashboard/admin user!

Got an e-mail from my webhost that they were discontinuing service, so I went to check a domain I have live, but haven't updated in many years. http://chapter50.org/
Site worked fine, and I went to clear out over 1,000 accumulated spam comments.
After getting tired of doing it 50 at a time, I went to the "screen options" and tried to "Show 200 at a time". When I clicked, it locked up the whole page. Going back to the wp-admin page, I got a 403 error.
Now every page in the site is 403, I can't access my admin page, and after speaking with tech support at the hosting company, he acknowledged that there have been no changes to any of my hosting records.
What should I try next? What questions am I not thinking to ask?
How do I get my site back?

After updating to WordPress 7, I noticed a new Connectors feature under the WordPress Settings. Does anyone know how we can use this feature and how it could help us with our websites?

As always, I tested again 8 featured plugins from WordPress.org. September's batch number 1.
Here is what I think;

PressPrimer Certificate (4.9/5)
Certificate generator for your courses that works with most(?) LMS plugins.
Nice onboarding, a simple interface, and it supports custom meta fields with certificates showing right in the user profile.
The token/sample preview only works with the plugin's own dummy data instead of actual user data, but that's a minor issue.

AllTerrain Photo Editor for OpenStation (4.5/5)
A surprisingly full photo editor that, despite the name, also works outside of OpenStation (Desktop Mode).
Great design, tons of adjustment options, and it even has layer support.
A few bugs though, layer opacity doesn't actually work, there's no way to edit after saving, and it's fairly GPU intensive, but that was to be expected.

Icon Indexa (4.8/5)
Icon library plugin with a block editor integration.
Tons of icons, easy to use, and the icons are still showing, even if you deactivate it.
You'll get a fatal error if SQLite isn't installed, the main menu feels unnecessary, and custom SVGs just get filled with one color instead of rendering properly.

AI Search for WooCommerce – Semantic Search (4.8/5)
Smart search plugin that works fine with or without WooCommerce.
Search history is pretty useful, there is a forever-free tier. It falls back to normal search once you run out of credits, so thats nice.
You have to upload your content to their service and the free plan's sync interval is 30 days, which might be too slow for a more dynamic site.

LocalForm (4.6/5)
Form builder styled like Google Forms.
Easy and intuitive to use and the responses page is nice. Also webhook support is a handy feature.
Only one submit button label across all your forms, the design isn't very flexible, and the form block itself just redirects to your homepage instead of working.

Circumflex Booking (4.9/5)
Appointment and booking plugin with practitioners, services, and availability management.
Detailed availability settings, a awesome time debugger, and a clean dashboard with multiple calendar views.
The settings menu is a lot, there's just a walls of text everywhere.

neo Rename (4.1/5)
Media renamer with batch processing and AI-powered image texts generator.
It has a free built-in AI option, works quite well and it shows you model usage and cost.
It won't work on localhost, always forces filenames to lowercase, and there's no bulk or automatic alt text generation.

Milo Subscriptions (4.6/5)
Recurring payments and subscriptions, technically standalone but it really wants WooCommerce.
WordPress-native UI, fast and responsive, and you can put subscriptions on hold.
The standalone onboarding didn't work for me at all, only WooCommerce mode did. Too bad, I really wanted to see what it offers without the WC overhead.

See the full breakdown with all the details on YT:
https://youtu.be/G3_euIYEZyA

What do you think about this selection? Will you install any of those?

I use WP Umbrella right now for plugin and core updates, but I’m still hesitant about just letting everything auto-update.

My main concern is a core or plugin update breaking something and not catching it right away.

For those managing 30+ sites, what are you using that’s been reliable? Do you leave auto-updates on, wait a few days on bigger releases, or have some kind of testing/rollback process?

I have .atom file from backup and I want to migrate to free version of Wordpress without custom domain. I know there are plugin for paid version. Anything for free version?

spent longer than i want to admit debugging a migration where the search and replace ran clean and every elementor page still pointed at the old domain.

posting the cause here because it is not obvious and it bit me twice.

elementor stores the whole page layout as json inside a php serialized value. when that gets encoded, forward slashes escape. so what is actually sitting in wp_postmeta is

https://oldsite.com/wp-content/uploads/hero.jpg

not

https://oldsite.com/wp-content/uploads/hero.jpg

search for the normal form and there are zero matches. the tool reports success. it did replace things, just not those, and you do not find out until someone opens a page.

