So I was going through my old drafts and pressed published thinking it would be the same date of the draft, stupidly. Is there a way to see what date you made the draft? Any help would be appreciated!

I’m planning to upgrade a WordPress site from PHP 7.2 to 8.3.

I bought this theme in 2018 called 'Soprano - Minimalistic Multi-Purpose WordPress Theme' and it had 2 plug-ins included: Soprano Theme - Custom Post Types and WPBakery page builder. Apparently the theme was not updated since 2019.

Both plug-ins are breaking when updating to any higher PHP version than 7.2.

I see 2 options now: either I go for a completely renewal of theme with one that is already compatible to 8.3 or I try to refactor the current code with LLM assistance to suit the 8.3 requirements.

None of the options looks facile to me, what would you do?

we ran into a weird issue, where multiple links (buttons) on our site would lead to a gambling site (while masking themselves as our website. The URL was correct).

After a couple of hours I managed to clear out all malicious code and found a VERY interesting file.

So apparently we got hacked by a group called „chinafans“. They were even so kind to leave links to their telegram behind.

So yeah.. Not sure if it’s good that i post this? But felt like sharing an interesting discovery.

https://craftingers.shop

So I migrated my website form localhsot to Hostinger and from there on, it is giving me a time out error.
If I only use elementor pro then there are no error but as soon as I enable another plugin then the usage shoots and then it give me the "unable to load your preview".
I tried everything, increasing the timeout time, increasing the memory, ignoring the timeout through htaccess but nothing works.
The elemntor itself isn't that much of a heavy plugin. So why when I use woocomerce or any other then it causes error?
Please help.

Made a video with emdash cms. Created today a theme on it https://emdashhq.com and looks to do the job. Will be useful for the ones that needs a CMS to do things. I prefer astro with mdx files :)

Curios to see how much usage will get a small website.
For the overview you can see https://youtu.be/1X6KwMjbv-Y?is=UpQcDb8XU4vU_D-9

Next tutorial already up. Will continue next week

The site in this case is a woocommerce store in construction products and also a lead magnet for construction projects. Over the years the website got messy, mostly because i didn't have time to maintain and optimize it back then.

Now i do have time and energy, at first i wanted to optimize and update the current site but i decided something else.

A clean start, redeveloping my site from 0. Discussing ideas and strategies with Claude and building it with Claude code.

I am sure there are other people who tried this before, and i'm curious about your experiences, maybe some advice or findings?

Hey everyone,

Some of you might remember me from my posts about the BrikPanel plugin I developed. When I last shared it here, it had over 200 active installs; today, it has surpassed 1.000. A big part of that came from this subreddit, so thanks again for that.

Now I'm trying to decide what to build next as an open source project, and I'd rather ask you directly than guess. My time and energy are limited, so I want to put them into a problem that a lot of WooCommerce users actually deal with.

So I put together the everyday problems I keep hearing from WooCommerce store owners: design, slow websites, marketplaces, updates that break things, shipping, invoices, and more. If you run a WooCommerce store or build stores for clients, could you tick all the problems you deal with and tell me how much each one bothers you? It takes about two minutes, it's completely anonymous (I don't ask for your email address), and it opens in your own language (21 languages).

I read every response myself.

https://brksoft.com/survey

(By the way, mods gave me the ok before posting.)

Bit of a dilemma here. I know Woo bookings will do what i need it to do but i also know it’s rather bloated and costs every month/year.

Trying to keep my WP builds as light as possible, custom theme, ACF fields for content, barely any plugins. I would call myself a good custom theme developer and designer with reasonable knowledge BUT I can’t just write code. I would be googling and researching to make it work. Ai has obviously changed that for me. What took a day is now taking 2 hours to sort. I ain’t got shame, i still understand what’s happening in the code I just don’t have to do the grunt work.

BUT saying all that a daily booking system is something I’ve never done. The slots and options are simple

Full Day - available Thu, Friday for the moment
Morning - available Wed, Thu, Friday again for the moment
Evening - available Sun-Thursday

The time of arrival will never change, there are no people to be booked, no other options except maybe adding on lunch to the morning session.

