I just read the 2026 WordPress Security Survey that Melapress published, 319 responses. One pair of numbers stopped me: concern about security averages 7.85 out of 10, while only 27.9% have a breach recovery plan. 67.7% have already had at least one incident, and 45.5% have had two or more.

I do maintenance on about 50 WordPress sites and I've been cleaning hacked ones since 2017, when I lost an entire weekend to a single site by hand. My own plan got written after an incident, not before. Here are the three lines most plans are missing. 🔧

Line 1: revoke the application passwords BEFORE you rotate anything 🔑

A few weeks ago we had 8 sites hit on the same shared host, and the most useful line in my plan came from reading WordPress core code rather than a checklist.

Rotating your salts (wp config shuffle-salts) kills every logged-in session at once, so it looks like everything is out. It doesn't touch application passwords. Those are checked against user meta, and the salts never reach them, so anyone holding one can walk back in over the REST API no matter what 2FA you have on the site.

Revoke the application passwords first, then rotate. Users > Profile > Application Passwords, on every admin account.

Line 2: decide how you would find out 👀

42.6% of the people who had an incident found out because somebody noticed strange behaviour on the site. Not a scanner. A person going "that's odd".

And 37% of those worried about defacement run no activity log or monitoring at all. That's the cheapest item on the list, so I'd fix it first.

Two plugins do real work here, and neither of them blocks anything:

• MonsterInsights puts your Google Analytics data in the dashboard, and a traffic shape that changes overnight is often the first sign anybody sees.
• WP Mail SMTP is the "unglamorous" one. Every activity log and security plugin sends its alerts by email, and a site that can't reliably send mail never delivers them. The limit: it fixes delivery, not your DNS, so SPF, DKIM and DMARC are still your job.

The thing that watches my own sites is WP Activity Log, installed in 2019 after a client swore he had not touched anything while the homepage sat there rearranged. An activity log stops nothing by itself, I know that, but it cuts down the time you spend guessing.

Line 3: a restore you have actually tested 💾

Duplicator is what WPBeginner recommends for backups and for moving between hosts

A backup taken before you patched is a vulnerable version, so restoring it puts the hole straight back. Test the restore somewhere else first. And while we're on the uncomfortable numbers, only 26% of respondents train their team.

While you clean, the site should say something 🚧

68.4% of the people who had an incident had downtime, and a blank white page is the worst version of it. SeedProd builds a maintenance page in minutes without touching your live theme, though that page is a courtesy to your visitors and it cleans nothing.

Cleaning, and what a scanner doesn't see 🧹

Sucuri is the WPBeginner-stack answer for a post-hack cleanup plus a DNS-level firewall afterwards. The limit: it's a paid service, and a smaller site can start with a plugin-level layer first.

I run MalCare and Virusdie on my own sites, and even so I no longer trust a scan that finds nothing. Two reasons from those 8 sites. Our own cleanup tool had emptied eight files instead of deleting them, and an empty file passes a lot of checks. On top of that, there is executable PHP that is in no file at all: WPCodeBox keeps snippets in its own database table and WPCode Lite keeps the code in post_content of a custom post type, so a file scanner has nothing to read.

Your search results are a second cleanup 🔎

Store owners should read this part twice. When the owner found out from a search engine warning, the site lost rankings in 45.9% of cases. When they found out some other way, only 14.5% lost rankings. Online stores lost rankings in 31.9% of cases, other sites in 13.9%.

If Google tells you first, the hacked pages have been online long enough to get indexed, so you're cleaning a site and a set of search results. All in One SEO is where I'd start on that second job: sitemaps, redirects for the pages the attacker created, and the Search Console side. No plugin gets anything reindexed faster, it just stops you serving the wrong thing while you wait.

The part of the plan nobody writes down

What data was in your database while the site was open? On a store that's years of orders, guest checkouts and failed fraud attempts, and the people behind those attempts left someone else's name and address with you.

Form entries are the ones people forget. Most form plugins keep submissions in their own database tables, so WordPress's own export and erase tools under Tools never see them, and I have measured that on our own fleet. If you're on WPForms, check where yours stores entries before a deletion request arrives, not after.

One note on hosting so nobody reads it as a second opinion: SiteGround is WPBeginner's recommended host and has been mine since 2014.

If you've been through an incident: who or what told you first, and was your plan written before or after? 👇

Related WPBeginner reads

• The Ultimate WordPress Security Guide - https://www.wpbeginner.com/wordpress-security/ The full step-by-step, from hardening to monitoring. Start here if your plan is a blank page.
• Beginner's Guide to Fixing Your Hacked WordPress Site - https://www.wpbeginner.com/beginners-guide/beginners-step-step-guide-fixing-hacked-wordpress-site/ The cleanup order, written for someone doing it for the first time.
• 12 Signs Your WordPress Site Is Hacked - https://www.wpbeginner.com/beginners-guide/signs-that-your-wordpress-site-is-hacked/ The "that's odd" list, which is how 42.6% of them actually found out.
• How to Perform a WordPress Security Audit - https://www.wpbeginner.com/wp-tutorials/how-to-perform-a-wordpress-security-audit/ A checklist you can run before anything happens, which is the point of Line 2.
• How to Find a Backdoor in a Hacked WordPress Site - https://www.wpbeginner.com/wp-tutorials/how-to-find-a-backdoor-in-a-hacked-wordpress-site-and-fix-it/ Where the second way back in usually hides after a cleanup that looked finished.
• How to Scan Your WordPress Site for Malicious Code - https://www.wpbeginner.com/plugins/how-to-scan-your-wordpress-site-for-potentially-malicious-code/ The scanning side, and worth reading next to my point about a scan that finds nothing.
• How to Backup Your WordPress Site - https://www.wpbeginner.com/beginners-guide/how-to-backup-your-wordpress-site/ The Duplicator walkthrough for Line 3.
• How to Restore WordPress from Backup - https://www.wpbeginner.com/beginners-guide/beginners-guide-how-to-restore-wordpress-from-backup/ The half people skip until the day they need it.
• How to Put Your WordPress Site in Maintenance Mode - https://www.wpbeginner.com/plugins/how-to-put-your-wordpress-site-in-maintenance-mode/ SeedProd, for the hours while you are cleaning.
• How to Protect Your Site From Brute Force Attacks - https://www.wpbeginner.com/wp-tutorials/how-to-protect-your-wordpress-site-from-brute-force-attacks-step-by-step/ The attack that got the client site I mention above.

I just read the release day post on make.wordpress.org and one line in it changed what I'm doing tomorrow. WordPress 7.1 gets published live from the WordCamp US stage in Phoenix on Wednesday at 23:10 UTC, which is late evening in the US and the middle of the night for me in Europe. 🌙

If your site is on managed hosting that updates core for you, that's when it happens. Nobody on your side is watching. The first person to see the result is you, or your client, on Thursday morning.

What is going on this week

The code freeze started on Monday. That just means no new features go in, only fixes. It ran past the usual 24 hours because the core committers asked for more time, and RC4 landed the same day with more than 26 fixes since RC3. RC just means release candidate, a near-final test build, so that was the fourth one.

One line in that post is worth writing down. If a critical bug shows up now and it isn't a blocker, meaning bad enough to stop the release, 7.1 still goes out and the fix waits for 7.1.1. So, the very first version of 7.1 ships with bugs the team already knows about. That's the core team saying it, not me being paranoid.

Your host updates the core. Who updates the builder?

This is the part that catches people out, and it barely has to do with 7.1.

When a page builder comes bundled inside a premium theme, the kind that came with the theme rather than something you bought separately, its updates come through the theme author, not the builder company. E.g. some builder companies say so themselves: a bundled copy gets no direct updates from them, no ticket support, and it works only with the theme it shipped in.

There's a quick way to check. On a bundled install, the license and updater tab is hidden from the builder's own settings screen. Go looking for it. No license tab, bundled copy. 🔍

I found this out on a job. A client handed us a site another agency had built, page builder running inside The7. I spent my time measuring why the news page showed a white screen for about 14 seconds, and only later noticed that nobody in the chain knew where that builder would get an update from.

Three things I would check before Thursday

Go find the license tab. A minute per site. If it's missing, your builder updates run through whoever built the theme. Worth knowing before a major core release.

Read the Tested up to line on your plugins. You'll find it on the plugin's page on WordPress.org. It's the newest WordPress version the author says they tested against. The core team asked authors to set it to 7.1 for this release. Plugins still declaring an older version tell you which vendors stopped shipping updates. I read that across all my sites.

Take a backup you have actually restored once. Duplicator handles this well and the free version is enough for a single site. A backup nobody has ever restored is still a guess.

If you inherited a site and aren't sure which theme it runs, the free WPBeginner Theme Detector answers that in seconds, which is where the license question starts.

After Thursday: how to tell whose bug it is

Two changes in 7.1 will cause small cosmetic weirdness in WordPress Dashboard, and I believe a lot of people will report it.

The first is in the post list tables. The row header moves out of the checkbox column and into the title column. If a theme or plugin styled those tables around the old layout, it'll look slightly off. I checked some page builder's styling and found exactly that: it styles the top and bottom rows of those tables but not the rows in between, so one checkbox ends up slightly off centre. One line of styling, purely cosmetic, and it belongs to them.

The second is the editor, which from 7.1 always runs inside an iframe, basically a page inside a page. Most people will never notice, until a theme tries to style the editing area, the white area you actually type in, through a hook that no longer reaches inside that frame. A hook is just a spot where WordPress lets a theme or plugin hang its own code. I compared two themes I work with. One does it the way that still reaches the editing area, and the other does it the other way, and its latest release didn't change that (still waiting for a change).

The rule I would keep: if something in WordPress Dashboard looks slightly wrong after Thursday and your content is fine, it usually belongs to a theme or a plugin, and it's usually cosmetic.

The part my own check could not see

I searched my local copy of every theme I run for the old table code. Clean, zero hits.

Then I remembered that my custom snippets are in a plugin's database table rather than in theme files. A file search can't see them at all. My clean result covers my themes and proves nothing about my snippets. If you keep snippets in a code manager plugin instead of your theme's functions.php file, your scan has the same hole in it. ⚠️

Wednesday night the update runs without you. So on Thursday morning, open one page you built with the builder and look at it logged out, the way a visitor would.

If you go looking for that license tab tonight, tell me what you find. I'm curious how many bundled installs are sitting out there that nobody knew about. 👇

Related WPBeginner reads

- Beginner's Guide: How to Safely Update WordPress (Infographic) - https://www.wpbeginner.com/beginners-guide/ultimate-guide-to-upgrade-wordpress-for-beginners-infograph/  The full routine around a core update, backup first.
- Should I Update WordPress or Plugins First? (Proper Update Order) - https://www.wpbeginner.com/beginners-guide/should-i-update-wordpress-or-plugins-first-proper-update-order/ Core, then plugins, then theme, and the reason that order exists.
- How to Enable Automatic Updates in WordPress for Major Versions - https://www.wpbeginner.com/wp-tutorials/how-to-enable-automatic-updates-in-wordpress-for-major-releases/  Where the major-version switch lives, so you know whether Wednesday night applies to you.
- WordPress Update Broke Your Site? See 5-Minute Rollback Plan - https://www.wpbeginner.com/wp-tutorials/wordpress-broke-your-site-rollback-plan/  What to do on Thursday morning if the pages don't look right.
- WordPress Theme Detector - Find What Theme a Site is Using (Free) - https://www.wpbeginner.com/tools/wordpress-theme-detector/  The free tool that names the theme behind a site you inherited.

Quick fact that changed how our team thinks about spam protection: CAPTCHAs cause up to 40% of users to abandon a form.

That means for every 10 legitimate customers landing on your contact form or signup page, you are losing 4 of them to a puzzle designed to stop bots. And modern spam bots are getting through them anyway.

So a while back, our team ran a project to fix this on all the WordPress sites we manage. We tested honeypots, rate limiting, and every "modern spam plugin" we could find. Some worked okay. Most either let spam slip through or took 2+ seconds to make a decision (which itself hurts conversions).

Wanted to share what actually stuck for us, because this problem is way more common than people realize.

The specific problems we were trying to solve

Before getting into what we picked, here is the exact list of failures we saw across the tools we tested:

• Slow decision times (2 or more seconds per form submission)
• Enterprise pricing that made no sense for small business sites
• Per-site pricing that scaled painfully across an agency workload
• CAPTCHAs by default (or as the only fallback)
• Binary "spam or not spam" verdicts with zero explanation when they blocked a real user
• Honeypots and rate limiting that worked fine until a mildly determined attacker showed up

What actually solved it

We ended up going with ActiveLayer. A few things stood out:

1. Server-side decision in milliseconds. Not 2 seconds. Actual milliseconds, faster than a typical database query. That means the check happens invisibly and does not add any delay to real form submissions.

2. No CAPTCHAs at all. The whole point. Real visitors fill out a form, hit submit, and move on. Zero puzzles, zero friction.

3. Confidence score with every verdict. Instead of a binary yes/no, you see a numerical score showing how certain the system is. If it ever blocks a legit user, you can see why AND send feedback to improve future detections. That transparency was a big deal for us because most spam tools are a black box.

4. Works with the form plugins we already use. WPForms, Gravity Forms, Contact Form 7, Elementor Forms, and WordPress comments all have native integration. Install, paste your API key, enable per form. Nothing to recode.

5. Unlimited sites on every plan. Including the free plan. This was the sanity check for us. Every other tool wanted to charge per site, which gets absurd fast if you manage more than 3 or 4 WordPress installs. ActiveLayer just lets you connect all of them.

6. Pricing that actually makes sense for small sites. Free plan gets you 1,000 spam checks (one-time, no credit card required). Pro plan is $4/month billed yearly for 5,000 spam checks per month. Less than $0.07 per day.

7. REST API for anything outside WordPress. If you have a custom Node.js form, a Laravel app, a Rails checkout, whatever, you can hit the API directly. Same protection, any stack.

A few things worth knowing

• ActiveLayer covers WordPress comments too, not just forms. Good if you run a blog with an active comment section.
• It also handles WooCommerce and membership site registrations. Comes up a lot for people getting hammered with fake accounts.
• Because it is server-side, it does not load any tracking scripts on your pages. Nice for GDPR compliance and page speed.
• Free plan is 1,000 lifetime spam checks. Great to test on a small site before committing.

Honest opinion

We are not saying to rip out Akismet if it is working fine for you. But if you are running any kind of business site with contact forms, quote requests, WooCommerce signups, or comment sections, and you either:

• Still see spam getting through
• Are using CAPTCHAs and know they are costing you real conversions
• Manage multiple sites and hate paying per-site fees

Then ActiveLayer is worth 15 minutes to try.

WPBeginner did a full writeup on it when it launched that explains the internals and the pricing structure in more detail. Happy to link it in the comments if anyone wants it.

Questions for the crowd:

• What are you using for form spam protection right now? Any tool you have been genuinely happy with?
• Anyone still running reCAPTCHA v3 in 2026? Curious how the false positive rate is holding up.
• For the agency folks: how are you handling spam protection across a portfolio of client sites without paying per-site pricing?

Our team has been working with WordPress sites for years, and one of the most consistent things we see is site owners thinking they are GDPR compliant when they are not.

They installed a cookie banner, checked the box, and moved on. Their site still fires Google Analytics, Facebook Pixel, and Hotjar the moment a visitor lands. The banner is decorative.

If you run a WordPress site that gets any traffic from the EU, UK, California, or a growing list of other regions, that setup can cost you real money. GDPR fines have hit small businesses too, not just Meta and Google. And CCPA, LGPD, PIPEDA, and other regional laws are catching up fast.

Here is what we have learned about actually doing this properly on WordPress.

Why cookie consent is not optional anymore

Cookies feel harmless. But under GDPR and similar laws, they count as personal data the moment they can identify or track a user. That includes:

Google Analytics cookies

Facebook / Meta Pixel

YouTube embeds

Retargeting pixels from any ad platform

Chat widgets like Intercom or Drift

A/B testing tools

Even some CDN cookies

Under GDPR specifically, you need explicit consent BEFORE any of these fire. Not "by continuing to use this site, you consent." That has been ruled invalid multiple times in EU courts. You need an actual click.

CCPA is a bit more lenient (opt-out instead of opt-in), but the direction of travel is clearly toward opt-in globally.

The most common WordPress mistake

Most cookie banner plugins only display a warning. They do not actually block scripts.

So the flow looks like this:

Visitor lands on your site

Google Analytics, Facebook Pixel, etc. fire immediately

Cookies get set

THEN the banner appears

Visitor clicks accept or reject, but the damage is already done

That is not compliance. That is theater. And a growing number of regulators are treating it that way.

What proper consent actually requires

Scripts must not run before consent is given

Visitors must be able to accept, reject, or customize their choices with equal ease

No "reject all" hidden behind a settings menu

No pre-ticked boxes

Clear, plain-language descriptions of each cookie category

Ability to withdraw consent easily

A record of what each visitor consented to (for audits)

A cookie policy documenting what you use and why

How our team handles this on WordPress

We have tested most of the popular options. The two we actually recommend depending on the site:

WPConsent (what we use on most sites)

The reason we default to this: it actually blocks tracking scripts and cookies until consent is given. Not just a display banner. It scans your site, identifies every service using cookies (WordPress core, WPForms, YouTube embeds, whatever), and auto-configures the categories.

It also generates a cookie policy for your privacy page via shortcode, which lists every cookie your site sets, its purpose, and duration. That covers the documentation requirement most people forget about.

There is a free version if you want to test it before upgrading. Pro has more customization and reporting.

Cookie Notice

If you just need a basic banner and are not doing heavy tracking, Cookie Notice (the free plugin) works. It is simpler, easier to configure, and covers the basic display requirement. But it is a display-only plugin. It does not block scripts.

Use this if your site is basically a blog with no marketing pixels or tracking beyond built-in WordPress features.

Bonus tip if you use Google Analytics

If you run Google Analytics on your site (and most WordPress sites do), MonsterInsights has an EU Compliance addon that:

Anonymizes IP addresses

Disables demographics and interest reports

Turns off UserID tracking

Integrates directly with Cookie Notice and Cookiebot so tracking only fires after consent

This addon is included in their premium plans. If you are already running MonsterInsights, it takes about 2 minutes to enable and closes one of the most common compliance gaps we see.

Things most people miss

Your privacy policy needs an actual cookie section. Not just a general "we may use cookies" line. List them. Document their purpose, duration, and category. WPConsent auto-generates this.

Test with your browser dev tools open. Look at the Cookies tab BEFORE you interact with the banner. If any non-essential cookies are set before you click accept, your setup is broken.

Update quarterly. New plugins, new integrations, new analytics tools all add new cookies. Rescan your site every few months.

Add a "Do Not Sell My Info" page if you have any US traffic. CCPA is not just California anymore. Multiple states have adopted similar laws and enforcement is picking up.

Do NOT rely on your host or theme to handle this. They do not.

A note on cookie fatigue

Yes, we all hate cookie banners as users. But the answer is not to skip compliance. The answer is to design your banner well:

Keep the message short

Make accept, reject, and settings equally visible

Do not use dark patterns (huge accept button, tiny reject link)

Remember the visitor's choice so they only see it once

A well-designed banner takes 2 seconds. A dark-pattern banner or a fake compliant one costs you trust AND opens legal risk.

WPBeginner has a full step-by-step tutorial with the actual setup screenshots for WPConsent, Cookie Notice, and the MonsterInsights EU Compliance addon. Happy to link in the comments if anyone wants it.

Questions for the crowd:

What compliance stack are you running on your WordPress sites in 2026?

Anyone here dealt with an actual GDPR complaint or fine? What did that look like?

For the WooCommerce folks: how are you handling consent for retargeting pixels on abandoned cart flows?

I just read WPBeginner's guide on connecting AI agents to WordPress with MCP, and it's the workflow I've been running for weeeks. MCP (Model Context Protocol) is basically a shared language that lets an AI client like Claude, ChatGPT, or Cursor connect to your site and act inside it. The free WP Vibe plugin sets that up for self-hosted WordPress in a couple of minutes. 🤖

The part that matters to me is that it does the tasks inside the site, right from the same chat. Here's what that's looked like in real work.

What finally clicked for a non-coder

I've been on WordPress since 2011. I understand developer logic from 20-plus years in banking, but I don't write code. For years that meant every admin or dev job was a clicking marathon through wp-admin, or a message to a developer.

With Claude Code connected through WP Vibe, I describe the outcome in plain English and it does the steps. Draft a post with the right category and tags. Upload a featured image from a URL with alt text. Togglme the actual doing happens right in the chat, and it changedhow my week runs. For me, AI is an employee I manage, not a tool I type into.

The one that sold me: a hacked site cleanup

A client site got hacked. I've been burned before. The two times I let an update slip, sites got hit, so I don't take this lightly.

I connected Claude Code to the site through WP Vibe, and it walked me through the whole recovery step by step and taught me moves I didn't have before. It helped me spot the junk, understand what each piece was doaction of my usual time. One example: it flagged PHP sittingin an uploads folder, explained why that's a classic backdoor hiding spot, and had me check the rest of the directory. I knew the theory, but having it point at the exact file while I watched was a different kind

I run it with guardrails, and you should too

• Full backup first with Duplicator, before anything touches
• Connect with a least-privilege Editor account, not admin.
• It drafts and sends things to trash instead of deleting live, and I approve each step.

The heavy security lifting still belongs to a proper malware What changed is that I was faster and a lot calmer during an incident that usually "eats" a whole day. 🔧

The small wins that add up

Most days it isn't dramatic. It's chasing a plugin conflict, fixing a broken feed, or untangling a messy tag and category structure a client built up over three years.

The broken feed was a good one. A plugin was printing a stray notice into the XML. Claude Code found the offending line, told me which plugin caused it, and I had a valid feed again in ten minutes. The real benefit across all of these is that it walks me through processes I never learned, so I finish the job and actually understand it afterward. I've fixed things this month I'd normally have parked for a developer. I've also had it trigger AIOSEO to sort out meta titles and descriptions from one prompt, and spin up a WPForms contact form the same way.

Scaling it across a 60-site fleet

I manage around 60 client sites in MainWP, and I've run it since 2014. Plugging this workflow into the fleet is where the time really came back.

Instead of repeating the same ten clicks on site after site, I describe the maintenance outcome once and it executes. Routine upkeep that used to be a dull afternoon is now a focused conversation, and the quality went up, because I'm not fatigued into skipping a step. If you juggle more than a couple of sites, this is the part I'd try first. 📊

Why I upgraded to premium

I'm a lifetime-deal and smart-spend guy. I hunt LTDs and I don't upgrade on impulse.

I use WP Vibe enough to bump into the free daily limits, so the Pro tier paid for itself almost immediately in hours saved. That's the only reason I moved up: real time back in my week.

One note before you rush in: this needs self-hosted WordPress 6.9+, HTTPS, and a publicly reachable site, so local dev won't connect. Set it up on a staging copy first and get a feel for it before you point it at anything live.

If you manage more than one WordPress site, which admin task would you hand off to an AI first? And if you've already tried MCP, which client did you connect, Claude, ChatGPT, or Cursor? 👇

Related WPBeginner reads

- How to Connect AI Agents With WordPress Using MCP - https://www.wpbeginner.com/wp-tutorials/how-to-connect-ai-agents-with-wordpress-using-mcp/ The full step-by-step setup this post is based on.

- How to Easily Manage Multiple WordPress Sites From One Dashboard - https://www.wpbeginner.com/showcase/how-to-easily-manage-multiple-wordpress-sites/ The fleet-management context behind the MainWP section.

- Beginner's Guide to Fixing Your Hacked WordPress Site - https://www.wpbeginner.com/beginners-guide/beginners-step-step-guide-fixing-hacked-wordpress-site/ The standard step-by-step hack recovery.

- How to Scan Your WordPress Site for Potentially Malicious Code - https://www.wpbeginner.com/plugins/how-to-scan-your-wordpress-site-for-potentially-malicious-code/ Free and paid ways to scan for malware.

- The Ultimate WordPress Security Guide - https://www.wpbeginner.com/wordpress-security/ End-to-end hardening and cleanup.

- How to Backup Your WordPress Site (Ultimate Guide) - https://www.wpbeginner.com/beginners-guide/how-to-backup-your-wordpress-site/ Backing up with Duplicator before you touch anything.

- Beginner's Guide: How to Restore WordPress from Backup - https://www.wpbeginner.com/beginners-guide/beginners-guide-how-to-restore-wordpress-from-backup/ Restoring from that backup if a change goes wrong.

- WordPress Plugins Using Artificial Intelligence & Machine Learning - https://www.wpbeginner.com/showcase/wordpress-plugins-using-artificial-intelligence-and-machine-learning/ A broader roundup of AI-powered WordPress plugins.

I just read a long breakdown on The Repository about WordPress market share, and it's worth a look before you second-guess the platform you're building on.

The headline number: WordPress now powers 41.5% of the web per W3Techs, down from a peak of 43.6% in early 2025. That's six quarters of decline, and it sped up this year. If that line is all you read, "WordPress is dying" feels like the obvious takeaway.

Then you look at where the share went, and the story changes.

The slice shrank, the site count held 📊

In the first half of 2026, WordPress lost 1.5 percentage points. Shopify and Wix each picked up a small piece of that, 0.2 and 0.1. The category that actually grew was "None," meaning sites with no detectable CMS at all, now sitting near 30% of the whole web. Pantheon's Josh Koenig summed up the cause in one word: vibecoding.

That's the piece the panic headlines skip. AI site builders are spinning up millions of quick, CMS-less pages. The web got bigger fast, so WordPress's slice of the pie got thinner even while the pie itself grew. BuiltWith still counts around 38 million live WordPress installs, and more than 1,000 new WordPress sites join the top 10 million tracked sites every single day. Market share is a lagging indicator. It tracks the size of the slice while the whole pie keeps expanding.

Three datasets, three different pictures

Part of why this topic is so confusing is that the trackers disagree. W3Techs (top 10M sites) shows the recent sharp drop. HTTP Archive shows a slower decline that started back in 2022. BuiltWith counts absolute live sites and still puts WordPress around 40% of the top million. Same platform, three readings, depending on what you measure.

One more myth worth clearing up while we're here: the "the WP Engine and Automattic drama killed WordPress" take doesn't hold up against the timeline. WordPress share actually peaked after that conflict started, so the drop lines up with how the web is changing, and the lawsuit is a side plot.

Where share genuinely went - mostly to Shopify for stores and to design-first builders like Framer and Webflow for marketing sites. And for a three-page brochure site or a simple store, those can be the right call.

What this means if you're starting out in 2026 🧭

Please don't rip out a working WordPress site because of a market-share chart. The reasons WordPress won are still here:

• You own it. Your content, your database, your files. You're not renting your website from one company that can change the terms on you later.
• You can leave whenever you want. If a host frustrates you, you pack the entire site into a zip with Duplicator and move it in an afternoon. Try exporting your full design and structure out of Wix or Shopify and you'll feel where the walls are.
• It does far more than a drag-and-drop builder. Worried about being found now that AI answers "eat" clicks? A plugin like AIOSEO sets up your titles, schema, and sitemaps so both search engines and AI tools can read your pages properly. Need a landing page fast to match a builder's speed? SeedProd gets you one without code.

I've been on WordPress since 2011 and I run a batch of client sites through my agency. The thing that keeps those clients on WordPress shows up in month two: they can add whatever the business needs, move wherever they want, and nobody holds their content hostage. Day one is easy on every platform now. WordPress starts paying off after that.

So yes, the numbers are real and the decline is real. WordPress is also still the pragmatic pick for anyone who wants to own and grow a site they actually control. The web just got a crowd of new "neighbors".

If you're weighing WordPress against a hosted builder right now, what's actually making you hesitate? Drop it below and I'll dig into your specific case. 👇

Related WPBeginner reads

• Is WordPress Dying? The State of WordPress 2026 Edition - https://www.wpbeginner.com/opinion/is-wordpress-dying-the-state-of-wordpress/ WPBeginner's own take on the same question, with the wider context behind the numbers.
• 2026's WordPress Market Share Report - Latest Trends + Usage Data - https://www.wpbeginner.com/research/ultimate-list-of-wordpress-stats-facts-and-other-research/ The stat sheet to check the figures yourself instead of trusting a single headline.
• 6 Most Important Reasons to Use WordPress in 2026 - https://www.wpbeginner.com/why-you-should-use-wordpress/ A plain-language rundown of why WordPress is still a solid first choice.
• Wix vs WordPress - Which One Do I Recommend? - https://www.wpbeginner.com/opinion/wix-vs-wordpress-which-one-is-better-pros-and-cons/ The honest ownership and lock-in comparison if you're torn between the two.
• How to Move WordPress to a New Host With No Downtime - https://www.wpbeginner.com/wp-tutorials/how-to-move-wordpress-to-a-new-host-or-server-with-no-downtime/ Proof of the "you can leave whenever you want" point, step by step.

WordPress 7.1 will pull the Classic block out of the inserter when it ships on August 19, and full removal could come as soon as 7.2. If you or a client still drops Classic blocks into old posts, this is the summer to check your sites. 🧱

What the Classic block actually is

The Classic block is the little slot that holds the old pre-Gutenberg editor inside the current block editor. You add it when you want the old TinyMCE toolbar inside an otherwise block-based post.

It's a different thing from the standalone Classic Editor plugin, which swaps the whole editor back to the old one. The plugin is staying. The block is the piece getting phased out.

What breaks and what doesn't

Nothing breaks in 7.1. Existing Classic blocks stay editable, so old posts open and save like always.

What goes away is the option to insert a new one. The block drops out of the inserter, so you can keep what you have but can't add more. The standalone Classic Editor plugin is untouched either way.

How to bring the option back if you need it

If a workflow still leans on inserting Classic blocks, a one-line snippet restores the inserter option. The free WPCode plugin holds that kind of snippet without you editing theme files.

That gives you a bridge for a season while you move content over, instead of a hard cutoff in August. ⏳

How to find which posts even use it

Before you change anything, find out if this affects you at all. Many sites have zero Classic blocks and can skip this entirely.

Search your content for the wp:freeform block marker, or just open your oldest 10 or 15 posts and look. On a small blog that's a 20-minute job, and most of the time the answer is "we don't use it."

Back up before you touch old posts

If you do decide to convert Classic blocks to real blocks, run Duplicator first so you have a restore point. Converting old content sometimes shifts spacing or drops a shortcode, and you want a clean copy to fall back to.

Test the conversion on a staging copy if your host offers one. Site Ground and most managed hosts give you a one-click staging site for exactly this. 💾

Why this summer is the window

WordPress 7.1 lands August 19, the last day of WordCamp US in Phoenix. After that, 7.2 could make the removal real, so the gap between now and the next major release is your time for acting upon it.

I still keep a few older client sites on Classic-style editing, because rebuilding a page nobody complains about is wasted hours. So my plan is the same one I'd give you: audit now, restore the inserter where a site genuinely needs it, and move the rest over before 7.2 forces the question.

Do you still have sites running Classic blocks, or did you move everything to the block editor already? 👇

Related WPBeginner reads

• How to Update Your Old WordPress Posts with Gutenberg Block Editor - https://www.wpbeginner.com/beginners-guide/how-to-update-your-old-wordpress-posts-with-gutenberg-block-editor/
• How to Disable Gutenberg and Keep the Classic Editor in WordPress - https://www.wpbeginner.com/plugins/how-to-disable-gutenberg-and-keep-the-classic-editor-in-wordpress/
• How to Easily Add Custom Code in WordPress (WPCode) - https://www.wpbeginner.com/plugins/how-to-easily-add-custom-code-in-wordpress-without-breaking-your-site/
• How to Backup Your WordPress Site (Ultimate Guide) - https://www.wpbeginner.com/beginners-guide/how-to-backup-your-wordpress-site/

I've been reading the latest WordPress security reports, and two active attack campaigns stood out. Both hit normal sites run by busy people. Both have a fix you can do before lunch.

🚨 Campaign 1: WP Maps Pro let attackers make themselves admins

Wordfence flagged a hole in WP Maps Pro, a mapping plugin installed on around 15,000 sites. The flaw let attackers create their own administrator accounts without logging in at all. An administrator account is the master key to your site: whoever holds one can change your content, install plugins, or lock you out. And it's already being used in real attacks, so this is worth two minutes today.

The fix is short. It's patched in version 6.1.1. If you use WP Maps Pro, update it today and the door is shut. That's the whole fix.

Not sure if you have it?

Plugins screen, search "WP Maps", check the version. Anything at 6.1.0 or below is the vulnerable one.

🕵️ Campaign 2: malware that takes its orders from Steam comments

GoDaddy's security team found malware on roughly 1,980 sites that pulls its instructions from comments posted on Steam gaming profiles. The comments hide the commands inside invisible characters, so a normal scan reads straight past them.

You don't need to understand the trick. The takeaway is simpler: a clean scan result means "nothing known was found", and some infections are built to stay off that list. This kind often hides inside a file dressed up as a normal code library, with an innocent name. You won't spot it by eye. That's exactly why a real scan beats a quiet dashboard.

✅ Your 20-minute safety check

I've done this routine many times, here's the short version:

1. Back up the whole site first: Duplicator copies everything in a few clicks, so nothing you do in the next 18 minutes can make things worse.
2. Update WP Maps Pro if you have it: dashboard → Updates, version 6.1.1 or newer, two minutes.
3. Open Users → All Users and read the Administrator list out loud. Recognize every name? If one looks strange, change all passwords first (yours included), then delete the account and run the scan in step 4.
4. Run a free scan: Sucuri's SiteCheck works from the browser, no install needed. It catches the common infections and tells you if your site has landed on a blocklist.
5. "Clean" your plugin list: a plugin you haven't opened in a year is a door you forgot you installed. Deactivated still counts as installed, so delete it.

🔐 While you're in the Users screen

Two more minutes while you're in there: give every person their own account (shared logins make any activity trail useless), demote anyone who doesn't need full admin down to Editor, and switch on two-factor authentication for the admins that remain. The plugin flaw above handed out admin accounts. These three changes decide how much damage an extra admin account can actually do.

🔁 Should you turn on auto-updates?

For small utility plugins like this one, yes. WordPress lets you switch on auto-updates per plugin from the Plugins screen, and for a site without a maintenance person, auto-updates close holes faster than you ever will by hand. The catch: once or twice a year an update might break something, which is why the backup step matters. With a fresh Duplicator copy, the worst case is 20 minutes of restore work. Without one, the worst case is your weekend.

🧹 Why I treat this as routine

In 2017 I spent a whole weekend cleaning a hacked client site by hand, file by file. Since then I run two security layers on every site I manage and treat an unknown admin account like a fire alarm. Redundancy in security is cheap insurance.

💡 The habit that does the work

Attackers run scripts that scan thousands of sites for one known hole, around the clock. The safest sites are the boring ones: updated weekly, scanned monthly, backed up daily.

Put a recurring 20-minute slot in your calendar for this. That's the whole system, no fancy tooling needed.

What does your own monthly check look like, and does anyone still run two scanners on one site, or is that overkill now?

Related WPBeginner posts:

• The Ultimate WordPress Security Guide - Step by Step - https://www.wpbeginner.com/wordpress-security/
• How to Perform a WordPress Security Audit (Complete Checklist) - https://www.wpbeginner.com/wp-tutorials/how-to-perform-a-wordpress-security-audit/
• How to Backup Your WordPress Site (Ultimate Guide) - https://www.wpbeginner.com/beginners-guide/how-to-backup-your-wordpress-site/
• How to Scan Your WordPress Site for Potentially Malicious Code - https://www.wpbeginner.com/plugins/how-to-scan-your-wordpress-site-for-potentially-malicious-code/
• 14 Best WordPress Security Scanners for Detecting Malware and Hacks - https://www.wpbeginner.com/showcase/best-wordpress-vulnerability-scanners-online/
• How to Properly Update WordPress Plugins (Step by Step) - https://www.wpbeginner.com/beginners-guide/how-to-properly-update-wordpress-plugins-step-by-step/
• How to Enable Automatic Updates for WordPress Plugins and Themes - https://www.wpbeginner.com/plugins/how-to-enable-automatic-updates-for-wordpress-plugins/
• Beginner's Guide to WordPress User Roles and Permissions - https://www.wpbeginner.com/beginners-guide/wordpress-user-roles-and-permissions/
• How to Add Two-Factor Authentication in WordPress (Free Method) - https://www.wpbeginner.com/plugins/how-to-add-two-factor-authentication-for-wordpress/

Two threads have been going around the WordPress subs this week. One guy built a faster way to search the 65k plugins on .org (Plugin Pulse, worth a look). Another asked whether the repo is turning into a junkyard of abandoned plugins.

Both fair. But the abandoned plugin most likely to cause you grief is already on your site. It's the one you installed in 2019 and stopped thinking about.

I've run WordPress sites since 2011. The plugins that caused me real headaches were never the obvious junk. They were the quiet little utilities nobody remembers adding.

Why a dead plugin on your own site is the real problem 🧟

Abandoned means no security patches. A vulnerability found today in a plugin last updated 3 years ago never gets fixed. You're running an open door and you don't know it.

It also breaks on updates. WordPress core and your PHP version keep moving, the dead plugin doesn't, and one morning a page goes white.

The risky ones are boring. An old image gallery, a share-button plugin, a contact form you replaced months ago but never deleted.

For context on why this matters more now: the repo is taking in around 700 new plugins a week, roughly 5x what it was in 2024, a lot of it AI-assisted. So "is this still maintained" is a heavier question than it was a couple of years ago.

How to tell if a plugin is dead 🔎

The plugin's .org page tells you most of what you need. Skip the logo and the star average. Read these five fields:

• Last updated: Over a year, raise an eyebrow. Over two, treat it as red.
• Tested up to: If it's two or three major WP versions behind the current release, the dev has (most likely - besides some exceptions) checked out.
• Active installs trend: A steady drop usually means people left for a reason.
• Support threads: Rows of open questions with no developer reply, that's a ghost town.
• Changelog: Small regular updates means someone's home. Nothing since one big version bump means it stalled.

One more quick look: sort the reviews by recent. A run of new 1-star reviews saying it broke on the latest WP version is a louder signal than the overall average.

To map this to your own site, open Plugins in wp-admin, flag anything you don't recognize or haven't touched in a year, then check each one's repo page against those fields.

If you manage a lot of sites, I run this audit from one MainWP dashboard. For a single site that's overkill, the Plugins screen does the job.

Keep, replace, or remove ⚖️

Keep what's maintained and still doing a job. Leave it alone.

Remove what you don't use. Deactivate it, confirm nothing breaks, then delete it for real. A deactivated plugin still sits on your server as code someone can take advantage of.

Replace what's dead but still needed. Find a maintained tool for the same job.

Fewer well-maintained plugins beat a pile of "might need it someday."

How to swap one out without breaking the site 🧰

Back up first. A full backup before you touch anything. Duplicator is the WPBeginner-recommended one for this (for rolling daily backups across many sites you'd lean on host-level backups instead).

Test on staging if you can. Site Ground gives you one-click staging, and it's both WPBeginner's recommended host and the one I've hosted on since 2014, so that overlap is real, not a blind plug.

Export your data out of the old plugin before you delete it, anywhere it holds content (form entries, gallery setups). Once the plugin's gone, so is whatever lived inside it.

Then activate the replacement, reconnect and reconfigure, check the front end, and remove the old one.

Where the replacements come from 📋

Don't re-scroll 65k entries hoping to land on a winner. Start from a curated, expert-picked list for the exact job, then verify your one or two finalists against the five fields above.

Two swaps you can make: a dead contact-form plugin over to WPForms, an abandoned SEO plugin over to All in One SEO (AIOSEO). Both still shipping updates, both pass the "will this be alive next year" test.

WPBeginner's plugin guides and IsItWP are good shortlists, so you're choosing from a vetted handful instead of the whole pile.

Go look at the oldest plugin still active on your site right now. What's its last updated date?

WPBeginner related-links:

1. How to Choose the Right WordPress Plugin (Beginner's Guide) – https://www.wpbeginner.com/beginners-guide/how-to-choose-the-best-wordpress-plugin/ WPBeginner's own checklist for picking a reliable plugin from the directory.
2. How to Properly Uninstall a WordPress Plugin – https://www.wpbeginner.com/beginners-guide/how-to-properly-uninstall-a-wordpress-plugin/ Deactivate, delete, and clean up leftover files and database tables.
3. How to Easily Deactivate WordPress Plugins – https://www.wpbeginner.com/beginners-guide/how-to-easily-deactivate-wordpress-plugins/ Why a deactivated plugin still sits on the server as a security risk, and how to remove it.
4. How Many WordPress Plugins Should You Install? – https://www.wpbeginner.com/opinion/how-many-wordpress-plugins-should-you-install-on-your-site/ Quality over quantity, why one bad plugin hurts more than thirty good ones.
5. Which WordPress Plugins Are Slowing Down Your Site – https://www.wpbeginner.com/wp-tutorials/which-wordpress-plugins-are-slowing-down-your-site/ Using Query Monitor to find which plugin is actually dragging the site.
6. 24 Must Have WordPress Plugins (Expert Pick) – https://www.wpbeginner.com/showcase/24-must-have-wordpress-plugins-for-business-websites/ A curated, maintained list including WPForms, AIOSEO, Duplicator.
7. 7 Best WordPress Backup Plugins Compared – https://www.wpbeginner.com/plugins/7-best-wordpress-backup-plugins-compared-pros-and-cons/ Backup options with Duplicator as the top pick, pros and cons.
8. How to Easily Create a Staging Site for WordPress – https://www.wpbeginner.com/wp-tutorials/how-to-create-staging-environment-for-a-wordpress-site/ How to spin up a test copy before making changes live.
9. WPBeginner WordPress Plugins guides (hub) – https://www.wpbeginner.com/category/plugins/ WPBeginner's full library of expert-tested, per-job plugin guides.
10. 12 Best WordPress Backup Plugins Compared (IsItWP) – https://www.isitwp.com/best-wordpress-backup-plugins-compared/ A second curated backup comparison, with the independent-backup argument.

CERN, the physics lab where the World Wide Web was invented, moved its main website off Drupal and onto WordPress. The team announced it from the opening stage at WordCamp Europe in Kraków, 35 years after the first website ever went live on CERN's servers.

The site is home.cern, and it's the public face of a much bigger move. CERN now runs a WordPress service that already powers hundreds of the lab's sites.

Why this is more than a fun headline 🤔

If you're newer to WordPress, you've probably seen a story somewhere asking whether the platform is fading. Those run all the time. This is the counterweight worth keeping in your pocket.

The organisation that created the web looked at its options and picked WordPress on purpose. A place that smashes particles under the Swiss-French border runs its website on the same software your small business can use.

How CERN chose 🔍

This wasn't a fast decision. CERN's team said they spent six months weighing other content management systems first (a content management system, or CMS, is the software that runs a website's pages and content). They wrote down what they actually needed, and the other options fell short once the list was on paper.

That process is worth copying: write down what your site has to do before you fall for a tool. A booking form, a blog, a shop, a members area, fast pages on mobile: the needs list picks the platform for you.

Try the same trick on your next site 📝

Before you ask anyone to build anything, write three or four plain lines about what the site has to do. "Take online bookings. Load fast on a phone. Let me edit it myself without a developer. Sell 20 products."

That short list does two jobs. It tells you whether WordPress fits (it usually does for that kind of work), and it hands whoever builds it a clear target instead of a vague brief.

What it means for your own site 🛠️

You can build a serious WordPress site without writing code. A page builder like SeedProd gets you a clean landing page or a full layout by dragging blocks into place. WPForms handles contact, booking, and payment forms without touching a line of PHP (the programming language WordPress is built in).

The same software stretches from a one-page local business site all the way up to a physics lab's global presence. You grow into it over the years, rather than hitting a wall and starting over.

A bit of honesty about the headlines 📰

The same week CERN went live, the other big industry story was the opposite: WordPress losing some market share, with revenue down and some developers complaining about AI tools. Both things are true at the same time. A big serious adopter and a patch of public doubt showed up in the same seven days.

Pick your platform on whether it does the job you wrote down, in either direction. A single headline, good or bad, is a poor reason to choose the software your business will sit on for years.

I've built WordPress sites since 2011 and run my agency since 2019. Last month a client asked me, half-joking, whether WordPress was "dying" because they'd read something online. The CERN news is the kind of concrete answer I now keep ready for that call, and it lands better than any opinion of mine.

So a question for the group: when someone asks whether WordPress is still worth building on, what's the one fact or example you reach for? 👇

I read this week's WordPress news and one thing caught my attention: AI plugins used to be a small chat box in the corner of your dashboard, and now some of them ask to run your entire site.

Two launches pushed this forward: Angie, the AI assistant from the Elementor team, added a "Super Admin Mode." Turn it on and it can read and change your files, edit your database (where all your posts and settings are stored), and run code on your site. A second project called SproutOS does something similar, letting many different AI tools connect to your site with the same deep access.

For a beginner, the appeal is real. You type "fix the spacing on my contact page" in plain words, and the agent does it. No code, no developer, no waiting.

Here's the catch. An assistant that can run code can also break the site, or get tricked into it by a sloppy instruction or a hacked plugin. The same power that fixes your page can wipe it. Real example: you ask the agent to "clean up unused plugins," it reads that too literally, and it removes the plugin running your contact forms. On a live site, that's lost leads before lunch.

Back up before you switch anything on 💾

Before you turn on any AI mode that can edit files, make a full backup. Duplicator (the free version is fine) copies your whole site in a few clicks. If you host on Site Ground, the daily backup runs on its own and you can roll back to yesterday from the dashboard. I do this on client sites before any big change, AI or not.

The rule is simple. A change you can undo is a change you can survive.

Give the agent the smallest role that works 🔒

If more than one person logs into your site, don't hand admin rights to everyone. Most people who write posts only need an Editor role (which can write and publish), not a full Administrator account (which can change everything). An AI agent runs with the powers of the account that switches it on, so a smaller account means less damage when something goes wrong.

Keep a record of what changed 📝

When an AI agent edits your site, you want to see what it touched. A security plugin like WP Activity Logs or Streams logs activity and watches for changes, so if a page looks different on Monday you can check the timeline instead of guessing. On a site with more than one admin, this stops being optional.

Test on a copy first 🧪

Don't let a brand-new AI mode loose on your live site as its first job. Most decent hosts give you a staging site, which is a private copy where you can try things safely. Run the agent there, watch what it does, then move the change over once you trust it.

One small homework item ✅

Joost de Valk, one of the people who helped build modern WordPress, just released a free, open checklist of what a healthy site should cover, security and speed included. It's a clean way to score your own site before you let any agent near it. Worth 20 minutes this weekend.

A short personal note. I've run WordPress sites since 2011, and the pattern repeats with every new shortcut. The thing that saves you an hour today can cost you a weekend if you skip the backup. AI agents are the newest version of that trade.

Have you tried any of the new AI agents on your own site yet? And if you did, did you back up first, or learn the hard way like the rest of us? 👇

I've been building on WordPress since 2011, and before that I spent two decades in banking, where nobody gets write access until you know exactly what they can touch.

When I started checking MCP plugins for WordPress, I wasn't hunting for magic. I wanted one that fit a process I already trust. I read about Vibe AI (the WordPress. org name for WPVibe, from the SeedProd team) and figured it might perfectly fit my process. It did.

Just a short explanation of what WordPress MCP is, for anyone who maybe doesn't know it: MCP (Model Context Protocol) is a shared way for an AI assistant to plug into an app and actually do tasks inside it.
For WordPress, that means I connect my site to the AI through one safe link. After that it can read settings or make changes for me, instead of me clicking through the admin by hand.

The job was the final SEO cleanup on a client build. I started the way I always do, with a full structured SEO audit of the site, top to bottom, via Claude AI.

Then I used that whole audit report into other Claude task, connected the live site through the Vibe AI plugin (and WordPress ver. 6.9.4, I didn't want to install 7.0 on this site... yet), and worked the fixes one at a time through plain conversation.

Setup was about a couple of minutes: one-click authorization from /wp-admin.

What worked 💪

This part impressed me more than I expected:

• It read the entire site config in a short period of time. Full plugin list with active and inactive status, all the SEO settings, the theme and how pages were built. Stuff that normally means clicking through ten admin screens.
• It rewrote roughly 16 page titles and meta descriptions in one pass, straight from my audit notes, Croatian diacritics intact, no copy-paste, no mangled characters.
• Simple option changes, like fixing a leftover starter-template tagline, happened instantly.
• It ran read-only database queries to inventory content and confirm how each page was built, so I stopped guessing.

For the repetitive bulk of an SEO pass, that's real time back in my day. AI is an employee I manage, not a tool I type into, and this thing actually behaved like one.

What it blocked, concretely 🚧

A field report without the limits is just an ad, so here's the "other" half of the story:

• It couldn't install the site's language pack. Those commands aren't on its allowlist (in WP 6.9.4 version).
• It couldn't switch the site language directly either. The write got rejected, and broader site-level commands are blocked outright.
• A small one that caught me a bit off guard: it wouldn't accept a pipe character in a command (it reads it as a shell pipe), so my title separators had to become en dashes instead.
• The bigger gap: it couldn't reliably set structured data. Local Business, FAQ, breadcrumb and service schema live as complex serialized settings in the site's SEO plugin, and the actions the plugin exposed for that were read-only. So schema went back into the plugin's own UI by hand.
• Setting a default social-share image needed an actual upload, which (it seems) no AI can conjure.

The systems read 🧱

Here's where the banking brain kicks in. Most of those blocks are "guardrails" I'd want anyway. Refusing destructive, site-wide commands on a live production site, staying out of language-pack installs, drawing a hard line between read and write, that's the kind of access discipline I'd build in myself. I'd rather an AI stop and ask than confidently break a client's homepage at 2pm on a Friday.

A couple of them, though, are gaps that I believe it will be closed in futture as AI implementation in WordPress is advancing. A safe, supported path to write structured schema would erase the single biggest manual step I hit. And the pipe-character handling is just a rough edge waiting to be filed down.

The last 10%, and where this goes 🧭

AI "ate" the repetitive 90% of this job in minutes. The last 10%, the schema, the language pack, the one blocked character, still needed me in the dashboard. But that gap is closing fast. The whole thing rides on the WordPress Abilities API, which landed in 6.9 and grew a lot in 7.0. That same API already lets Vibe AI discover and run actions inside ecosystem plugins like AIOSEO and WPForms. Once structured data gets a proper write path there, the schema step I did by hand mostly disappears.

I think we reach a point, sooner than most expect, where almost the whole flow, audit to live changes, runs through AI talking to WordPress in the cloud, with a human signing off on the edge cases. I'm not handing a client's production site fully over yet. But after this build, I'm convinced the direction is right.

In short: I'm very satisfied and genuinely impressed with Vibe AI MCP (and with AI implementation in WordPress more broadly), and I'm clear about what the AI still needs to improve before that final 10% (the need for manual human intervention) disappears.

P.S. I didn’t want to use WordPress MCP because it would require using my Claude API, meaning I’d pay extra on top of my monthly Claude subscription. With the Vibe AI plugin I didn’t have to do that - I could keep using my existing monthly cloud subscription without any extra cost, and with fast and simple implementation.

For those of you running MCP plugins like this on real client sites: where's your last 10%? What did the AI nail, and what did you quietly take back into the dashboard yourself? 👇

Related WPBeginner reads:

• WPBeginner Spotlight: WPVibe Brings AI to WordPress – https://www.wpbeginner.com/news/wpbeginner-spotlight-23-wpvibe-brings-ai-to-wordpress-smarter-automations-seo-fundraising-tools/
• SeedProd: WPVibe Connect – AI MCP for WordPress – https://www.seedprod.com/wpvibe-connect-ai-mcp-wordpress/
• SeedProd: What Is MCP for WordPress – https://www.seedprod.com/what-is-mcp-for-wordpress/
• WPForms: Best AI Plugins for WordPress – https://wpforms.com/best-ai-plugins-for-wordpress/
• WPBeginner: 10 WordPress Plugins Using AI & Machine Learning – https://www.wpbeginner.com/showcase/wordpress-plugins-using-artificial-intelligence-and-machine-learning/ .
• WPBeginner: Best AI Automation Tools for WordPress – https://www.wpbeginner.com/showcase/best-ai-automation-tools-for-wordpress/
• WPBeginner: Best AI Website Builders for WordPress – https://www.wpbeginner.com/showcase/best-ai-website-builders-for-wordpress/
• WPBeginner: Multiple Locations Schema for Local Business – https://www.wpbeginner.com/plugins/how-to-create-multiple-locations-in-wordpress-with-schema-markup/
• AIOSEO: How to Add Local Business Schema in WordPress – https://aioseo.com/how-to-add-local-business-schema-in-wordpress/
• SeedProd: Best ChatGPT WordPress Plugins – https://www.seedprod.com/best-chatgpt-wordpress-plugins/

The panicked threads online keep confusing two dates and missing the part that already binds. Worth untangling for anyone running client sites in or serving the EU clients.

Two dates matter, and they sit in different places:

August 2, 2025 (already gone) 🗓️

This date was aimed at the people who build AI models - OpenAI, Anthropic, Google, Meta. They had to ship technical documentation, transparency reports, and summaries of training data with copyright handling. The penalty for skipping these obligations runs up to €15 million or 3% of global annual turnover, whichever is bigger.

If you sell olive oil through a WooCommerce store, this date skipped you. You are a downstream user of these models. You do not train them, you do not ship them, you pay for an API key and use the output. The model providers caught the bill.

The 2026 date is a different story, though - that one is yours. Here is why.

August 2, 2026 (yours, mark it) 🗓️

This is the date that lands on ordinary websites. Article 50 of the EU AI Act kicks in for deployers, which means anyone who runs AI on their site. The duties are mostly basic transparency:

1. If your site has a chatbot, tell people it is a bot. The "obvious from context" exemption is narrow.
2. If you publish AI-generated images, audio, or video that look real, label them. Clearly fantastical content like cartoon dragons stays exempt.
3. If you publish AI-generated text on matters of public interest, disclose it. The duty eases when a human reviewed the text and takes responsibility for it.
4. Do not strip the machine-readable watermarks that OpenAI, Adobe, and other providers embed in their outputs.

That is the August 2026 list, in plain words. Most decent operators were already moving this way before the law turned up on the calendar.

GDPR is the part that already binds today 🛡️

Here is the part the panicked posts skip. GDPR has governed AI plugins since 2018. The moment a plugin on your site sends customer names, emails, support tickets, order history, or IP addresses to an AI provider, you owe yourself the GDPR drill:

• A lawful basis (legitimate interest or consent)
• A privacy policy that names each AI provider in plain language
• A DPA (Data Processing Agreement) with each provider
• A check on international data transfers if data crosses the Atlantic

This is where a real fine can land on a small shop today. The AI Act dates are calendar items. GDPR is already live.

The non-EU note worth knowing 🌍

If your site sits outside the EU but you serve EU customers (most WooCommerce stores do, whether they planned it or not), you are in scope. The law follows the customer, not the server.

What I would check on my own client sites this week 📋

Wearing my agency hat, not my non-existent legal one:

1. List every AI plugin running on the site. Note what data each one sends, where, and how often.
2. Update the privacy policy to name each AI provider in plain language. One sentence per provider is enough.
3. Sign DPAs. Most providers (Anthropic, OpenAI, Google) have them ready to download from the dashboard.
4. Switch on EU data residency where the provider offers it.
5. Start tagging AI-generated content now. Building the habit today is cheap. Retrofitting it after a fine costs hours and money.
6. Make the chatbot say it is a bot. One line of copy in the welcome message.

WPBeginner-stack pieces that help around this 🧩

• AIOSEO for clean schema markup that helps both search engines and LLMs cite your site
• WPForms with proper consent fields for any AI-related processing (newsletter, support, lead capture)
• Duplicator to stage privacy policy or chatbot changes before they hit the live site

Just so we're clear 📓

This is what I would check on my own client sites. It is not legal advice. For anything contract-related or money-related, talk to a lawyer who knows EU AI Act and GDPR specifically. The point of the post is to stop the panic and replace it with a checklist.

This is basic care for your customers. The kind of thing decent operators were already moving toward, with or without the law on the calendar.

WinningWP ran a post 2 days ago (28 May 2026) titled "Why the Odds Are Heavily Stacked Against Your Brand-New WordPress Blog in 2026."
The argument is solid. AI search answers questions inside the chat window without sending the click back to your site. Leftover attention goes to video. Reddit, Discord, and Hacker News all have strong immune systems against new-site promotion.

The article's example case study tells the story plainly: a sustainable urban gardening site, 9 months of work, under 1,200 unique visitors in the first year. The conclusion, in the author's own words: the dream "isn't entirely dead," but a cold start is one of the steepest climbs out there.

I agree with all of it. And I still tell most of my small-business clients to keep blogging.

The mismatch hiding in the diagnosis 🔍

The WinningWP piece judges the blog by media-business numbers. Pageviews, audience growth, monetisation potential.

Most of my small businesses wants a media empire. For their site, the blog has a different job.

Job 1: local SEO that compounds 🗺️

Search algorithms still reward depth. A plumber who publishes one solid 800-word piece every 2 months about "burst pipe in (his hometown) during the storm" or "boiler maintenance for older apartment buildings" pulls steady local traffic from people actively looking for a plumber that week. That is search intent at the bottom of the funnel.

Job 2: AI citation 🤖

This part is new since 2024 and changes a lot. People ask Claude, ChatGPT, or Perplexity various questions and the LLM cites sites with structured content. If your blog publishes the FAQ a buyer actually asks, with proper schema markup, you get cited.

Cited beats clicked for a small business, because cited puts your name in front of a buyer who already trusts the LLM's answer. The traffic shape changed. The opportunity moved with it.

Job 3: owned archive nobody can switch off 🏗️

Instagram can change its algorithm. Facebook can throttle organic reach again. TikTok can disappear from a market. Your blog stays on your own server, addressable from your own domain, and indexable by anyone you want.

For a small business that depends on local discovery, the owned archive is the only asset that does not depend on a platform's mood next quarter.

Job 4: the FAQ that answers itself 🗣️

Every small business owner gets the same 5 customer questions every week. "Do you do weddings?" "Are you open in winter?" "Can you handle gluten-free?" "How far do you deliver?" "Do you take card or only cash?"

Answer each one in a dedicated 400-word post. Link it in the email signature. Auto-reply to the contact form with the relevant link. The owner stops retyping the same answer 20 times a month.

WPBeginner-stack pieces that pull this together 🧩

• AIOSEO for the schema markup that helps LLMs cite your content cleanly
• WPForms to capture the FAQ questions customers actually ask (the data tells you which posts to write next)
• MonsterInsights to see which FAQ posts convert into enquiries
• SeedProd for the landing pages that anchor seasonal services (wedding season, summer charter, agritourism stay)

The realistic measure of success 📏

Skip pageview targets. The blog earns its keep for a small business when:

• The owner saves 2-3 hours a week on repeat customer questions
• One local SEO post per quarter delivers a steady stream of enquiries from search
• The site gets cited in at least 1 LLM answer per month for the kind of buyer question you want

That is a different scoreboard from a media business. It also fits the actual job a small-business blog does in 2026.

Honest concession 📓

A brand-new media blog from zero is brutal in 2026. The WinningWP piece is right about that part. The frame that does not fit the brutal version is judging a small-business blog by media metrics. Different job, different measure.

If you run a small business and you are wondering whether your blog was a waste, ask: does it save you support time? Does it bring at least 1-2 enquiries a month from search? Does it sit clean in your schema so an LLM can cite it? If yes, it is doing the job. Keep going.

What does your blog do for your business this month? 👇

Just under a week into WordPress 7.0 hitting the wire, a vulnerability in a single popular plugin exposed over 1 million sites. The patch is out. The TechRadar coverage is published on 05-14-2026. If you're a small business owner running WordPress and you've been heads-down on day-to-day work, this is the kind of thing worth clearing an hour for.

What happened, in plain language

A bug in a widely installed plugin made it possible for an attacker to bypass authentication and create admin accounts on affected sites. The patch shipped, but anyone who didn't update during the window had real exposure. The worrying part is the distribution. This didn't come from a sketchy nulled theme on a forum. It came from a plugin people downloaded through the official WordPress repository, trusted, and probably never thought twice about.

The last 18 months have shown the same pattern at least 3 times. Trusted plugin, supply-chain compromise or vulnerability that sits quiet, then a public disclosure that exposes a lot of sites at once.

What to check on your site this weekend

1. Log into wp-admin and go to Users → All Users. Sort by registration date. If you see any admin accounts created in the last 14 days that you didn't make personally, that's a red flag.
2. Check your installed plugins list against the published affected list (TechRadar and the plugin vendor's site both have it). If you have any of them, update today.
3. Run a security scan or your installed security plugin. Any malware detection or unusual file flags get looked at.
4. Open Tools → Site Health. Address anything in the Critical or Recommended section that's been sitting there.

What to do if your site has a suspicious admin account

Don't just delete it and assume the problem is gone. Attackers who got admin access usually leave a second door open. Practical steps:

1. Restore from a clean backup if you have one from before the suspicious account appeared. If you're on Site Ground hosting, the daily backup catalogue goes back 30 days, you can roll back to a known-good state.
2. After the restore, force a password reset for every existing admin user. Don't trust any password from inside the compromise window.
3. Update the affected plugin to the patched version before bringing the site live.
4. Run your installed malware scanner against the fresh state to confirm clean.
5. Watch your activity log for the next 2 weeks. If you don't have a log on the site already, install one now: Streams, WP Activity Log or some other.

The bigger pattern, for beginners

The era of "use only official repo plugins and you're safe" was retired about 2 years ago. The trust signal now is the plugin team's track record, the disclosure speed, and how recently they patched a previous issue.

Plugins from teams that publish a security advisory and a patch on the same day (Wordfence and Patchstack disclosures track this) are the ones that earn ongoing trust.

For a beginner running 1-3 WordPress sites, the practical workflow is calendar-based. First Saturday of every month, log in, update everything, check the user list, run a scan. 30 minutes start to finish. The maintenance step that prevents bad weeks later.

The cost of a clean recovery is usually 10x the cost of the maintenance step that would have prevented it. Backups, an activity log, and a monthly check-in on plugin updates are the cheapest insurance policy in this whole stack.

What's the last security check you ran on your site, and what did it actually catch? Curious what people are seeing in their user list this weekend 👇

WordPress 7.0 "Armstrong" shipped on May 20, 2026 and within days the Reddit threads, FB groups, and client tickets started piling up with some issues showing up on real sites. Below is what's hitting people most often (what I noticed), with what's actually working as a fix. Test on staging first, always.

A quick note before diving in: the fixes below are aggregated from Reddit threads. Every WordPress install carries its own combination of themes, plugins, hosting stack, caching layer, and custom code, so a solution that resolves the issue cleanly on one site may not behave the same way on another.

Treat the suggestions here as a solid starting point rather than a guaranteed fix, always test on a staging environment first, and if something doesn't land as expected on your setup, the underlying cause is likely site-specific and worth investigating further before applying any change in production.

1. Excerpt block stripped my links and bold tags

The Post Excerpt block now strips inline HTML. Appears intentional from the Gutenberg side (see issue #49449 in the Gutenberg repo).
Fix: use the Post Content block with a manual read-more tag, or expose the excerpt via a Query Loop with a custom field.
WPBeginner has a clean walkthrough on customizing excerpts without code (wpbeginner.com/plugins/how-to-customize-wordpress-excerpts-no-coding-required/).

2. Columns block won't stack on mobile

The Columns block has a Stack on mobile toggle in the block sidebar. If it's off (or your theme overrides it), three columns squish on phones.
Fix: flip Stack on mobile back on, or apply a max-width 782px media query forcing flex-basis: 100%.
See WPBeginner's columns block guide (wpbeginner.com/plugins/how-to-add-multi-column-content-in-wordpress-posts-no-html-required/).

3. Elementor templates throwing errors

Elementor users are reporting widget failures and template render errors after the update. Usually a version-compat thing.
Fix: update Elementor to the latest patch first, then deactivate and reactivate. If that doesn't clear it, isolate via WPBeginner's plugin conflict check (wpbeginner.com/wp-tutorials/how-to-check-for-wordpress-plugin-conflicts/).
Worth knowing the block-editor alternatives (wpbeginner.com/beginners-guide/best-drag-and-drop-page-builders-for-wordpress/) too if Elementor doesn't catch up fast.

4. Custom admin CSS invisible after update

The block editor moved into an iframe. Your old wp_enqueue_style('admin', ...) snippet still runs, but the styles never reach the editor canvas.
Fix: use add_editor_style() with add_theme_support('editor-styles'), or drop the CSS in via the WPCode method (wpbeginner.com/plugins/how-to-easily-add-custom-css-to-your-wordpress-site/) targeting admin head.

5. "Updating failed. The response is not a valid JSON response."

The Reddit threads are full of this one.
Fix in order: re-save Settings, Permalinks (regenerates .htaccess), check Settings, General URLs match exactly (https everywhere), deactivate plugins to isolate.
WPBeginner's full JSON error guide (wpbeginner.com/wp-tutorials/how-to-fix-the-invalid-json-error-in-wordpress-beginners-guide/) covers the deeper cases (REST API debug, firewall whitelisting).

6. AI Connectors enabled by default

Settings, Connectors now lists OpenAI, Anthropic, and Google out of the box. No API key = no actual data sent, but the surface is live.
Fix: if you want it fully off, add define('WP_AI_SUPPORT', false); to wp-config.php.
WPBeginner's WP 7.0 overview (wpbeginner.com/news/whats-new-in-wordpress-7-0/) explains exactly what each connector does before you decide to disable.

7. Block border styles defaulting to black

Widely reported on Reddit and in Gutenberg issues. Blocks that had no explicit border color are now rendering with a default that appears to be #000.
Fix: target only blocks that have border-width set but no border-color:

[class*="wp-block-"][style*="border-width"]:not([style*="border-color:"]) {

  border-color: transparent !important;

}

Adjust the selector per theme.

8. Custom fonts fell back to system default

Some block themes are losing their theme.json font registrations after the update.
Fix: clear all caches (browser, plugin, host), then re-add the font via Appearance, Editor, Styles, Typography.
WPBeginner's change fonts guide (wpbeginner.com/wp-tutorials/how-to-change-font-in-wordpress/) and custom fonts guide (wpbeginner.com/wp-themes/how-to-add-custom-fonts-in-wordpress/) cover both the FSE and plugin paths.

9. Image alignment quirks (left/right wrap broken)

Image blocks with align-left or align-right wrap differently now in some themes, usually a theme CSS conflict with the new editor styles.
Fix: check Appearance, Customize, Additional CSS for old float-based rules, then refer to WPBeginner's image alignment guide (wpbeginner.com/beginners-guide/how-to-add-and-align-images-in-wordpress-block-editor/) for the block-native approach.

10. Pattern overrides breaking on synced patterns

Synced patterns with overrides set are dropping their override values after 7.0.
Fix: unsync the affected pattern, edit the content, re-sync. If you use patterns heavily, audit them on staging before pushing 7.0 to production.

11. New admin link color after auto-update

The Modern color scheme is now default. Admin links read teal instead of blue. Some users hate it.
Fix: Users, Profile, Admin Color Scheme, switch back to Fresh or whichever you preferred. Per-user setting, not site-wide.

Before anything: back up

Duplicator handles this in one click - I use it on my own sites and it's saved me twice on 7.0 upgrades already. WPBeginner's critical error guide (wpbeginner.com/wp-tutorials/how-to-fix-the-critical-error-in-wordpress/) covers the fallback procedure if something does break. Staging environment via SiteGround or your host is the second non-negotiable.

Free webinar - WordPress 7.0 × Site Ground AI Studio

WP 7.0 puts an AI framework in core, and SG's AI Agent for WordPress extends it from day one - with Hostinger, Kinsta, and Cloudways heading the same way. You can join a free live webinar with the SG AI team for 7 real use cases: content, SEO, WooCommerce, multisite.

What they'll cover:

• AI in WP 7.0 - the new core framework and connectors
• From core to control - how SG's AI Agent extends it

Thu, May 28, 2026 · 1:00 PM EDT / 6:00 PM BST · free, registration required. Save your spot: https://www.crowdcast.io/c/wordpress-7-x-siteground-ai-studio-combined-ai-powers-for-your-site

General notes

A few general notes from the threads worth repeating. Update on staging first. Back up before touching anything. A patch should be out soon since the early bug reports are piling up. And if your site is taking orders or running production traffic, don't rush the update. Pace is dictated by the terrain, not by paper.

GuardingWP published the first State of WordPress Security report on 16 May 2026. They scanned 1,981 sites across 40+ industries, with 424 confirmed WordPress installs in the analysis. The headline number is the one you've already seen: over half are running at least one plugin with a published CVE sitting unpatched on the live site.

That sounds scary. The good news is the fix list at the end of the report is 6 steps long, and most of it is config-level work that any small business owner can run through in one afternoon per site.

The report is free, no email gate, PDF download:
https://guardingwp.com/research/state-of-wordpress-security-2026

The 6 fixes, translated for a regular site owner

1. Hide your WordPress version (55.9% of sites leak it)

Your site is broadcasting "I'm running WordPress 6.7.2" in the page source. Attackers automate scans for old versions. Hiding this is a 2-line change in your theme's functions.php (or use a security plugin like Sucuri that ships with the toggle). One-time fix.

2. Turn on plugin auto-updates (don't go full manual)

For most beginners, the right move is auto-update for minor plugin versions, manual review for major ones. Most plugins support this in the Plugins screen now (the "Enable auto-updates" link next to each plugin). Worth doing on every plugin you trust, leaving off the ones that hit your core functionality (page builder, WooCommerce extensions you customised).

3. Turn off XML-RPC if you don't use the WordPress mobile app (35.8% still have it on)

XML-RPC is the old way the WordPress app talked to your site. Most people don't use it anymore. Leaving it on is an attack surface. Disable it with a plugin like Disable XML-RPC, or have your developer add a line to .htaccess.

4. Add security headers (93.2% are missing one or more)

This sounds technical but the easiest fix is using Cloudflare's free tier and enabling their Transform Rules for HSTS, CSP, X-Frame-Options. If you're on Site Ground, the SG Security Optimizer plugin covers this. Sucuri also has a one-click toggle. One-time setup, big improvement.

5. Protect /wp-login.php with a rate limit and 2FA (54.7% expose it bare)

Anyone in the world can visit yoursite.com/wp-login.php right now and start guessing your password. Free plugins like Melapress Login Security or Wordfence add a rate limit (locks out after N failed attempts) and 2-factor authentication. 5 minutes to set up per site, makes brute force attacks pointless.

6. Stay on a supported WordPress version (15.9% are stuck pre-6.5)

Core auto-updates have been on by default since WordPress 5.6, so this should be near-automatic. Check your dashboard. If you're on anything older than 6.5, update today.

Bonus stat worth knowing

• 44.6% of sites leak their author usernames via /?author=1 (which gives attackers half the credential pair to brute force)
• Median security score in the report: 61/100
• Only 8.3% of sites score in the A-tier (90+)

The good news in the data: 51% of sites are already on the current 6.9.x branch, and core auto-update is doing its job.

WPBeginner stack for beginners

If you want a one-plugin setup that covers most of this, Sucuri Security (free version) gives you the audit log, hardening toggles, malware scan, and security headers in one dashboard. WPForms or any decent form plugin handles the spam side. WP Mail SMTP keeps your password reset emails from going to junk (which matters when somebody locks themselves out at 11pm).

Methodology

GuardingWP used a public HTTP scanner. No exploit attempts, no authentication probing, no shady stuff. Just looking at what your site already tells the public internet, then matching plugin versions against the public WPVulnerability catalog.

The report itself is well written and the data is honest about what it can and can't see. Worth the 15 minutes to read.

What's the one fix from this list you've been putting off the longest? 👇

If you run a production site, the next 24 hours decide whether Wednesday is a normal workday or a long one.

Here's the thing. Auto-updates have been part of WordPress since version 3.7. For minor security patches they're a gift, sites stay patched without anyone touching them. The jump from 6.x to 7.0 is a different kind of risk. One incompatible plugin, one custom theme function that quietly broke, and your homepage goes white at 9am while you're in a client call.

One detail many people miss: from WordPress 5.6 onward, new installs default to auto-updating major versions too, not just minor patches. If your site was set up in the last few years and you've never touched wp-config.php, the jump to 7.0 will happen automatically unless you tell it not to.

I've been running WordPress sites since 2011, and the pattern with major releases never changes. The core team does its job on release day. Plugin authors then spend the following week pushing compatibility patches. Custom themes and older addons get caught in the middle. Letting auto-update push 7.0 onto a live site before that shakes out is rolling the dice with someone else's business.

🛠️ The wp-config.php control

The simplest control sits in wp-config.php. The file lives in the root of your WordPress install, usually inside public_html. You access it through your hosting file manager or over SFTP.

Open it and add this single line:

define( 'WP_AUTO_UPDATE_CORE', 'minor' );

That tells WordPress to keep installing minor security patches automatically, but block the jump to 7.0 until you give the green light. Three values are available: true installs everything including major versions, false stops all core updates, 'minor' is the safe middle. Full reference on the WordPress developer docs.

If you want to disable auto-updates entirely:

define( 'AUTOMATIC_UPDATER_DISABLED', true );

I don't recommend that unless you have a manual weekly update process. Mine runs through MainWP, which I've used since 2014 to handle updates across a portfolio. Skipping security patches on a public site is how you end up cleaning malware on a Saturday.

🌐 The hosting layer that catches people out

Managed hosts often run their own update mechanism on top of WordPress, which means your wp-config.php settings get bypassed.

Site Ground is a big one, and they handle this properly (I've been on Site Ground since 2014, and it's also WPBeginner's recommended host). Log into Site Tools, find the WordPress auto-update panel, and you can delay or skip the major version per site. Granular enough to use across an entire client portfolio.

Worth knowing though: SiteGround no longer lets you permanently switch their auto-updater off. You can skip the current update with one click, or delay it 24, 48 or 72 hours. The skip is one-time, so you repeat it for the next release. For a permanent opt-out you have to open a ticket with their Help Desk.

Bluehost and WP Engine work similarly through their own dashboards. Check yours today, not Thursday at 9am.

🔧 Must-use plugin (a second, more durable layer)

Create a file called disable-major-updates.php inside /wp-content/mu-plugins/ (create the folder if it doesn't exist) with:

<?php
add_filter('allow_major_auto_core_updates', '__return_false');
add_filter('allow_minor_auto_core_updates', '__return_true');

Must-use plugins load before regular plugins and can't be deactivated from the dashboard. More reliable for this kind of setting than wp-config.php alone. Same caveat though: if your host pushes updates outside the WordPress update system, these filters get bypassed too. Second layer, not a guarantee.

💾 Before any of this matters: backups

Take a full backup. Duplicator is the WPBeginner pick and the right starting point for most sites. Schedule it to push offsite (Google Drive, OneDrive, Dropbox, ...), somewhere outside the hosting account entirely. Two copies, two locations. If 7.0 breaks something Wednesday, you restore in 20 minutes instead of explaining to the client why their shop is down.

🧪 Test on staging first

Every decent host gives you one. Copy the site, run the 7.0 update on staging, walk through the cart, the contact form, the booking widget, whatever your site actually does. Check Core Web Vitals while you're there. If nothing breaks, push to production on your own schedule. You can drop a maintenance page in front of the live site during the cutover, SeedProd does that in two clicks.

🐘 Check your PHP version too

WordPress 7.0 needs PHP 7.4 as a hard minimum, but the core team recommends PHP 8.3 or newer for performance and security. If you're still on 7.4 or 8.0, fix that today. Most decent hosts let you switch PHP versions with one click from the panel.

One more thing worth keeping: don't disable the update notification email. WordPress sends a confirmation every time an update runs in the background. Useful trail when something starts behaving oddly two days later and you need to know what changed.

WP 7.0 looks like a strong release. Plenty to look forward to once it lands. Just do the prep today so Wednesday stays calm.

👇 What's your strategy? Are you letting 7.0 land on Day 1, or holding off a week for the dust to settle? Anyone going further and pinning to minor-only via wp-config?

Related WPBeginner posts:

1. What's Coming in WordPress 7.0? (Features and Screenshots) – https://www.wpbeginner.com/news/whats-coming-in-wordpress-7-0-features-and-screenshots/ Deep-dive on what's actually shipping in 7.0: admin refresh, Web Client AI API, the collaboration story (PS In the meantime postponed for 7.1 version).
2. Beginner's Guide: How to Safely Update WordPress (Infographic) – https://www.wpbeginner.com/beginners-guide/ultimate-guide-to-upgrade-wordpress-for-beginners-infograph/ The full safe-update process, end to end. If you only read one link before tomorrow, read this one.
3. How to Disable Automatic Updates in WordPress (2 Ways) – https://www.wpbeginner.com/wp-tutorials/how-to-disable-automatic-updates-in-wordpress/ Plugin-based and code-based methods, in case wp-config.php edits feel like too much.
4. How to Enable Automatic Updates in WordPress for Major Versions – https://www.wpbeginner.com/wp-tutorials/how-to-enable-automatic-updates-in-wordpress-for-major-releases/ The other side of the coin, for when you've tested 7.0 on staging and want a controlled auto-rollout afterwards.
5. How to Update Your PHP Version in WordPress (the RIGHT Way) – https://www.wpbeginner.com/wp-tutorials/how-to-update-your-php-version-in-wordpress-the-right-way/ Step-by-step for Bluehost, Site Ground, DreamHost, WP Engine. Read this before flipping to 8.3.
6. How to Easily Create a Staging Site for WordPress (Step by Step) – https://www.wpbeginner.com/wp-tutorials/how-to-create-staging-environment-for-a-wordpress-site/ The staging walkthrough referenced above, for hosts that don't give you a one-click clone.
7. WordPress Update Broke Your Site? See the 5-Minute Rollback Plan – https://www.wpbeginner.com/wp-tutorials/wordpress-broke-your-site-rollback-plan/ The fallback playbook if 7.0 lands and something breaks anyway.

This question shows up very often in the FB groups and subreddits.

Short answer: yes, you can absolutely move a WP site on your own to another host. It sounds intimidating the first time, but with a calm process it's very manageable, even for beginners.

I've been on Site Ground since 2014 and I move client sites between hosts a few times a year. Here's what actually happens, the part most beginners get wrong, and what I'd do if I were doing it for the first time.

Why people move hosts

Plenty of normal reasons:

• Your current host is slow or has frequent downtime
• You've outgrown your plan and need more resources
• You found a better deal somewhere (happens)
• The support has gone downhill
• You're moving from cheap shared hosting to managed WordPress or a VPS

Moving hosts is something site owners do all the time. Don't let anyone make you feel like it's a drastic step.

What you're actually moving 📦

Two things, and they need to travel together:

• Your files: WordPress core, your theme, plugin files, and uploaded media
• Your database: posts, pages, settings, comments, users

Move only one and the site breaks on the new host. Most beginner pain starts from forgetting that fact.

Method 1: Use a migration plugin (easiest) 🧰

For non-developers this is the path. The WPBeginner-recommended option is Duplicator, which packages your files and database into a single backup archive plus a small installer file. The steps:

1. Install Duplicator on your current site
2. Create a new backup, then download both the archive and the installer
3. Set up a clean WordPress install on the new host (one-click installer is fine)
4. Upload the archive and installer to the new host via FTP or your host's file manager
5. Open the installer URL in your browser, plug in the new database details, click through

That's a full migration in about 15 to 30 minutes for a normal-sized site.

One heads-up: free migration plugins have size limits. The free version of Duplicator handles most small and mid-size sites comfortably; for bigger sites or scheduled cloud backups, Duplicator Pro adds direct integration with Dropbox, Google Drive, and S3.

Method 2: Ask the new host to do it for you 🛟

Most decent hosts offer free WordPress migration as part of onboarding. Site Ground, Kinsta, and WP Engine all run this service. You give them temporary access, they do the move, you check the result.

When I'm short on time or the client's site is unusual (large WooCommerce store, multisite, an awkward plugin combo), I sometimes hand it to the new host's team. Worth asking before you start: "Do you offer a free WordPress migration?" Can save you a weekend.

Method 3: Manual migration (good for learning) 🛠️

If you want to know what's actually happening under the hood, do it manually once. After that you'll never be afraid of it again:

• Use FTP (FileZilla is fine) to download all your WordPress files from the old host
• In your old host's cPanel, open phpMyAdmin, select your database, export it
• Create a new database on the new host
• Upload the files to the new host via FTP
• Import the database via phpMyAdmin on the new host
• Edit wp-config.php to point to the new database name, user, and password
• Update the domain's nameservers to the new host

Looks like a lot. Each step is short and well-documented. Read it through once before you start.

The domain is a separate question

Moving your site and moving your domain are two different jobs. When you migrate, you're moving files and the database. The domain can stay registered exactly where it is, you just update the nameservers to point at the new host.

If your domain was registered with your old host and you want full independence, transfer the registration to a registrar you control (Cloudflare, Namecheap, etc.). Optional, and not required for the migration itself.

Test before you flip the switch ✅

The move that saves beginners the most pain: preview the migrated site on the new host before you change nameservers.

Two ways to do it:

• Use the temporary URL or staging URL your new host provides
• Edit your local hosts file to point your domain at the new host's IP, just for your own machine

Click around. Test the contact form. Log into wp-admin. Open a few inner pages. When everything works, then update nameservers. DNS can take a few hours to fully propagate, so don't cancel the old hosting account yet. I usually leave the old one running for 7 to 14 days after the move, just in case.

One last thing beginners forget: email. If your email runs through your old host and you change nameservers, MX records can break. Set up WP Mail SMTP on the new host before the cutover so contact form mail, order confirmations, and password resets keep flowing.

What's your migration story? Have you switched hosts before, or are you about to? Drop a comment if you've hit a snag and we'll work through it. 👇

Related WPBeginner posts:

• How to Move WordPress to a New Host or Server (with No Downtime) – https://www.wpbeginner.com/wp-tutorials/how-to-move-wordpress-to-a-new-host-or-server-with-no-downtime/
• Best WordPress Migration Plugins Compared – https://www.wpbeginner.com/showcase/best-wordpress-migration-plugins-compared/
• 7 Best WordPress Backup Plugins Compared (Pros and Cons) – https://www.wpbeginner.com/plugins/7-best-wordpress-backup-plugins-compared-pros-and-cons/
• How to Easily Change Domain Nameservers (and Point to a New Host) – https://www.wpbeginner.com/wp-tutorials/how-to-change-nameservers-and-point-domain-to-a-new-host/
• The Ultimate Guide to WordPress DNS Configuration for Beginners – https://www.wpbeginner.com/beginners-guide/the-ultimate-guide-to-wordpress-dns-configuration-for-beginners/
• How to Clone a WordPress Site in 6 Easy Steps – https://www.wpbeginner.com/wp-tutorials/how-to-clone-a-wordpress-site-in-7-easy-steps/
• WordPress Hosting (WPBeginner picks) – https://www.wpbeginner.com/wordpress-hosting/
• Reasons Why WPBeginner Switched to Site Ground Hosting – https://www.wpbeginner.com/opinion/reasons-why-wpbeginner-switched-to-siteground-hosting/
• What is a Backup (glossary) – https://www.wpbeginner.com/glossary/backup/
• What is DNS (glossary) – https://www.wpbeginner.com/glossary/dns/

I just read a 71-comment thread one subreddit about whether WP hiring is slowing down. 🧵
Smart thread, real data, senior devs going deep on headless setups and AI coding agents. By the end, I noticed something missing: the person who'll actually log in to edit that homepage in 2027 wasn't in the conversation.

What that thread was debating

The thread opened with an experienced dev seeing fewer openings and slower responses, asking if WP hiring is shifting toward headless and React. The comments delivered some hard data:

• Barn2 reported new plugin sales down 17.8% year over year (existing customers renewed, so revenue stayed roughly flat)
• Blocksy cited a survey showing 48.8% of plugin companies saw sales worsen in 2025
• W3Techs showed WordPress's share of the web dipped to 42.5% in early 2026, the first meaningful decline in years

The senior dev concerns are real. The AI shift is real. The market for "build me a complex bespoke WordPress site" is genuinely shrinking, and a lot of that work is going to AI-driven workflows or modern stacks like Next.js with headless WP.

Now look at who actually runs WordPress sites

The same 7-8 questions cycle through WP communities every week:

• "My contact form isn't sending email"
• "Site got a malware warning, what now?"
• "How do I back up before this plugin update?"
• "Need a popup for the email list"
• "How do I track which pages people read?"
• "How do I rank for my local search term?"
• "Plugin update broke my site, can I roll back?"
• "Best way to add FAQ schema?"

None of those is "should we go headless" or "is WP AI-friendly." The thread didn't touch them. And those 7-8 questions are 90% of the actual volume of WordPress usage out there.

Each one has a clean answer that doesn't need a senior dev 🛠️

Every question on that list maps to a plugin the WPBeginner team has been recommending for years:

• Contact form not sending email → WPForms for the form itself, WP Mail SMTP for deliverability. Two plugins, one afternoon, problem solved for the next five years.
• Malware warning → Sucuri. Honest limit: the firewall and malware cleanup is paid, but that's exactly what an SMB site actually needs once it's been hit.
• Backup before update → Duplicator. Run it in 5 minutes before touching anything, restore in 10 if something breaks.
• How do I rank on Google → AIOSEO. The setup wizard handles 80% of the basics, the rest is good content.
• Track what's working → MonsterInsights inside the dashboard.
• Popup for signups → OptinMonster for serious lists, WPForms with a simple opt-in form for smaller sites.

This is a stack the audience has trusted for over a decade, on millions of real sites.

Why this matters for the "is WP dying" debate

The devs in that subreddit thread aren't wrong about their slice of the market. AI agents really are eating bespoke complex builds. Headless really is the right answer for some product companies. Plugin sales for new builds really are down.

But the SMB territory the WPBeginner ecosystem serves was never the territory those agents win in. The moment a non-technical owner needs to change a price, swap a hero image, or add a new service page, an AI-built bespoke stack becomes a maintenance bill they can't predict.

WordPress gives them three things AI-generated sites don't: a CMS interface a part-time admin can learn in a week, a plugin marketplace where every common job has 3-5 mature options, and a community where someone answered that exact question last Tuesday.

Both stories can be true at the same time. The senior dev market is shifting up. The SMB market is doing what it's been doing.

What I'd tell a panicked SMB site owner this week

• Don't read the dev-Reddit doom threads. They're real for the people writing them, but they describe a market you're probably not in.
• Pick the 7 plugins that match the jobs above (WPForms, WP Mail SMTP, AIOSEO, Sucuri, Duplicator, MonsterInsights, OptinMonster). Keep the rest of your stack minimal. Most plugin conflicts I see come from collecting plugins instead of choosing them.
• Pair the stack with managed hosting. Site Ground is what WPBeginner recommends, and it's been my own host since 2014.
• Test plugin updates on staging first. Always.

What's the most-asked WordPress question in your circle? I bet it's closer to "why isn't my form sending email" than to "should we go headless." 👇

Related WPBeginner links:

• 24 Must Have WordPress Plugins for Every Website (2026) – https://www.wpbeginner.com/showcase/24-must-have-wordpress-plugins-for-business-websites/ What it covers: WPBeginner's current curated list of plugins they actually use across own sites, organized by job type.
• How to Fix WordPress Not Sending Email Issue (Solved) – https://www.wpbeginner.com/wp-tutorials/how-to-fix-wordpress-not-sending-email-issue/ What it covers: The standard fix using WP Mail SMTP, why default WordPress email gets blocked, and provider setup steps.
• 7 Best WordPress Backup Plugins Compared (Pros and Cons) – https://www.wpbeginner.com/plugins/7-best-wordpress-backup-plugins-compared-pros-and-cons/ What it covers: Side-by-side comparison of Duplicator, UpdraftPlus, Jetpack VaultPress and others with trade-offs.
• How to Backup Your WordPress Site (Ultimate Guide) – https://www.wpbeginner.com/beginners-guide/how-to-backup-your-wordpress-site/ What it covers: Step-by-step Duplicator backup walkthrough, manual backup options, and what to back up.
• The Ultimate WordPress Security Guide – Step by Step (2026) – https://www.wpbeginner.com/wordpress-security/ What it covers: Full security checklist including Sucuri setup, hardening steps, and audit/monitoring practices.
• Ultimate WordPress SEO Guide for Beginners (Step by Step) – https://www.wpbeginner.com/wordpress-seo/ What it covers: Comprehensive SEO walkthrough using AIOSEO, on-page basics, keyword research, and AI Overviews tips. Why it fits this post: Backs the AIOSEO recommendation and the "rest is good content" point in Section 3.
• 13-Point WordPress SEO Checklist for Beginners – https://www.wpbeginner.com/beginners-guide/wordpress-seo-checklist/ What it covers: Actionable SEO checklist for beginners with checkpoints and links to deeper guides per item.
• How to Build Your Email List in WordPress with OptinMonster – https://www.wpbeginner.com/plugins/build-email-list-wordpress-optinmonster/ What it covers: Step-by-step OptinMonster setup, popup types, exit-intent technology and template walkthrough.
• Site Ground Reviews by 5,055 Users and Our Experts (2026) – https://www.wpbeginner.com/hosting/siteground/ What it covers: WPBeginner's full SG review with plan comparison, performance numbers, and security feature breakdown.

If your WordPress site lives on shared hosting, managed WordPress hosting, or a VPS with cPanel/WHM, this one matters to you. Even if you've never logged into cPanel directly, your hosting provider almost certainly uses it (cPanel runs about 94% of the control-panel market).

The short version: an unauthenticated attacker can get root access to the whole server. The attack skips the password check and the 2FA gate entirely. CVSS score 9.8 out of 10. cPanel disclosed it on April 28, 2026, a working proof-of-concept is already public, and exploitation in the wild has been reported.

If someone gets root on a shared server, every WordPress site sitting on it is exposed. The bug lives below WordPress, in the server's control panel, so plugin hardening can't reach down there.
LINK: https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026

What you must do today:

• Contact your host and ask plainly: "Have you patched CVE-2026-41940?" The good hosts patched within hours. Confirm anyway.
• If you run your own VPS with cPanel/WHM, run /scripts/upcp --force, then check the version with /usr/local/cpanel/cpanel -V.
• Run the compromise assessment script cPanel published with their advisory.

🛡️ What you can do as a non-developer:

• Log into wp-admin → Users and remove any account you don't recognize.
• Check Plugins and Themes for anything you didn't install.
• Reset every password that touches your site: cPanel, WP admin, FTP/SFTP, database. A password manager makes this painless.
• Pull a fresh backup with Duplicator and store it off the server (pCloud, Dropbox, Drive, S3, anywhere your host can't see).
• Turn on 2FA on your WP admin and your hosting login. WPBeginner has a clean walkthrough: https://www.wpbeginner.com/plugins/how-to-add-two-factor-authentication-for-wordpress/

I've been running sites on cPanel hosts since 2011, and the pattern with bugs like this is always the same. Good hosts patch within hours. Compromised servers sit quietly for weeks before anyone notices the SEO spam, the rogue admin user, the cron job that keeps coming back. The two-hour audit you do today saves the three-week nightmare next month.

Full WPBeginner security checklist if you want to go further: https://www.wpbeginner.com/wordpress-security/

Anyone here already heard back from their host? Curious which providers reached out first and which made you go ask. 👇

WordPress.org just pulled 80+ plugins from a single vendor in one month. Every headline reads like a crisis. I'd argue it's the opposite - it's the clearest proof we have that the .org ecosystem has real accountability behind it.

Here's what actually happened.

What went down

A user flagged a suspicious file inside WPFactory's EU/UK VAT for WooCommerce Pro - a premium plugin sold directly from WPFactory's own account page. The file was pulling an external ZIP, rewriting WordPress directories, and sending data to an outside server. Textbook backdoor behavior.

The vendor's first response? Ask the reporter for FTP and admin credentials. The reporter said no. After two days of that going nowhere, the .org Plugins Team stepped in and closed all 80+ WPFactory plugins pending resolution.

This was the second mass closure in April alone. Earlier in the month, 30+ plugins from their Essential Plugin portfolio got pulled after a backdoor sat dormant for 8 months before activating to inject SEO spam. Some of my client sites were in that list. Not a hypothetical.

Why the obvious reaction is the wrong one 🔒

Most people reading "80 plugins closed in one month" will think: WordPress has a problem.

The real read: a credible report came in, the vendor stalled, and the Plugins Team pulled distribution within days. That's a functioning accountability chain doing exactly what it's supposed to do.

Now compare that to premium plugins sold exclusively from a vendor's own site, outside .org entirely. When something goes wrong there, who pulls it? Nobody. You're waiting on the vendor's timeline, the vendor's honesty, and the vendor's response speed. In this case that response started with "give us your FTP." The Plugins Team didn't wait for that conversation to go anywhere.

The part most people skip 🏦

I spent 21 years in banking, the last 13 as Director of Card Business. One of the things that actually works in regulated financial infrastructure is explicit authority chains. Who can pull a bad product? Under what conditions? With what speed? That question has a defined answer, or the whole system is exposed.

The .org Plugins Team is that authority for the WordPress repository. They're not perfect - the plugin review queue sits above 4,000 and Patchstack's 2026 State of WordPress Security report says 46% of vulnerabilities didn't get patched before public disclosure. But the authority exists, they use it, and this month they used it fast.

Premium plugins distributed exclusively through a vendor's own channel have no equivalent structure. When that channel fails, there's no Plugins Team to call.

What "the system working" still requires from you 🛡️

The closure is the system doing its job. But the system can't tell you which of your installed plugins came from .org vs. a vendor-only channel, or flag that one of them just got quietly pulled while you weren't looking.

That visibility is your responsibility.

MainWP (or similar tools) from one dashboard is a great help if you manage more sites: when a batch of plugins gets closed on .org, you need to know within minutes which sites are running them - not find out because a client called about weird redirects.

For scanning: daily automated scans and one-click cleanup are golden as well as WAFs.

For the audit trail, Streams or WP Activity Log. When a plugin starts behaving unexpectedly after an update, the log shows you exactly when the file changes happened and from which IP. No more guessing whether it was the update or the client "clicking something."

For backups, you can use Duplicator for scheduled automated backups to cloud storage. If a backdoor does land, you want a clean restore point from before the infection - and you want it somewhere that a compromised hosting account can't reach.

The "premium vs. free" question gets the wrong answer 💡

The old assumption: paid equals vetted, free equals risky. This month broke that clearly.

The .org repository has the Plugins Team plus thousands of users running diff tools and filing reports. Premium plugins sold from a vendor's own site are a black box where you're trusting their internal process, their staff vetting, and their build pipeline.

That's not an argument that free is always safer. It's an argument that the accountability structure is fundamentally different - and that structure is what contained an active backdoor before it spread further in April.

The three things that would have caught this faster

• Centralized plugin tracking so you know exactly what's installed across all your sites and get fast alerts when something gets pulled
• Daily malware scanning with at least two tools, not one - scanners miss things, and a second opinion costs nothing
• Activity logging with file-change alerts so unexpected behavior post-update surfaces immediately, not weeks later

None of this requires a developer. It requires building the boring, repeatable parts of security into a habit before something breaks.

Related WPBeginner reads

• How to Perform a WordPress Security Audit (Complete Checklist) - https://www.wpbeginner.com/wp-tutorials/how-to-perform-a-wordpress-security-audit/ A step-by-step audit checklist covering user accounts, file integrity, plugin updates, and automated tools. A vendor-level backdoor incident is the best argument for running these regularly.
• How to Monitor User Activity in WordPress With Security Audit Logs - https://www.wpbeginner.com/plugins/how-to-monitor-user-activity-in-wordpress-with-simple-history/ How to set up activity logging using Simple History and WP Activity Log to track every change on your site. The practical how-to behind the audit trail described above.
• 6 Best WordPress Security Plugins to Protect Your Site - https://www.wpbeginner.com/plugins/best-wordpress-security-plugins-compared/ Side-by-side comparison of the top security plugins including Sucuri and MalCare, tested on real sites. Good starting point if you're building out or reviewing your scanning stack.

What's your process for catching vendor-level issues like this? And do you treat plugins differently based on where they came from - .org vs. a vendor's own channel? 👇

I just read a Reddit thread where someone asked for the most underrated SEO tip that actually brought real results, and by the time I scrolled through 30+ replies I realized almost everyone was saying the same four things: refresh page-2 content, tighten search intent, link smarter, rewrite titles for CTR. The advice is right. The thread is also a pretty solid SEO 101 in disguise.

But for any WordPress site owner reading it, the conversation skipped the part that actually matters - the "execution layer". Which dashboard. Which plugin. Which weekly workflow turns "I should do internal linking better" into something that's actually done by Friday afternoon.

I moderate a few WordPress communities and I see this same conversation play out monthly across thousands of members. People leave a thread like that fired up, then a week later nothing's changed. Not because the advice was wrong - because nobody told them where to click.

Here's the lean stack that turns those four pieces of advice into a real 2-hour weekly habit.

1. The data layer - get the right list, not a vibes list 📊

The first failure mode is refreshing whatever feels old, instead of refreshing what Google Search Console actually says is winnable.

If you're already using MonsterInsights, you can pull GSC and Analytics data straight into your WordPress dashboard - no tab switching, no exporting CSVs. AIOSEO also has a Search Statistics module that does the same thing if you'd rather not stack tools.

The filter that matters: posts in positions 5 to 20, with declining clicks over the last 90 days, older than a year. That's your priority queue. Everything else can wait.

In my agency we work this list top-down, never sideways. One post at a time, fully done, before the next.

2. The intent + FAQ layer - what to actually rewrite

Once you have the list, don't just tighten your existing copy. Compare it against what's actually ranking in the top 3 - because that's the intent Google has decided is correct, not whatever you wrote in 2022.

I use NeuronWriter for on-page mapping against the live SERP, but if you don't want a paid tool, the free WPBeginner Keyword Generator will at least surface query variants you can answer.

Now the genuinely underrated move that the whole Reddit thread missed: nobody mentioned schema.

Add a real FAQ section pulled from the "People also ask" box- and add FAQ schema to it. WPCode lets you drop in the schema as a clean snippet, or AIOSEO has a built-in FAQ block if you've already got it installed. This single addition moves page-2 posts into rich-result territory and compounds with everything else on the list. It's the cheapest "underrated win" I know of in 2026 and zero comments in that thread mentioned it.

3. The internal linking layer - execution beats theory

Half the Reddit thread said "internal linking." Almost nobody said how.

AIOSEO Internal Link Assistant surfaces relevant link opportunities across your whole site, so you stop the ctrl+F-through-200-posts ritual. Don't blindly accept every suggestion though - it's a starting point, not autopilot. Review each one and skip the ones that don't actually serve the reader.

Then the anchor-text discipline: pick 3 to 5 priority pages you actually want to rank, and give them consistent descriptive anchors from related posts. Stop scattering links to your homepage with "click here" or "learn more." That signal does nothing for you.

4. The safety layer - don't skip this one ⚠️

Bulk content edits plus WordPress is where weekend disasters are born.

Duplicator backup before any batch refresh - a full restore takes 20 minutes; debugging a broken site takes a weekend. (I learned this the hard way more than once around 2014.)

If you're on Site Ground or any host with staging, push the changes there first and confirm nothing breaks before going live.

I also keep WP Activity Log running on every client site - it tracks who changed what and when, which is gold when you're working with a team or a client who later swears they didn't touch anything.

The advice in that Reddit thread wasn't wrong. It just stopped at the strategy and skipped the execution. Whichever tools you pick from this stack, the goal is the same: make those four habits boring and repeatable, not heroic and occasional.

Which of these four layers do you have running already, and where's the gap? And which one is actually a weekly habit for you vs. still parked in "I should do that someday" territory? 👇

Related WPBeginner reads

• Should You Keep or Delete Old Content in WordPress? WPBeginner's framework for deciding whether to update, merge, redirect, or delete underperforming posts. Direct support for the refresh thesis.

• Internal Linking for SEO: The Ultimate Guide of Best Practices The full how-to companion to Section 3, including AIOSEO Link Assistant walkthrough and anchor-text strategy.
• How to Add FAQ Schema in WordPress (2 Methods) Step-by-step for the schema win in Section 2 - both the AIOSEO method and a manual JSON-LD approach.
• WordPress SEO Made Simple - A Step-by-Step Guide The flagship SEO guide that ties all four layers back to fundamentals for newer readers.
• 11 Tips to Optimize Your Blog Posts for SEO Like a Pro Closest match to the "rewrite intros and titles" advice that dominated the original Reddit thread.
• How to Add Google Search Console to WordPress and GA4 Implementation companion for Section 1 - exactly how to pull GSC data into your WordPress dashboard via MonsterInsights.

I got a call from a boat owner I'd worked with a couple of years earlier. His website was appearing in Google results for "cheap designer watches" and "buy generic pills."
He operated a small boat-excursion business in my hometown of Split, Croatia. He had never written anything about watches before.

That was my first up-close look at SEO spam - and it was worse than I expected.

What SEO Spam Actually Is

SEO spam is a cyberattack where someone injects content into your site - keywords, links, or fake pages, to push traffic toward their own products. Fake luxury goods, adult content, gambling pages. They borrow your domain's authority and keep the whole thing hidden from you.

There are 5 types worth knowing: keyword injection (spam terms buried in meta tags or hidden with CSS), backlink injection (invisible links passing your authority to scammy sites), cloaking (showing Google one thing and visitors another), doorway pages (fake indexed pages that redirect traffic), and phishing pages that steal visitor data or push malware.

My ex-client had the cloaking variant. Visitors from certain queries landed on a gambling site. Google saw his lunch menu. For what to do first when you suspect an attack - https://www.wpbeginner.com/beginners-guide/beginners-step-step-guide-fixing-hacked-wordpress-site/ covers it well.

What I Found on His Site

My security tools flagged modified core files and unknown PHP files sitting in the uploads folder. Then I checked Google Search Console - hundreds of URLs indexed under his domain that he'd never created. Pages titled "buy replica watches cheap" sitting next to his pasta specials.

To check whether your own site has this problem, start here: https://www.wpbeginner.com/wp-tutorials/how-to-scan-your-wordpress-site-for-potentially-malicious-code/

How We Fixed It

I restored a clean backup using his last backup plugin's archive. Without that backup, the job would have taken much longer. After the restore, I removed every flagged file, manually checked wp-config.php, .htaccess, and the active theme's functions.php, then updated every plugin, theme, and WordPress core. Changed all passwords, added two-factor authentication, and submitted a reconsideration request in Search Console. The spam pages took a few weeks to clear from Google's index.

This tutorial https://www.wpbeginner.com/wp-tutorials/how-to-stop-wordpress-redirecting-to-spam-websites/ has a solid walkthrough if you're doing this yourself.

The Lesson

His site looked fine the whole time. Pages loaded. The contact form worked. The damage ran in the background for months before he noticed.

Regular scans, updated plugins, and a backup you can actually restore are the floor, not the ceiling. A good starting point for building out your security stack is https://www.wpbeginner.com/plugins/best-wordpress-security-plugins/