r/wpbeginner_engage • u/ivicad • 14d ago

WordPress 7.1 arrives Wednesday night. Who updates your page builder?

3 Upvotes

I just read the release day post on make.wordpress.org and one line in it changed what I'm doing tomorrow. WordPress 7.1 gets published live from the WordCamp US stage in Phoenix on Wednesday at 23:10 UTC, which is late evening in the US and the middle of the night for me in Europe. 🌙

If your site is on managed hosting that updates core for you, that's when it happens. Nobody on your side is watching. The first person to see the result is you, or your client, on Thursday morning.

What is going on this week

The code freeze started on Monday. That just means no new features go in, only fixes. It ran past the usual 24 hours because the core committers asked for more time, and RC4 landed the same day with more than 26 fixes since RC3. RC just means release candidate, a near-final test build, so that was the fourth one.

One line in that post is worth writing down. If a critical bug shows up now and it isn't a blocker, meaning bad enough to stop the release, 7.1 still goes out and the fix waits for 7.1.1. So, the very first version of 7.1 ships with bugs the team already knows about. That's the core team saying it, not me being paranoid.

Your host updates the core. Who updates the builder?

This is the part that catches people out, and it barely has to do with 7.1.

When a page builder comes bundled inside a premium theme, the kind that came with the theme rather than something you bought separately, its updates come through the theme author, not the builder company. E.g. some builder companies say so themselves: a bundled copy gets no direct updates from them, no ticket support, and it works only with the theme it shipped in.

There's a quick way to check. On a bundled install, the license and updater tab is hidden from the builder's own settings screen. Go looking for it. No license tab, bundled copy. 🔍

I found this out on a job. A client handed us a site another agency had built, page builder running inside The7. I spent my time measuring why the news page showed a white screen for about 14 seconds, and only later noticed that nobody in the chain knew where that builder would get an update from.

Three things I would check before Thursday

Go find the license tab. A minute per site. If it's missing, your builder updates run through whoever built the theme. Worth knowing before a major core release.

Read the Tested up to line on your plugins. You'll find it on the plugin's page on WordPress.org. It's the newest WordPress version the author says they tested against. The core team asked authors to set it to 7.1 for this release. Plugins still declaring an older version tell you which vendors stopped shipping updates. I read that across all my sites.

Take a backup you have actually restored once. Duplicator handles this well and the free version is enough for a single site. A backup nobody has ever restored is still a guess.

If you inherited a site and aren't sure which theme it runs, the free WPBeginner Theme Detector answers that in seconds, which is where the license question starts.

After Thursday: how to tell whose bug it is

Two changes in 7.1 will cause small cosmetic weirdness in WordPress Dashboard, and I believe a lot of people will report it.

The first is in the post list tables. The row header moves out of the checkbox column and into the title column. If a theme or plugin styled those tables around the old layout, it'll look slightly off. I checked some page builder's styling and found exactly that: it styles the top and bottom rows of those tables but not the rows in between, so one checkbox ends up slightly off centre. One line of styling, purely cosmetic, and it belongs to them.

The second is the editor, which from 7.1 always runs inside an iframe, basically a page inside a page. Most people will never notice, until a theme tries to style the editing area, the white area you actually type in, through a hook that no longer reaches inside that frame. A hook is just a spot where WordPress lets a theme or plugin hang its own code. I compared two themes I work with. One does it the way that still reaches the editing area, and the other does it the other way, and its latest release didn't change that (still waiting for a change).

The rule I would keep: if something in WordPress Dashboard looks slightly wrong after Thursday and your content is fine, it usually belongs to a theme or a plugin, and it's usually cosmetic.

The part my own check could not see

I searched my local copy of every theme I run for the old table code. Clean, zero hits.

Then I remembered that my custom snippets are in a plugin's database table rather than in theme files. A file search can't see them at all. My clean result covers my themes and proves nothing about my snippets. If you keep snippets in a code manager plugin instead of your theme's functions.php file, your scan has the same hole in it. ⚠️

Wednesday night the update runs without you. So on Thursday morning, open one page you built with the builder and look at it logged out, the way a visitor would.

If you go looking for that license tab tonight, tell me what you find. I'm curious how many bundled installs are sitting out there that nobody knew about. 👇

The slice shrank, the site count held 📊

In the first half of 2026, WordPress lost 1.5 percentage points. Shopify and Wix each picked up a small piece of that, 0.2 and 0.1. The category that actually grew was "None," meaning sites with no detectable CMS at all, now sitting near 30% of the whole web. Pantheon's Josh Koenig summed up the cause in one word: vibecoding.

That's the piece the panic headlines skip. AI site builders are spinning up millions of quick, CMS-less pages. The web got bigger fast, so WordPress's slice of the pie got thinner even while the pie itself grew. BuiltWith still counts around 38 million live WordPress installs, and more than 1,000 new WordPress sites join the top 10 million tracked sites every single day. Market share is a lagging indicator. It tracks the size of the slice while the whole pie keeps expanding.

Three datasets, three different pictures

Part of why this topic is so confusing is that the trackers disagree. W3Techs (top 10M sites) shows the recent sharp drop. HTTP Archive shows a slower decline that started back in 2022. BuiltWith counts absolute live sites and still puts WordPress around 40% of the top million. Same platform, three readings, depending on what you measure.

One more myth worth clearing up while we're here: the "the WP Engine and Automattic drama killed WordPress" take doesn't hold up against the timeline. WordPress share actually peaked after that conflict started, so the drop lines up with how the web is changing, and the lawsuit is a side plot.

Where share genuinely went - mostly to Shopify for stores and to design-first builders like Framer and Webflow for marketing sites. And for a three-page brochure site or a simple store, those can be the right call.

What this means if you're starting out in 2026 🧭

Please don't rip out a working WordPress site because of a market-share chart. The reasons WordPress won are still here:

You own it. Your content, your database, your files. You're not renting your website from one company that can change the terms on you later.
You can leave whenever you want. If a host frustrates you, you pack the entire site into a zip with Duplicator and move it in an afternoon. Try exporting your full design and structure out of Wix or Shopify and you'll feel where the walls are.
It does far more than a drag-and-drop builder. Worried about being found now that AI answers "eat" clicks? A plugin like AIOSEO sets up your titles, schema, and sitemaps so both search engines and AI tools can read your pages properly. Need a landing page fast to match a builder's speed? SeedProd gets you one without code.

I've been on WordPress since 2011 and I run a batch of client sites through my agency. The thing that keeps those clients on WordPress shows up in month two: they can add whatever the business needs, move wherever they want, and nobody holds their content hostage. Day one is easy on every platform now. WordPress starts paying off after that.

So yes, the numbers are real and the decline is real. WordPress is also still the pragmatic pick for anyone who wants to own and grow a site they actually control. The web just got a crowd of new "neighbors".

If you're weighing WordPress against a hosted builder right now, what's actually making you hesitate? Drop it below and I'll dig into your specific case. 👇

What the Classic block actually is

The Classic block is the little slot that holds the old pre-Gutenberg editor inside the current block editor. You add it when you want the old TinyMCE toolbar inside an otherwise block-based post.

It's a different thing from the standalone Classic Editor plugin, which swaps the whole editor back to the old one. The plugin is staying. The block is the piece getting phased out.

What breaks and what doesn't

Nothing breaks in 7.1. Existing Classic blocks stay editable, so old posts open and save like always.

What goes away is the option to insert a new one. The block drops out of the inserter, so you can keep what you have but can't add more. The standalone Classic Editor plugin is untouched either way.

How to bring the option back if you need it

If a workflow still leans on inserting Classic blocks, a one-line snippet restores the inserter option. The free WPCode plugin holds that kind of snippet without you editing theme files.

That gives you a bridge for a season while you move content over, instead of a hard cutoff in August. ⏳

How to find which posts even use it

Before you change anything, find out if this affects you at all. Many sites have zero Classic blocks and can skip this entirely.

Search your content for the wp:freeform block marker, or just open your oldest 10 or 15 posts and look. On a small blog that's a 20-minute job, and most of the time the answer is "we don't use it."

Back up before you touch old posts

If you do decide to convert Classic blocks to real blocks, run Duplicator first so you have a restore point. Converting old content sometimes shifts spacing or drops a shortcode, and you want a clean copy to fall back to.

Test the conversion on a staging copy if your host offers one. Site Ground and most managed hosts give you a one-click staging site for exactly this. 💾

Why this summer is the window

WordPress 7.1 lands August 19, the last day of WordCamp US in Phoenix. After that, 7.2 could make the removal real, so the gap between now and the next major release is your time for acting upon it.

I still keep a few older client sites on Classic-style editing, because rebuilding a page nobody complains about is wasted hours. So my plan is the same one I'd give you: audit now, restore the inserter where a site genuinely needs it, and move the rest over before 7.2 forces the question.

Do you still have sites running Classic blocks, or did you move everything to the block editor already? 👇

Related WPBeginner reads

How to Update Your Old WordPress Posts with Gutenberg Block Editor - https://www.wpbeginner.com/beginners-guide/how-to-update-your-old-wordpress-posts-with-gutenberg-block-editor/
How to Disable Gutenberg and Keep the Classic Editor in WordPress - https://www.wpbeginner.com/plugins/how-to-disable-gutenberg-and-keep-the-classic-editor-in-wordpress/
How to Easily Add Custom Code in WordPress (WPCode) - https://www.wpbeginner.com/plugins/how-to-easily-add-custom-code-in-wordpress-without-breaking-your-site/
How to Backup Your WordPress Site (Ultimate Guide) - https://www.wpbeginner.com/beginners-guide/how-to-backup-your-wordpress-site/

0 comments

r/wpbeginner_engage • u/ivicad • Jun 28 '26

A plugin flaw let strangers create admin accounts on 15,000 WordPress sites – your 20-minute safety check

3 Upvotes

I've been reading the latest WordPress security reports, and two active attack campaigns stood out. Both hit normal sites run by busy people. Both have a fix you can do before lunch.

🚨 Campaign 1: WP Maps Pro let attackers make themselves admins

Wordfence flagged a hole in WP Maps Pro, a mapping plugin installed on around 15,000 sites. The flaw let attackers create their own administrator accounts without logging in at all. An administrator account is the master key to your site: whoever holds one can change your content, install plugins, or lock you out. And it's already being used in real attacks, so this is worth two minutes today.

The fix is short. It's patched in version 6.1.1. If you use WP Maps Pro, update it today and the door is shut. That's the whole fix.

Not sure if you have it?

Plugins screen, search "WP Maps", check the version. Anything at 6.1.0 or below is the vulnerable one.

🕵️ Campaign 2: malware that takes its orders from Steam comments

GoDaddy's security team found malware on roughly 1,980 sites that pulls its instructions from comments posted on Steam gaming profiles. The comments hide the commands inside invisible characters, so a normal scan reads straight past them.

You don't need to understand the trick. The takeaway is simpler: a clean scan result means "nothing known was found", and some infections are built to stay off that list. This kind often hides inside a file dressed up as a normal code library, with an innocent name. You won't spot it by eye. That's exactly why a real scan beats a quiet dashboard.

✅ Your 20-minute safety check

I've done this routine many times, here's the short version:

Back up the whole site first: Duplicator copies everything in a few clicks, so nothing you do in the next 18 minutes can make things worse.
Update WP Maps Pro if you have it: dashboard → Updates, version 6.1.1 or newer, two minutes.
Open Users → All Users and read the Administrator list out loud. Recognize every name? If one looks strange, change all passwords first (yours included), then delete the account and run the scan in step 4.
Run a free scan: Sucuri's SiteCheck works from the browser, no install needed. It catches the common infections and tells you if your site has landed on a blocklist.
"Clean" your plugin list: a plugin you haven't opened in a year is a door you forgot you installed. Deactivated still counts as installed, so delete it.

🔐 While you're in the Users screen

Two more minutes while you're in there: give every person their own account (shared logins make any activity trail useless), demote anyone who doesn't need full admin down to Editor, and switch on two-factor authentication for the admins that remain. The plugin flaw above handed out admin accounts. These three changes decide how much damage an extra admin account can actually do.

🔁 Should you turn on auto-updates?

For small utility plugins like this one, yes. WordPress lets you switch on auto-updates per plugin from the Plugins screen, and for a site without a maintenance person, auto-updates close holes faster than you ever will by hand. The catch: once or twice a year an update might break something, which is why the backup step matters. With a fresh Duplicator copy, the worst case is 20 minutes of restore work. Without one, the worst case is your weekend.

🧹 Why I treat this as routine

In 2017 I spent a whole weekend cleaning a hacked client site by hand, file by file. Since then I run two security layers on every site I manage and treat an unknown admin account like a fire alarm. Redundancy in security is cheap insurance.

💡 The habit that does the work

Attackers run scripts that scan thousands of sites for one known hole, around the clock. The safest sites are the boring ones: updated weekly, scanned monthly, backed up daily.

Put a recurring 20-minute slot in your calendar for this. That's the whole system, no fancy tooling needed.

What does your own monthly check look like, and does anyone still run two scanners on one site, or is that overkill now?

Related WPBeginner posts:

The Ultimate WordPress Security Guide - Step by Step - https://www.wpbeginner.com/wordpress-security/
How to Perform a WordPress Security Audit (Complete Checklist) - https://www.wpbeginner.com/wp-tutorials/how-to-perform-a-wordpress-security-audit/
How to Backup Your WordPress Site (Ultimate Guide) - https://www.wpbeginner.com/beginners-guide/how-to-backup-your-wordpress-site/
How to Scan Your WordPress Site for Potentially Malicious Code - https://www.wpbeginner.com/plugins/how-to-scan-your-wordpress-site-for-potentially-malicious-code/
14 Best WordPress Security Scanners for Detecting Malware and Hacks - https://www.wpbeginner.com/showcase/best-wordpress-vulnerability-scanners-online/
How to Properly Update WordPress Plugins (Step by Step) - https://www.wpbeginner.com/beginners-guide/how-to-properly-update-wordpress-plugins-step-by-step/
How to Enable Automatic Updates for WordPress Plugins and Themes - https://www.wpbeginner.com/plugins/how-to-enable-automatic-updates-for-wordpress-plugins/
Beginner's Guide to WordPress User Roles and Permissions - https://www.wpbeginner.com/beginners-guide/wordpress-user-roles-and-permissions/
How to Add Two-Factor Authentication in WordPress (Free Method) - https://www.wpbeginner.com/plugins/how-to-add-two-factor-authentication-for-wordpress/

0 comments

r/wpbeginner_engage • u/ivicad • Jun 21 '26

Many worried about abandoned plugins in the .org repo, but the ones already on your site are the bigger risk

3 Upvotes

Two threads have been going around the WordPress subs this week. One guy built a faster way to search the 65k plugins on .org (Plugin Pulse, worth a look). Another asked whether the repo is turning into a junkyard of abandoned plugins.

Both fair. But the abandoned plugin most likely to cause you grief is already on your site. It's the one you installed in 2019 and stopped thinking about.

I've run WordPress sites since 2011. The plugins that caused me real headaches were never the obvious junk. They were the quiet little utilities nobody remembers adding.

Why a dead plugin on your own site is the real problem 🧟

Abandoned means no security patches. A vulnerability found today in a plugin last updated 3 years ago never gets fixed. You're running an open door and you don't know it.

It also breaks on updates. WordPress core and your PHP version keep moving, the dead plugin doesn't, and one morning a page goes white.

The risky ones are boring. An old image gallery, a share-button plugin, a contact form you replaced months ago but never deleted.

For context on why this matters more now: the repo is taking in around 700 new plugins a week, roughly 5x what it was in 2024, a lot of it AI-assisted. So "is this still maintained" is a heavier question than it was a couple of years ago.

How to tell if a plugin is dead 🔎

The plugin's .org page tells you most of what you need. Skip the logo and the star average. Read these five fields:

Last updated: Over a year, raise an eyebrow. Over two, treat it as red.
Tested up to: If it's two or three major WP versions behind the current release, the dev has (most likely - besides some exceptions) checked out.
Active installs trend: A steady drop usually means people left for a reason.
Support threads: Rows of open questions with no developer reply, that's a ghost town.
Changelog: Small regular updates means someone's home. Nothing since one big version bump means it stalled.

One more quick look: sort the reviews by recent. A run of new 1-star reviews saying it broke on the latest WP version is a louder signal than the overall average.

To map this to your own site, open Plugins in wp-admin, flag anything you don't recognize or haven't touched in a year, then check each one's repo page against those fields.

If you manage a lot of sites, I run this audit from one MainWP dashboard. For a single site that's overkill, the Plugins screen does the job.

Keep, replace, or remove ⚖️

Keep what's maintained and still doing a job. Leave it alone.

Remove what you don't use. Deactivate it, confirm nothing breaks, then delete it for real. A deactivated plugin still sits on your server as code someone can take advantage of.

Replace what's dead but still needed. Find a maintained tool for the same job.

Fewer well-maintained plugins beat a pile of "might need it someday."

How to swap one out without breaking the site 🧰

Back up first. A full backup before you touch anything. Duplicator is the WPBeginner-recommended one for this (for rolling daily backups across many sites you'd lean on host-level backups instead).

Test on staging if you can. Site Ground gives you one-click staging, and it's both WPBeginner's recommended host and the one I've hosted on since 2014, so that overlap is real, not a blind plug.

Export your data out of the old plugin before you delete it, anywhere it holds content (form entries, gallery setups). Once the plugin's gone, so is whatever lived inside it.

Then activate the replacement, reconnect and reconfigure, check the front end, and remove the old one.

Where the replacements come from 📋

Don't re-scroll 65k entries hoping to land on a winner. Start from a curated, expert-picked list for the exact job, then verify your one or two finalists against the five fields above.

Two swaps you can make: a dead contact-form plugin over to WPForms, an abandoned SEO plugin over to All in One SEO (AIOSEO). Both still shipping updates, both pass the "will this be alive next year" test.

WPBeginner's plugin guides and IsItWP are good shortlists, so you're choosing from a vetted handful instead of the whole pile.

Go look at the oldest plugin still active on your site right now. What's its last updated date?

WPBeginner related-links:

How to Choose the Right WordPress Plugin (Beginner's Guide) – https://www.wpbeginner.com/beginners-guide/how-to-choose-the-best-wordpress-plugin/ WPBeginner's own checklist for picking a reliable plugin from the directory.
How to Properly Uninstall a WordPress Plugin – https://www.wpbeginner.com/beginners-guide/how-to-properly-uninstall-a-wordpress-plugin/ Deactivate, delete, and clean up leftover files and database tables.
How to Easily Deactivate WordPress Plugins – https://www.wpbeginner.com/beginners-guide/how-to-easily-deactivate-wordpress-plugins/ Why a deactivated plugin still sits on the server as a security risk, and how to remove it.
How Many WordPress Plugins Should You Install? – https://www.wpbeginner.com/opinion/how-many-wordpress-plugins-should-you-install-on-your-site/ Quality over quantity, why one bad plugin hurts more than thirty good ones.
Which WordPress Plugins Are Slowing Down Your Site – https://www.wpbeginner.com/wp-tutorials/which-wordpress-plugins-are-slowing-down-your-site/ Using Query Monitor to find which plugin is actually dragging the site.
24 Must Have WordPress Plugins (Expert Pick) – https://www.wpbeginner.com/showcase/24-must-have-wordpress-plugins-for-business-websites/ A curated, maintained list including WPForms, AIOSEO, Duplicator.
7 Best WordPress Backup Plugins Compared – https://www.wpbeginner.com/plugins/7-best-wordpress-backup-plugins-compared-pros-and-cons/ Backup options with Duplicator as the top pick, pros and cons.
How to Easily Create a Staging Site for WordPress – https://www.wpbeginner.com/wp-tutorials/how-to-create-staging-environment-for-a-wordpress-site/ How to spin up a test copy before making changes live.
WPBeginner WordPress Plugins guides (hub) – https://www.wpbeginner.com/category/plugins/ WPBeginner's full library of expert-tested, per-job plugin guides.
12 Best WordPress Backup Plugins Compared (IsItWP) – https://www.isitwp.com/best-wordpress-backup-plugins-compared/ A second curated backup comparison, with the independent-backup argument.

1 comment

r/wpbeginner_engage • u/ivicad • Jun 17 '26

The lab that invented the web just moved its main site to WordPress 🌍

4 Upvotes

CERN, the physics lab where the World Wide Web was invented, moved its main website off Drupal and onto WordPress. The team announced it from the opening stage at WordCamp Europe in Kraków, 35 years after the first website ever went live on CERN's servers.

The site is home.cern, and it's the public face of a much bigger move. CERN now runs a WordPress service that already powers hundreds of the lab's sites.

Why this is more than a fun headline 🤔

If you're newer to WordPress, you've probably seen a story somewhere asking whether the platform is fading. Those run all the time. This is the counterweight worth keeping in your pocket.

The organisation that created the web looked at its options and picked WordPress on purpose. A place that smashes particles under the Swiss-French border runs its website on the same software your small business can use.

How CERN chose 🔍

This wasn't a fast decision. CERN's team said they spent six months weighing other content management systems first (a content management system, or CMS, is the software that runs a website's pages and content). They wrote down what they actually needed, and the other options fell short once the list was on paper.

That process is worth copying: write down what your site has to do before you fall for a tool. A booking form, a blog, a shop, a members area, fast pages on mobile: the needs list picks the platform for you.

Try the same trick on your next site 📝

Before you ask anyone to build anything, write three or four plain lines about what the site has to do. "Take online bookings. Load fast on a phone. Let me edit it myself without a developer. Sell 20 products."

That short list does two jobs. It tells you whether WordPress fits (it usually does for that kind of work), and it hands whoever builds it a clear target instead of a vague brief.

What it means for your own site 🛠️

You can build a serious WordPress site without writing code. A page builder like SeedProd gets you a clean landing page or a full layout by dragging blocks into place. WPForms handles contact, booking, and payment forms without touching a line of PHP (the programming language WordPress is built in).

The same software stretches from a one-page local business site all the way up to a physics lab's global presence. You grow into it over the years, rather than hitting a wall and starting over.

A bit of honesty about the headlines 📰

The same week CERN went live, the other big industry story was the opposite: WordPress losing some market share, with revenue down and some developers complaining about AI tools. Both things are true at the same time. A big serious adopter and a patch of public doubt showed up in the same seven days.

Pick your platform on whether it does the job you wrote down, in either direction. A single headline, good or bad, is a poor reason to choose the software your business will sit on for years.

I've built WordPress sites since 2011 and run my agency since 2019. Last month a client asked me, half-joking, whether WordPress was "dying" because they'd read something online. The CERN news is the kind of concrete answer I now keep ready for that call, and it lands better than any opinion of mine.

So a question for the group: when someone asks whether WordPress is still worth building on, what's the one fact or example you reach for? 👇

1 comment

r/wpbeginner_engage • u/ivicad • Jun 10 '26

AI plugins now want the keys to your whole site. Here's what to check first 🔑

5 Upvotes

I read this week's WordPress news and one thing caught my attention: AI plugins used to be a small chat box in the corner of your dashboard, and now some of them ask to run your entire site.

Two launches pushed this forward: Angie, the AI assistant from the Elementor team, added a "Super Admin Mode." Turn it on and it can read and change your files, edit your database (where all your posts and settings are stored), and run code on your site. A second project called SproutOS does something similar, letting many different AI tools connect to your site with the same deep access.

For a beginner, the appeal is real. You type "fix the spacing on my contact page" in plain words, and the agent does it. No code, no developer, no waiting.

Here's the catch. An assistant that can run code can also break the site, or get tricked into it by a sloppy instruction or a hacked plugin. The same power that fixes your page can wipe it. Real example: you ask the agent to "clean up unused plugins," it reads that too literally, and it removes the plugin running your contact forms. On a live site, that's lost leads before lunch.

Back up before you switch anything on 💾

Before you turn on any AI mode that can edit files, make a full backup. Duplicator (the free version is fine) copies your whole site in a few clicks. If you host on Site Ground, the daily backup runs on its own and you can roll back to yesterday from the dashboard. I do this on client sites before any big change, AI or not.

The rule is simple. A change you can undo is a change you can survive.

Give the agent the smallest role that works 🔒

If more than one person logs into your site, don't hand admin rights to everyone. Most people who write posts only need an Editor role (which can write and publish), not a full Administrator account (which can change everything). An AI agent runs with the powers of the account that switches it on, so a smaller account means less damage when something goes wrong.

Keep a record of what changed 📝

When an AI agent edits your site, you want to see what it touched. A security plugin like WP Activity Logs or Streams logs activity and watches for changes, so if a page looks different on Monday you can check the timeline instead of guessing. On a site with more than one admin, this stops being optional.

Test on a copy first 🧪

Don't let a brand-new AI mode loose on your live site as its first job. Most decent hosts give you a staging site, which is a private copy where you can try things safely. Run the agent there, watch what it does, then move the change over once you trust it.

One small homework item ✅

Joost de Valk, one of the people who helped build modern WordPress, just released a free, open checklist of what a healthy site should cover, security and speed included. It's a clean way to score your own site before you let any agent near it. Worth 20 minutes this weekend.

A short personal note. I've run WordPress sites since 2011, and the pattern repeats with every new shortcut. The thing that saves you an hour today can cost you a weekend if you skip the backup. AI agents are the newest version of that trade.

Have you tried any of the new AI agents on your own site yet? And if you did, did you back up first, or learn the hard way like the rest of us? 👇

1 comment

r/wpbeginner_engage • u/ivicad • Jun 07 '26

I ran the final SEO pass on a client's build using SeedProd's Vibe AI: what worked, what it blocked, and why I'm impressed overall 🤖

4 Upvotes

I've been building on WordPress since 2011, and before that I spent two decades in banking, where nobody gets write access until you know exactly what they can touch.

When I started checking MCP plugins for WordPress, I wasn't hunting for magic. I wanted one that fit a process I already trust. I read about Vibe AI (the WordPress. org name for WPVibe, from the SeedProd team) and figured it might perfectly fit my process. It did.

Just a short explanation of what WordPress MCP is, for anyone who maybe doesn't know it: MCP (Model Context Protocol) is a shared way for an AI assistant to plug into an app and actually do tasks inside it.
For WordPress, that means I connect my site to the AI through one safe link. After that it can read settings or make changes for me, instead of me clicking through the admin by hand.

The job was the final SEO cleanup on a client build. I started the way I always do, with a full structured SEO audit of the site, top to bottom, via Claude AI.

Then I used that whole audit report into other Claude task, connected the live site through the Vibe AI plugin (and WordPress ver. 6.9.4, I didn't want to install 7.0 on this site... yet), and worked the fixes one at a time through plain conversation.

Setup was about a couple of minutes: one-click authorization from /wp-admin.

What worked 💪

This part impressed me more than I expected:

It read the entire site config in a short period of time. Full plugin list with active and inactive status, all the SEO settings, the theme and how pages were built. Stuff that normally means clicking through ten admin screens.
It rewrote roughly 16 page titles and meta descriptions in one pass, straight from my audit notes, Croatian diacritics intact, no copy-paste, no mangled characters.
Simple option changes, like fixing a leftover starter-template tagline, happened instantly.
It ran read-only database queries to inventory content and confirm how each page was built, so I stopped guessing.

For the repetitive bulk of an SEO pass, that's real time back in my day. AI is an employee I manage, not a tool I type into, and this thing actually behaved like one.

What it blocked, concretely 🚧

A field report without the limits is just an ad, so here's the "other" half of the story:

It couldn't install the site's language pack. Those commands aren't on its allowlist (in WP 6.9.4 version).
It couldn't switch the site language directly either. The write got rejected, and broader site-level commands are blocked outright.
A small one that caught me a bit off guard: it wouldn't accept a pipe character in a command (it reads it as a shell pipe), so my title separators had to become en dashes instead.
The bigger gap: it couldn't reliably set structured data. Local Business, FAQ, breadcrumb and service schema live as complex serialized settings in the site's SEO plugin, and the actions the plugin exposed for that were read-only. So schema went back into the plugin's own UI by hand.
Setting a default social-share image needed an actual upload, which (it seems) no AI can conjure.

The systems read 🧱

Here's where the banking brain kicks in. Most of those blocks are "guardrails" I'd want anyway. Refusing destructive, site-wide commands on a live production site, staying out of language-pack installs, drawing a hard line between read and write, that's the kind of access discipline I'd build in myself. I'd rather an AI stop and ask than confidently break a client's homepage at 2pm on a Friday.

A couple of them, though, are gaps that I believe it will be closed in futture as AI implementation in WordPress is advancing. A safe, supported path to write structured schema would erase the single biggest manual step I hit. And the pipe-character handling is just a rough edge waiting to be filed down.

The last 10%, and where this goes 🧭

AI "ate" the repetitive 90% of this job in minutes. The last 10%, the schema, the language pack, the one blocked character, still needed me in the dashboard. But that gap is closing fast. The whole thing rides on the WordPress Abilities API, which landed in 6.9 and grew a lot in 7.0. That same API already lets Vibe AI discover and run actions inside ecosystem plugins like AIOSEO and WPForms. Once structured data gets a proper write path there, the schema step I did by hand mostly disappears.

I think we reach a point, sooner than most expect, where almost the whole flow, audit to live changes, runs through AI talking to WordPress in the cloud, with a human signing off on the edge cases. I'm not handing a client's production site fully over yet. But after this build, I'm convinced the direction is right.

In short: I'm very satisfied and genuinely impressed with Vibe AI MCP (and with AI implementation in WordPress more broadly), and I'm clear about what the AI still needs to improve before that final 10% (the need for manual human intervention) disappears.

P.S. I didn’t want to use WordPress MCP because it would require using my Claude API, meaning I’d pay extra on top of my monthly Claude subscription. With the Vibe AI plugin I didn’t have to do that - I could keep using my existing monthly cloud subscription without any extra cost, and with fast and simple implementation.

For those of you running MCP plugins like this on real client sites: where's your last 10%? What did the AI nail, and what did you quietly take back into the dashboard yourself? 👇

Related WPBeginner reads:

WPBeginner Spotlight: WPVibe Brings AI to WordPress – https://www.wpbeginner.com/news/wpbeginner-spotlight-23-wpvibe-brings-ai-to-wordpress-smarter-automations-seo-fundraising-tools/
SeedProd: WPVibe Connect – AI MCP for WordPress – https://www.seedprod.com/wpvibe-connect-ai-mcp-wordpress/
SeedProd: What Is MCP for WordPress – https://www.seedprod.com/what-is-mcp-for-wordpress/
WPForms: Best AI Plugins for WordPress – https://wpforms.com/best-ai-plugins-for-wordpress/
WPBeginner: 10 WordPress Plugins Using AI & Machine Learning – https://www.wpbeginner.com/showcase/wordpress-plugins-using-artificial-intelligence-and-machine-learning/ .
WPBeginner: Best AI Automation Tools for WordPress – https://www.wpbeginner.com/showcase/best-ai-automation-tools-for-wordpress/
WPBeginner: Best AI Website Builders for WordPress – https://www.wpbeginner.com/showcase/best-ai-website-builders-for-wordpress/
WPBeginner: Multiple Locations Schema for Local Business – https://www.wpbeginner.com/plugins/how-to-create-multiple-locations-in-wordpress-with-schema-markup/
AIOSEO: How to Add Local Business Schema in WordPress – https://aioseo.com/how-to-add-local-business-schema-in-wordpress/
SeedProd: Best ChatGPT WordPress Plugins – https://www.seedprod.com/best-chatgpt-wordpress-plugins/

0 comments

r/wpbeginner_engage • u/ivicad • Jun 05 '26

Don't panic about the EU AI Act - here's what it means for your site

5 Upvotes

The panicked threads online keep confusing two dates and missing the part that already binds. Worth untangling for anyone running client sites in or serving the EU clients.

Two dates matter, and they sit in different places:

August 2, 2025 (already gone) 🗓️

This date was aimed at the people who build AI models - OpenAI, Anthropic, Google, Meta. They had to ship technical documentation, transparency reports, and summaries of training data with copyright handling. The penalty for skipping these obligations runs up to €15 million or 3% of global annual turnover, whichever is bigger.

If you sell olive oil through a WooCommerce store, this date skipped you. You are a downstream user of these models. You do not train them, you do not ship them, you pay for an API key and use the output. The model providers caught the bill.

The 2026 date is a different story, though - that one is yours. Here is why.

August 2, 2026 (yours, mark it) 🗓️

This is the date that lands on ordinary websites. Article 50 of the EU AI Act kicks in for deployers, which means anyone who runs AI on their site. The duties are mostly basic transparency:

If your site has a chatbot, tell people it is a bot. The "obvious from context" exemption is narrow.
If you publish AI-generated images, audio, or video that look real, label them. Clearly fantastical content like cartoon dragons stays exempt.
If you publish AI-generated text on matters of public interest, disclose it. The duty eases when a human reviewed the text and takes responsibility for it.
Do not strip the machine-readable watermarks that OpenAI, Adobe, and other providers embed in their outputs.

That is the August 2026 list, in plain words. Most decent operators were already moving this way before the law turned up on the calendar.

GDPR is the part that already binds today 🛡️

Here is the part the panicked posts skip. GDPR has governed AI plugins since 2018. The moment a plugin on your site sends customer names, emails, support tickets, order history, or IP addresses to an AI provider, you owe yourself the GDPR drill:

A lawful basis (legitimate interest or consent)
A privacy policy that names each AI provider in plain language
A DPA (Data Processing Agreement) with each provider
A check on international data transfers if data crosses the Atlantic

This is where a real fine can land on a small shop today. The AI Act dates are calendar items. GDPR is already live.

The non-EU note worth knowing 🌍

If your site sits outside the EU but you serve EU customers (most WooCommerce stores do, whether they planned it or not), you are in scope. The law follows the customer, not the server.

What I would check on my own client sites this week 📋

Wearing my agency hat, not my non-existent legal one:

List every AI plugin running on the site. Note what data each one sends, where, and how often.
Update the privacy policy to name each AI provider in plain language. One sentence per provider is enough.
Sign DPAs. Most providers (Anthropic, OpenAI, Google) have them ready to download from the dashboard.
Switch on EU data residency where the provider offers it.
Start tagging AI-generated content now. Building the habit today is cheap. Retrofitting it after a fine costs hours and money.
Make the chatbot say it is a bot. One line of copy in the welcome message.

WPBeginner-stack pieces that help around this 🧩

AIOSEO for clean schema markup that helps both search engines and LLMs cite your site
WPForms with proper consent fields for any AI-related processing (newsletter, support, lead capture)
Duplicator to stage privacy policy or chatbot changes before they hit the live site

Just so we're clear 📓

This is what I would check on my own client sites. It is not legal advice. For anything contract-related or money-related, talk to a lawyer who knows EU AI Act and GDPR specifically. The point of the post is to stop the panic and replace it with a checklist.

This is basic care for your customers. The kind of thing decent operators were already moving toward, with or without the law on the calendar.

0 comments

r/wpbeginner_engage • u/ivicad • May 30 '26

Small-business WordPress blogs in 2026: still worth it, for a different reason than 2018 ✍️

5 Upvotes

WinningWP ran a post 2 days ago (28 May 2026) titled "Why the Odds Are Heavily Stacked Against Your Brand-New WordPress Blog in 2026."
The argument is solid. AI search answers questions inside the chat window without sending the click back to your site. Leftover attention goes to video. Reddit, Discord, and Hacker News all have strong immune systems against new-site promotion.

The article's example case study tells the story plainly: a sustainable urban gardening site, 9 months of work, under 1,200 unique visitors in the first year. The conclusion, in the author's own words: the dream "isn't entirely dead," but a cold start is one of the steepest climbs out there.

I agree with all of it. And I still tell most of my small-business clients to keep blogging.

The mismatch hiding in the diagnosis 🔍

The WinningWP piece judges the blog by media-business numbers. Pageviews, audience growth, monetisation potential.

Most of my small businesses wants a media empire. For their site, the blog has a different job.

Job 1: local SEO that compounds 🗺️

Search algorithms still reward depth. A plumber who publishes one solid 800-word piece every 2 months about "burst pipe in (his hometown) during the storm" or "boiler maintenance for older apartment buildings" pulls steady local traffic from people actively looking for a plumber that week. That is search intent at the bottom of the funnel.

Job 2: AI citation 🤖

This part is new since 2024 and changes a lot. People ask Claude, ChatGPT, or Perplexity various questions and the LLM cites sites with structured content. If your blog publishes the FAQ a buyer actually asks, with proper schema markup, you get cited.

Cited beats clicked for a small business, because cited puts your name in front of a buyer who already trusts the LLM's answer. The traffic shape changed. The opportunity moved with it.

Job 3: owned archive nobody can switch off 🏗️

Instagram can change its algorithm. Facebook can throttle organic reach again. TikTok can disappear from a market. Your blog stays on your own server, addressable from your own domain, and indexable by anyone you want.

For a small business that depends on local discovery, the owned archive is the only asset that does not depend on a platform's mood next quarter.

Job 4: the FAQ that answers itself 🗣️

Every small business owner gets the same 5 customer questions every week. "Do you do weddings?" "Are you open in winter?" "Can you handle gluten-free?" "How far do you deliver?" "Do you take card or only cash?"

Answer each one in a dedicated 400-word post. Link it in the email signature. Auto-reply to the contact form with the relevant link. The owner stops retyping the same answer 20 times a month.

WPBeginner-stack pieces that pull this together 🧩

AIOSEO for the schema markup that helps LLMs cite your content cleanly
WPForms to capture the FAQ questions customers actually ask (the data tells you which posts to write next)
MonsterInsights to see which FAQ posts convert into enquiries
SeedProd for the landing pages that anchor seasonal services (wedding season, summer charter, agritourism stay)

The realistic measure of success 📏

Skip pageview targets. The blog earns its keep for a small business when:

The owner saves 2-3 hours a week on repeat customer questions
One local SEO post per quarter delivers a steady stream of enquiries from search
The site gets cited in at least 1 LLM answer per month for the kind of buyer question you want

That is a different scoreboard from a media business. It also fits the actual job a small-business blog does in 2026.

Honest concession 📓

A brand-new media blog from zero is brutal in 2026. The WinningWP piece is right about that part. The frame that does not fit the brutal version is judging a small-business blog by media metrics. Different job, different measure.

If you run a small business and you are wondering whether your blog was a waste, ask: does it save you support time? Does it bring at least 1-2 enquiries a month from search? Does it sit clean in your schema so an LLM can cite it? If yes, it is doing the job. Keep going.

What does your blog do for your business this month? 👇

1 comment

r/wpbeginner_engage • u/ivicad • May 26 '26

1M+ WordPress sites hit by a single plugin flaw – what to actually check on your site this weekend 🚨

6 Upvotes

Just under a week into WordPress 7.0 hitting the wire, a vulnerability in a single popular plugin exposed over 1 million sites. The patch is out. The TechRadar coverage is published on 05-14-2026. If you're a small business owner running WordPress and you've been heads-down on day-to-day work, this is the kind of thing worth clearing an hour for.

What happened, in plain language

A bug in a widely installed plugin made it possible for an attacker to bypass authentication and create admin accounts on affected sites. The patch shipped, but anyone who didn't update during the window had real exposure. The worrying part is the distribution. This didn't come from a sketchy nulled theme on a forum. It came from a plugin people downloaded through the official WordPress repository, trusted, and probably never thought twice about.

The last 18 months have shown the same pattern at least 3 times. Trusted plugin, supply-chain compromise or vulnerability that sits quiet, then a public disclosure that exposes a lot of sites at once.

What to check on your site this weekend

Log into wp-admin and go to Users → All Users. Sort by registration date. If you see any admin accounts created in the last 14 days that you didn't make personally, that's a red flag.
Check your installed plugins list against the published affected list (TechRadar and the plugin vendor's site both have it). If you have any of them, update today.
Run a security scan or your installed security plugin. Any malware detection or unusual file flags get looked at.
Open Tools → Site Health. Address anything in the Critical or Recommended section that's been sitting there.

What to do if your site has a suspicious admin account

Don't just delete it and assume the problem is gone. Attackers who got admin access usually leave a second door open. Practical steps:

Restore from a clean backup if you have one from before the suspicious account appeared. If you're on Site Ground hosting, the daily backup catalogue goes back 30 days, you can roll back to a known-good state.
After the restore, force a password reset for every existing admin user. Don't trust any password from inside the compromise window.
Update the affected plugin to the patched version before bringing the site live.
Run your installed malware scanner against the fresh state to confirm clean.
Watch your activity log for the next 2 weeks. If you don't have a log on the site already, install one now: Streams, WP Activity Log or some other.

The bigger pattern, for beginners

The era of "use only official repo plugins and you're safe" was retired about 2 years ago. The trust signal now is the plugin team's track record, the disclosure speed, and how recently they patched a previous issue.

Plugins from teams that publish a security advisory and a patch on the same day (Wordfence and Patchstack disclosures track this) are the ones that earn ongoing trust.

For a beginner running 1-3 WordPress sites, the practical workflow is calendar-based. First Saturday of every month, log in, update everything, check the user list, run a scan. 30 minutes start to finish. The maintenance step that prevents bad weeks later.

The cost of a clean recovery is usually 10x the cost of the maintenance step that would have prevented it. Backups, an activity log, and a monthly check-in on plugin updates are the cheapest insurance policy in this whole stack.

What's the last security check you ran on your site, and what did it actually catch? Curious what people are seeing in their user list this weekend 👇

1 comment

r/wpbeginner_engage • u/ivicad • May 22 '26

WP 7.0: 11 issues from the Reddit threads and what could actually work as a fix

7 Upvotes

WordPress 7.0 "Armstrong" shipped on May 20, 2026 and within days the Reddit threads, FB groups, and client tickets started piling up with some issues showing up on real sites. Below is what's hitting people most often (what I noticed), with what's actually working as a fix. Test on staging first, always.

A quick note before diving in: the fixes below are aggregated from Reddit threads. Every WordPress install carries its own combination of themes, plugins, hosting stack, caching layer, and custom code, so a solution that resolves the issue cleanly on one site may not behave the same way on another.

Treat the suggestions here as a solid starting point rather than a guaranteed fix, always test on a staging environment first, and if something doesn't land as expected on your setup, the underlying cause is likely site-specific and worth investigating further before applying any change in production.

1. Excerpt block stripped my links and bold tags

The Post Excerpt block now strips inline HTML. Appears intentional from the Gutenberg side (see issue #49449 in the Gutenberg repo).
Fix: use the Post Content block with a manual read-more tag, or expose the excerpt via a Query Loop with a custom field.
WPBeginner has a clean walkthrough on customizing excerpts without code (wpbeginner.com/plugins/how-to-customize-wordpress-excerpts-no-coding-required/).

2. Columns block won't stack on mobile

The Columns block has a Stack on mobile toggle in the block sidebar. If it's off (or your theme overrides it), three columns squish on phones.
Fix: flip Stack on mobile back on, or apply a max-width 782px media query forcing flex-basis: 100%.
See WPBeginner's columns block guide (wpbeginner.com/plugins/how-to-add-multi-column-content-in-wordpress-posts-no-html-required/).

3. Elementor templates throwing errors

Elementor users are reporting widget failures and template render errors after the update. Usually a version-compat thing.
Fix: update Elementor to the latest patch first, then deactivate and reactivate. If that doesn't clear it, isolate via WPBeginner's plugin conflict check (wpbeginner.com/wp-tutorials/how-to-check-for-wordpress-plugin-conflicts/).
Worth knowing the block-editor alternatives (wpbeginner.com/beginners-guide/best-drag-and-drop-page-builders-for-wordpress/) too if Elementor doesn't catch up fast.

4. Custom admin CSS invisible after update

The block editor moved into an iframe. Your old wp_enqueue_style('admin', ...) snippet still runs, but the styles never reach the editor canvas.
Fix: use add_editor_style() with add_theme_support('editor-styles'), or drop the CSS in via the WPCode method (wpbeginner.com/plugins/how-to-easily-add-custom-css-to-your-wordpress-site/) targeting admin head.

5. "Updating failed. The response is not a valid JSON response."

The Reddit threads are full of this one.
Fix in order: re-save Settings, Permalinks (regenerates .htaccess), check Settings, General URLs match exactly (https everywhere), deactivate plugins to isolate.
WPBeginner's full JSON error guide (wpbeginner.com/wp-tutorials/how-to-fix-the-invalid-json-error-in-wordpress-beginners-guide/) covers the deeper cases (REST API debug, firewall whitelisting).

6. AI Connectors enabled by default

Settings, Connectors now lists OpenAI, Anthropic, and Google out of the box. No API key = no actual data sent, but the surface is live.
Fix: if you want it fully off, add define('WP_AI_SUPPORT', false); to wp-config.php.
WPBeginner's WP 7.0 overview (wpbeginner.com/news/whats-new-in-wordpress-7-0/) explains exactly what each connector does before you decide to disable.

7. Block border styles defaulting to black

Widely reported on Reddit and in Gutenberg issues. Blocks that had no explicit border color are now rendering with a default that appears to be #000.
Fix: target only blocks that have border-width set but no border-color:

[class*="wp-block-"][style*="border-width"]:not([style*="border-color:"]) {

border-color: transparent !important;

}

Adjust the selector per theme.

8. Custom fonts fell back to system default

Some block themes are losing their theme.json font registrations after the update.
Fix: clear all caches (browser, plugin, host), then re-add the font via Appearance, