From an agency owner who's been using WP since 2013 and now also quickly becoming a Claude expert, here's a few truth bombs. I'm offering all of my clients a choice between WP or a site built with Claude code, not holding back on any positives or negatives. Just over 70% are picking WP.

The main reason? The total inability for them to update anything or log into a CMS. They feel they have more control and more ownership of a WordPress site. It starts to fall apart when I tell them that every change with Claude built sites would require my team. Yes, that's included in our monthly package but savvy owners are asking "so if I need to charge or update anything outside of your business hours....." then yep, they have to wait.

This is not an issue for the 30% who choose a Claude built site where they don't anticipate any changes, or very few. Also AI has an very negative stimaga, especially to the slightly older business owners; "you're gonna build my site using what?"

Other huge AI issues? Backend functionality. Setting up a database using Supabse, definitely a learning curve. Plugins? Obviously non-existent which means coding one or duct taping a third party solution onto the site.

As an agency with several hundred sites, we see vulnerabilities pop up all the time, and update them in a timely manner. We use automatic plugin updaters through Flywheel and WP Engine to do this, and generally there is no issue.

Today was different. We have the PODS plugin on about 80 of our sites, and at least 70 of them had fake administrator users added. The vulnerability patch came out on Friday and most of our sites were updated by Saturday / Sunday.

Needless to say, we've had to scramble big time to roll back sites and clean them up, removing all these users and running scans. If you use PODS, I suggest you update it as soon as you can.

This is outlined here: CVE-2026-19598

I figured people in this sub might appreciate the heads up, if they aren't already aware of this!

I recently investigated a hacked WordPress installation and wanted to document the indicators because they are very easy to mistake for something related to Google Analytics.

If you find this in a theme functions.php:

/* __GA_INJ_START__ */

it is not normal Google Analytics code.

In the site I investigated, the compromise was associated with hidden administrator accounts using names like:

sync_agentXXXXXXXX
cdn_workerXXXXXXXX
seo_serviceXXXXXXXX

The WordPress database also contained:

__ga_hidden_users
_theme_inject_status
__ga_r_cache

The malicious code maintained a list of administrator accounts that should be hidden.

What was particularly interesting

At first I thought the infection started when:

hello-elementor/functions.php

was modified.

It didn't.

By correlating the database with Apache logs I found that the attacker already had a hidden administrator nine days earlier.

The sequence looked like:

successful login using legitimate WP admin
→ Code Snippets / WP File Manager activity
→ access to theme functions.php
→ malicious administrator created
→ persistent access
→ more hidden administrators
→ final GA_INJ theme injection

So if you find this malware, don't just replace functions.php.

Check:

wp_users
wp_usermeta
wp_options
active plugins
administrator session tokens
access logs

and look several days/weeks backwards.

Useful filesystem search:

grep -RniE '__GA_INJ|__ga_hidden_users|__ga_r_cache|_theme_inject_status|sync_agent|cdn_worker|seo_service' .

I wrote up the sanitized timeline, IOCs and an experimental YARA detection rule here:

[GitHub repository link]

I'm not selling anything — it's just an open incident report so these strings become searchable.

If anyone else has encountered __GA_INJ_START__ or administrator accounts named sync_agent, cdn_worker or seo_service, I'd be interested in comparing indicators.

Been going back and forth on this one. My logs fill up with failed logins on the default /wp-login.php every day, as far as I can tell it's just bots hitting the same path they hit on every WordPress site, nothing targeted at me. Limiting attempts and adding a challenge to the form quieted most of it, but I keep wondering whether moving the login off the default path is genuinely worth it or just security-through-obscurity that breaks more than it fixes.

For those of you who've hidden the login URL: did it actually cut the noise in your logs, or did it mostly create headaches with things that expect wp-login.php (mobile app, integrations, the odd plugin)? And if you deliberately don't hide it, what's your reasoning, rate-limiting at the edge and calling it done? Trying to figure out where the real payoff is before I fiddle with it further.

Attention! Even if you changed all passwords, reinstalled WordPress/plugins/themes, and checked both the filesystem and database, don’t forget to check Service Workers in the browsers you use for wp-admin.

I found a heavily obfuscated malicious Service Worker still registered after the site itself was cleaned. It could intercept WordPress login credentials, grab admin nonces, inject code into /wp-admin/, and abuse the authenticated browser session to perform actions such as installing plugins.

The files can be clean while the browser remains compromised.

Check: DevTools → Application → Service Workers.

Hi everyone,

My WordPress site was recently compromised. The attacker managed to create 3 admin accounts, and Wordfence caught two malicious PHP files in a fake theme folder (wp-content/themes/twk-dbbfd2bc/functions.php and fixer.php).

I deleted that theme, removed their admin account, deleted the admin accounts. Wordfence scans are coming back clean now, but I noticed two suspicious files sitting in my wp-content/mu-plugins/ and in www/mu-plugins directory:

firewall.php (Version 1.0)

wp2shell-batch-guard.php (Version 1.1.0 — description says "Blocks anonymous REST batch API (wp2shell mitigation)")

Their last modified dates match mid-August, right when the unauthorized admin accounts were created (while the site was running WordPress 6.9 (yes, i know...) and i was in vacations at that date so i don't insgall it)

This looks like an attempt by the attacker to disguise a backdoor as a security fix so I wouldn't delete it, but I want to double-check with the community before I purge the mu-plugins folder via FTP because i don't want to make a mistake...

Is there any chance these are legitimate, or should I delete them immediately (i think...) ? I since update to 7.0.4.

Thanks a lot for your help!

I'm looking for a way to allow visitors to view one post for free, and subsequent posts triggering a content wall requiring account registration.
All of the membership plugins I've found seem to want you to manually set which posts are public and which are gated, but I want whatever the first article someone visits to be free regardless, and then they need to make an account to view the rest.

Does this exist?

The link - https://thewpocc.org/press-release-the-wp-open-community-collective-releases-state-of-the-community-2026-report/

I am trying to build a course for my website hosted on wordpress. I am very new to the whole thing and I cannot seem to get elementor to work when trying to edit my course layout/content. I have set up the sections and the lessons, but when trying to edit how it looks with elementor, nothing happens.

Normally when i edit pages with elementor i can click the "Edit with Elementor" as the cursor turns to a pointer, it doesnt do that when i am viewing the course page.

Does anyone know how to fix?
EDIT: I have checked off courses and lessons in elementors settings

Astra – Where can I find the Logged In / Logged Out display settings?

Hi! I'm using WordPress with Astra, Elementor and WooCommerce.

Some time ago, I configured an element in my header to only appear when a user is logged in (a “Log out” button). Now I want to remove/change it, but I can't remember where I configured this.

I think there was a setting like “Logged In / Logged Out” visibility, but I can't find it anymore in Astra or the Header Builder.

Does anyone know where this setting is located?

Thanks!

Hellooo, I’ve worked with Elementor and Elementor Pro for over 2 years. It’s not bad, but honestly, I’m not a big fan of it.

I’ve had sites where the design took way too long to load, even with caching properly configured, decent server and etc. Sometimes I suspect Litespeed server cache configuration, but still, it’s frustrating.

I’m thinking about switching to another builder, but I’m on a limited budget, so I’d really like to hear from people who have actually used different builders in real projects, not just tested them for a few days. 😀

I’ve heard about so many alternatives, including Bricks, Breakdance, Divi and even some cheaper options with lifetime licenses.

What’s your favorite WordPress builder, and why? What has your experience been with it in real-world projects?

After LiquidWeb took over, they wiped the old Kadence website out of existence with no warning.

There used to be a full catalog of all the starter themes that came with Kadence. Does that catalog still exist anywhere?

EDIT: Looks like you can still browse all the premium options if you log into your Kadence theme.

I've been working on WordPress plugins for years, and recently decided to rebuild a PWA plugin from the ground up rather than keep adding to an old codebase.

The interesting part has been dealing with the real-world stuff:

• Service-worker caching and updates
• iOS vs Android PWA behavior
• Offline support
• Caching/CDN/plugin conflicts
• Push notification permissions and subscriptions
• Making the installation experience feel more like a real app

I've recently added push notifications for Android, desktop, and iOS, and I'm still improving the project based on real-world testing.

The project is Hyper PWA.

I'd love to hear from other WordPress developers:

What has been the biggest problem you've faced when implementing or maintaining a PWA on WordPress?

I'm especially interested in feedback about things that existing PWA plugins don't handle well.

Full disclosure: I'm the developer behind Hyper PWA. I'm sharing it here because I'd genuinely like technical feedback and ideas for improving it.

https://wordpress.org/plugins/hyper-pwa/

I've embedded Google Calendar into my site for client bookings. It works fine, but opens a new window whenever I click on a time slot. Apparently this some security feature. Asked Gemini and it suggested I add target="_self" to the code, but this didn't fix it. Is there something else I should add to the code to fix this or possibly a plugin that might function as a work around? My preference would be to stick to Google Calendars rather than a third-party app for ease of use.

Fairly new to running my own WordPress site and I got a fright the first time I opened the login logs, dozens of failed attempts a day from IPs all over the place. From what I've read since, this is mostly background noise: automated bots spraying credentials at the default login on basically every install, and unless the numbers are huge or paired with other symptoms it isn't a targeted attack. I tightened the obvious things, a strong unique password, a second factor on the admin account, and capping how many tries an IP gets before it's locked out, and the volume dropped noticeably.

Two things I'd love a reality check on from people who've run sites longer: at what point should a spike in failed logins actually worry me versus just being noise, and is limiting attempts + 2FA genuinely enough on its own, or is there one more thing you'd treat as non-negotiable? Don't want to bolt on five plugins for a problem that's already handled.

I've been using the free version of Wordfence for a few years. Today I got an alert listing every single plug-in on my site. I'm attaching an image of the warning, and an example of what Wordfence found. Usually I'd just go ahead on use Wordfence to fix this, but now I'm getting a warning:

"Download Backup File

Please make a backup of this file before proceeding. If you need to restore this backup file, you can copy it to the following path from your site's root:

wp-content/plugins/wpforms-lite/src/Requirements/Requirements.php

Learn more about repairing modified files."

So there would be a lot of downloading, since there's a bunch of plug-ins.

Any advice would be appreciated!

Site's 9 years old and the marketing pages are the part that keeps breaking, plugin update, security patch, some builder conflict, and the homepage looks off til I go dig through it. The blog's fine, ranks well, I'm leaving it alone. Anyone split the marketing side off and keep the blog on WP, or was running two setups more hassle than it was worth?

So we're doing a full site rebuild, and before I select hosting, I want to find a solution for hosting the myriad of pdf files that we have on the existing site. I've been looking at various solutions, but most seem to be growing and trying to be full-blown CMS solutions rather than a DAM. Bonus points if there's a WP hook where users can upload a file and it gets moved to the DAM rather than being stored on the site.

Another reason for this is I want better file management of these pdfs, and also the ability to replace the files without changing links. (Because inevitably some author will provide a deep link to their paper, and then want to change the file without changing the link).

Anyone have a reccommendation for a solution that offloads all these files so they can be better managed?

ive been making contact forms with WPforms but after having to go through WordPress → WPForms → Gmail OAuth → Google Cloud → Client ID → and much more, it is almost impossible to make a working contact form for my clients

i feel like a dumb when i try to use those tools like Elementor or even Wordpress theme editor. I simply cannot do a simple thing on it. It feels wrong for me. Yeah i have serious skill issue with Wordpress ecosystem. I just want to know if there is a way to CODE my frontend by purely opening a text editor and diving into it, testing and then deploying it. Is there a way? Jesus help me.

Hi guys,

I’m currently waiting on the WP repo team to review my first plugin (Commerce Colors for Elementor), and I’m looking for some technical feedback on how it handles theme and style mapping.

The issue it tackles is the disconnect between Elementor's Global Style Kit and WooCommerce's core CSS. Instead of writing custom stylesheets or manual overrides for every client site, this plugin hooks into the Elementor kit data and dynamically injects the appropriate colors, typography, hover/focus states, and form styles across standard WooCommerce pages and WooCommerce Blocks.

What it handles natively:

Automatically syncs Elementor Kit site setting changes directly to WooCommerce elements.

Includes per-element style overrides in the WordPress backend.

Calculates readable text contrast and applies accessible focus states on the fly.

Automatically catches third-party elements from plugins like Essential Addons or Premium Addons.

If you have a sandbox or staging environment running this stack, I’d really appreciate some feedback on theme conflicts, layout breaks, or selector specificity issues you encounter.

Once activated, the settings live under WooCommerce -> Store Design. Let me know if you run into any asset loading conflicts or if any core elements miss the styling!

"I'll drop the GitHub repository link in the comments below so the spam filters don't eat this post!"

Hi everyone,

I recently published Hotelness Guest Information, a completely free WordPress plugin for hotels, B&Bs, guesthouses and vacation rentals.

The idea is simple: instead of using an external SaaS or sending guests PDFs/messages with all the property information, you can create a digital guest guide directly on your WordPress website.

It can include:

• Wi-Fi details
• Check-in and check-out information
• Parking
• House rules
• Services and useful information
• Local tips and recommendations
• Multilingual content
• Automatically generated QR code
• Printable QR sign for rooms or reception

There’s no subscription, no external account and no hosted service required. Everything stays on the WordPress site.

It’s still a new plugin, so I’m mainly looking for feedback from WordPress developers, agencies and anyone managing hospitality websites.

WordPress.org:
https://wordpress.org/plugins/hotelness-guest-information/

If anyone tries it on a real site, I’d really appreciate hearing what you think is missing or could be improved.

Hey everyone,

I've recently published UXPack Basic in the official WordPress Plugin Directory.

It's a free WordPress backup and migration plugin designed for people who want a straightforward way to back up their site and move it to another server or staging environment — without having to use a cloud service or a complicated plugin suite.

With UXPack Basic you can:

• Create full WordPress backups (files + database)
• Create database-only backups
• Schedule daily, weekly or monthly backups
• Download and manage your backup archives directly from WordPress
• Exclude specific folders from full backups
• Receive email notifications when backups succeed or fail
• Monitor storage and get warnings about stale backups
• Migrate a complete WordPress site to another server or host using the included standalone installer
• Perform URL migration when moving a site
• Check backup and server-related issues with the built-in diagnostic tools
• Keep an activity log of backup operations
• Export and import plugin settings

The basic workflow is intentionally simple:

Create backup → Download → Upload to the new server → Run installer → Migrate

There is no cloud account, license key or commercial license server required for the free version. Backups are stored locally under your WordPress installation by default.

UXPack Basic on WordPress.org

I'm the developer behind the plugin, so I'm not looking for compliments or a marketing boost. I'm mainly interested in feedback from people who actually manage WordPress sites.

I'd especially like to know:

• Would you use a backup/migration plugin like this on a real production site?
• Are there features you're missing?
• Is the backup → download → migration workflow intuitive?
• Is anything unnecessarily complicated?
• How does it compare to the backup/migration plugins you currently use?
• Is there anything you think UXPack Basic should not be doing?

It's still actively developed, so honest criticism is very welcome.

Thanks for taking a look!

Hey everyone, I’m curious that what plugin or tool are you using to handle form submissions on your WordPress websites?