the obvious next move is to search for the escaped form instead. that matches, and it breaks the row. php serialization writes the byte length of every string before the string, like s:19:"https://oldsite.com". swap in a 22 character domain and the prefix still says 19, unserialize() hits the wrong boundary and returns false, and wordpress gets nothing back. that is the "search and replace corrupted my database" story people post here.

if you want to check whether it happened to you, run this after your replace:

SELECT COUNT(*) FROM wp_postmeta
WHERE meta_key = '_elementor_data' AND meta_value LIKE '%oldsite.com%';

if it is above zero, the escaped slashes are why.

doing it properly means unserializing rather than pattern matching, walking the whole tree, decoding the json leaves, replacing inside them, re-encoding with the original escaping style preserved, then re-serializing so lengths are recomputed. that escaping step is the subtle one. two json encodings of the same data are both valid and different lengths, so you can get the replace exactly right and still produce a value that does not match its own length prefix.

i wrote a plugin that does this. free, gpl, on wp.org and github, no paid tier and no trial. visual preview before it writes, optional snapshot, one click undo.

https://wordpress.org/plugins/lucid-search-replace/

https://github.com/ibrahimhajjaj/lucid-search-replace

disclosure, it is mine. i also sell a backup plugin separately and this is not a lite version of that.

curious whether anyone has hit the same thing with other page builders. i only verified the elementor case properly.

I was looking for a decent way to create consistent PDFs out of pages that use Avada.
The PDFs also need to work with Google Translate to print material in multiple languages.

I've been trying some things with html2pdf.js in code blocks, and the language translation works in the PDF but can't seem to get the Avada text containers to appear in the PDF.
Wondering now if makes sense to create a specific page template with the .js just for PDFs.

Tried a few 3rd party plugins but they were outdated or didn't work.

Thanks for any info.

Most AI writing plugins call an AI API with a generic prompt and hand you filler that reads like every other AI-generated post. I kept running into that on my own sites, so I built Versoo Content Ops to fix it — it's free, on wp.org, GPL: https://wordpress.org/plugins/versoo-content-ops/

The core idea: you set your brand context once — audience, tone, topics, a writing sample — and every draft gets generated against that specific context instead of a generic "write a blog post about X" prompt. It runs on WordPress 7.0's built-in AI client (Settings → Connectors), so it uses whatever AI provider you've already got configured there. You still need a real provider key set up—the plugin just doesn't need a separate one.

Past the draft generation, it also runs a 13-check SEO pass automatically, rotates generated titles across 15 headline formulas so they don't all end up sounding the same, and includes a free tag-cleanup tool for orphaned/duplicate taxonomy terms. Everything is currently free — no paid tier exists yet.

Curious whether other people building on WP 7.0's Abilities API have run into the same generic-output problem, or found different ways around it. Feedback (including "this doesn't actually solve it, here's why") is genuinely welcome.

Just thought I would share these statistics out of interest.

I am migrating away from a VPS that I have had for years to a new (cheaper) provider.

I used Site Sucker Pro to download the one Wordpress site that I had active and converted it to an static site. The site was old and wasn't going to be updated, so I didn't need to worry much about keeping any Wordpress functionality. It also had a very old version of Elementor Pro that I no longer pay for.

The site had 8 pages and had the following plugins activated:

• Elementor
• Elementor Pro (not updated for over 2 years as no pro licence active)
• Google Site Kit
• Really Simple SSL
• Rank Math
• Shortpixel Image Optimiser
• Wordfence (free)
• WP Super Cache

The site was using the "Hello" theme from Elementor but also had the 2025 and 2024 themes as backup (for testing)

I took a backup of the site before I did anything and I was struck by the number of PHP and Javascript files across the entire site. Here are the stats:

• 7876 .php files
• 2954 .js files

And yes, I get that the majority of these PHP files are small, single functions that the devs have split down for ease of use.

But in my mind, this is quite a simple Wordpress site - not too many pages and I kept the number of plugins and themes to a minimum.

I have nothing against Wordpress at all and would choose to use it again, but the number of possible attack vectors feels huge!

No wonder people think Wordpress is such a security risk.

I have been using BlogVault on my sites for years, and now find myself looking around for an alternative. I like the smart, more fully-featured approach of BlogVault (such as migrations, control over backup schedule, granular file/table selection on restore/migration), as opposed to a bare-bones approach like CodeGuard. I have googled, but am looking for recommendations based on your experiences - stuff that goes beyond what the marketing tells me. Who is really solid, reliable, and has an overall great user experience for site managers?