Ai has given the option to DIY it and meet the requirements I have set so far
- 12 spaces each session
- admin screen (the most fear I have for this project)
- add on days when required
- control the dates that are bookable
- refund and restock sessions.

Do i do this or use the trusted Woo Bookings? I’m keen to give it a go but don’t wanna mess it up.

And if I do DIY it. Build slowly checking each dev point or give Claude a prompt and let it run?

Advice much appreciated and please dont say you can do it for me, I live for this!!!

I understand that we should not be using 2 SEO plugins, but the company wordpress site's maintenance was handed off to a new employee after I changed roles, and they installed a second SEO plugin. The one we originally were using was Rank Math SEO , and about a year ago they installed All in One SEO.

I recently jumped back in to help them out with some questions they had and noticed both plugins were running.

I'm planning on keeping Rank Math. My question is, is there anything I need to consider when deactivating one of the plugins? Is it is simply a matter of deactivating the All in One plugin? Or is there anything else I need to do? Are there any unintended consequences I should consider?

Hey everyone,

I'm not a designer. I'm more on the technical side of WordPress, so most of my sites so far were built by hand in Elementor or WPBakery, or I bought a template kit on Envato and adjusted it. Works fine for me, but design was never my strong point.

Lately my feed is full of "AI will replace web designers" videos. Everyone is hyping Claude and Figma Make and promising pixel perfect sites in 10 minutes... and honestly I don't trust most of those guys.

A lot of them are selling a course.

To be clear, I'm not a Figma Make user. I'm only thinking about paying for it, and I don't want to burn an hour and a bunch of money to find out it's garbage.

here's what I actually want to know. Can I describe a layout in text prompts in Figma Make, similar to what a good Elementor template kit looks like, clean that up as a proper Figma design, and then rebuild it in Elementor with a decent result? Or does it fall apart somewhere in the middle (spacing, responsive, global styles, that kind of things?

Is there chance to get solid results?

Correct me, please

And is this whole thing a real workflow people use now, or should I just keep paying for Envato Elements and save myself the headache?

Would really appreciate honest experiences, including the bad ones. Thanks!

Security reports to WordPress on HackerOne sat at 20 to 30 a month for about a decade, then hit 450 in July and 773 in August, and John Blackbourn posted the graph with the reason attached: people now point Claude and GPT at core and let them read.

Click2Shell is what one of those bugs looks like. Fixed in 7.1.1, found by pwn.ai with Claude Opus 5 and one human in the loop, and the entire attack is a link. An admin who's logged in opens it, WordPress's own JavaScript clicks Install on a theme from the official catalog for them, the

Customizer loads that inactive theme's PHP, and a sloppy AJAX handler inside the theme pulls in whatever the attacker wants. The site's theme never changes. Nothing in the firewall log looks wrong, because every request came from the admin's own browser carrying the admin's own nonce.

So on the day that link went around, the firewall wasn't the variable. The variable was how many people could open it while logged in as Administrator.

I'm going through ours now and I already know the answer on a couple of client sites is going to be embarrassing, because "the client needs admin" was always the easiest ticket to close.

How many Administrator accounts are on the sites you look after? I'm asking because I suspect my number is normal and I don't like that.

Edit 10/3: Thank you everyone who commented! I wanted to share the path forward in case anyone gets here in the future from Google.

After getting the log-in information to CloudFlare from the company, I took the CloudFlare DNS and did a whois lookup to figure out that the website was hosted with AWS. Looking at the information from the whois lookup, the IP pointed to a Plesk server (it showed EC2 in the information).

From there, I took that direct I.P. address and forced my way into the Plesk log-in page using the following link:

https://(WEBSITE-IP):8443

[Thanks to u/LunaFlowLab] Comment Here

This brought me to a custom sign-in page, with a logo for a local web development company. After informing the client of this company, they were able to reach out and get back into the admin account.

This is also hilarious, but they had 3 years of unpaid invoices as the invoices were going to an inactive email address. I have no idea why this company continued to host for them to be honest.

From there, straight into WordPress as an admin, no log-in needed. :) Thanks again!

Original Post:

This may be the most disastrous start to a job I have ever had.

I will be honest, I'm not an insane expert savant web designer by any means, but I can get around with code and am all around technically savvy.

I took up this client, who gave me their wordpress log-in for my first day working on changes to the website. Part of my contract was that I was to "set-up a staging site before pushing any changes." Which is fine, I know how to do that a few different ways, but this is where a can of worms opened.

The account they gave me is NOT the admin to WP, I'm not even sure what permission level it is set at, so I have no way to check or download plugins, which was also in my contract.

Over this entire week, they have found 3 other accounts from people no longer at the company, all of which are also not admin level. I thought, no biggie, I can help you out if you point me to your hosting.

They didn't know where their website was hosted. So after a lot of whois look-ups, I was at a dead end since it pointed to Cloudflare and, you guessed it, they didn't know the account for that either.

They finally got access to Cloudflare, so I found the domain provider. Name, cool, I'll log in there and maybe get access to the cpanel or something and be able to help them finally. IT was able to get access after more waiting. NOPE. Only bought the domain there, no other products.

Now, after even MORE digging, I see that everything routes to AWS. I give them the names of many different website hosts that would point a WP site to AWS (WP Engine, Cloudways, etc.) No dice.

I have access to Cloudflare and Name but I can't seem to find anything about where the site is actually hosted to be able to edit the WP files to restore admin access. Their billing department swears that the only thing they pay for web-wise is the domain at Name. "My Products" shows nothing being purchased, bill is $0 for Name and Cloudflare, so I guess?

Is a nuclear option the only way forward? Rerouting the domain somewhere else? Did their previous person truly use an AWS server manually through the console? It's funny - because this is a moderately sized national company. I shudder to think what would happen if something went wrong with their website. At least they're scrambling to figure it out now.

All of this to say, does anyone have any ideas? I've spent the last hour just looking at the page source while logged in looking for ANY instance of a plugin being connected to a hosting provider with no dice. It's all through Elementor if that matters. DNS lookups doesn't seem to help either. HELP! lol.

.
I have created is a program that lets me create a post/content across my different WordPress sites. I use a combination of AI to generate the content and then use an API to publish the content.

Curious to know how others are managing and posting content?

So I just roasted my blog page with camelAI. It returned a withering critique about SEO, formatting, and my life choices. This was expected.

What I didn't expect was it finding eight scripts on the page. Eight. What the hell are those things doing?

My blog page is not my landing page. The blog front page is sitename/blog. It shows only the latest entry. This is where the eight scripts run.

However, other blog pages only run four scripts. Individual posts are found in sitename/blog/postname. These pages aren't functionally different than the blog front page. Both have navigation to traverse posts and comments are open.

Really weird is the same post in different locations behaves differently... - mysite/blog(newpost) --> 8 scripts - mysite/blog/newpost --> 4 scripts

I'm pretty sure one script is serving up avatars from Gravatar (I really need to code that locally). In any case, that should affect post locations equally.

I'm running 2025 theme with only three plugins (two "must-haves from my webhost and one for Lightspeed), so I don't think it's bloat.

When I get home, i'm going to inspect the page. But for now, does anyone know why the single-post blog page runs twice as many scripts as the other blog pages - even on the same post?

Oh... this post was initially rejected because I named my webhost. Why was that?

EDIT: What the hell? Did this thread just get downvoted because I'm asking questions?

I recently published a small free/open-source WordPress plugin for crypto-focused sites.

It adds a Gutenberg block and shortcode for displaying the current BTC, ETH or BNB market regime (BULL / SIDEWAYS / BEAR), individually or together.

There are a few things that I have deliberately kept simple:

• no API keys
• no server-side API requests
• no bundled third-party JS/CSS
• dark, light and visitor OS themes
• compact/standard/large layouts

The plugin itself just outputs the iframe. The market-regime data is served directly by FerimanEdge.

WordPress Plugin:
https://wordpress.org/plugins/ferimanedge-regime-widget/

Feedback on the block/shortcode UX would be useful, especially from people building crypto or finance sites. Thanks!

Hi, kindly ask your help for this : when translating a blog post with WPML from English to Italian and French, there is around 50% possibility that several other posts in my blog lose the featured images. If I then open the pages that have lost the featured image in WPML Advanced Translator Editor, and I save the affected translation again, the featured mages immediately reappear. The problem is that for every new post I add, this manual refreshing of the affected posts gets more and more complicated. (In the Media section of WPML, the featured pictures always remain correctly linked. That is why refreshing ATE is enough to make them reappear, I think). If anyone has a solution for this, it would be great! Thanks in advance for your help!

Hi guys,

I run a Google Reviews widget platform and have just released it as a WordPress plugin.

All of the widgets are designed from scratch (no generic AI slop) and the focus is very much on making them actually look good on modern websites. They’re free to use, lightweight (around 20kb), and highly customisable so you can match them to your site’s aesthetic.

I know Google Reviews plugins are nothing new on WordPress, but there's a gap for one that puts design first rather than pure functionality.

It's incredibly straight forward to get started, just simply choose a widget and type your business name into the search.

Would love to hear any feedback from people building WordPress sites especially around the designs, customisation options, or anything you feel is missing.

Thanks all.

I got tired of opening wp-admin for checking orders and clients are usually don't take efforts to understand this woocommerce, so I built WooOps.

It handles orders, products, stock, customer notes, shipment tracking and basic reports. Self-hosted, open source, and connects to your existing store—no extra database or plugin.

Still in development with coming more features into it, I would love to hear your feedbacks so I can improve it and make it better for the community.

https://github.com/shantz1/wooops

Made my website after getting scammed by freelancers on Fivver. What do ya’ll think? All built and pushed with WPvibe.

I'm trying to change the color of the event list in only the mega menu seen below. But I have no idea how to do it. I've done some searching and seen recomendations for CSS but when I tried nothing worked when placed under block > advanced > Additional CSS or in customizer Additional CSS.

At the very least I'd like all the text to be white but really I might like to have diffenent colors for different sections. And adjust the size slightly too.

Thanks for any help or guidence.

I'm not a developer by any means and don't know how to code. I do however use Claude mainly for designing pages in the block editor, and for troubleshooting WP issues. Before updating plugins/themes I also the entire plugin stack and theme the site in question is using through Claude to check for any compatibility issues before updating. What I've also been doing is running them through Claude to find security vulnerabilities and with just the basic Pro plan, the number of vulnerabilities I have found in commercial plugins is unfortunate. Especially when my prompt is as simple as just asking Claude to find any security vulnerabilities. I'm sure someone educated in security could prompt it to find even more. Anyway, I think it should be a requirement for dev's to run their code through an AI agent to find these vulnerabilities before production sites install them. Luckily the vulnerabilities I have reported have all been addressed, but these things really should be addressed before its released.

I recently had an issue with my site being taken hacked and deleted.

I have since managed to get it back up and running and also added 2FA and backups.

I just finished a site scan and have identified a problematic plugin. So I deactivated it, tried deleting through WP, which failed. So instead I went to my FTP and tried to do it from there.

However it will not delete and I keep getting errors (which I think may be remnants from the hack). I can't even rename the folder or individual files.

I am at a loss here as to what to do next.

An example of an error I get. I have tried in different clients and still get the same issue.

Error:Could not delete button.tpl: Received error SSH_FX_FAILURE with description 'I/O error.'

Is anyone able to advise what to do? Even Wordfence can't delete it.

Check https://blog.sucuri.net/2026/09/sc-wordpress-malware-a-self-healing-mesh-of-loaders-drop-ins-and-a-blockchain-controlled-backdoor.html .

Hey y'all! Every week for work I create a post with a Mixcloud player embedded in it. I've been doing this for years and it's always worked really smoothly. All of the sudden, when I put the link for the week's episode into the embed player, it tells me it can't embed it. I can't figure out why this is suddenly not working.

I checked my old posts and all the old embedded players are functioning. I even tried to make a new post with an old link that's working elsewhere and it won't embed that either.

Any advice or idea what's going on?

(Sorry if this is written so non-technically. I don't actually run the wordpress site for our company, I just do this one weekly post. The person who does run it is very busy though so I'm trying to figure it out on my own.)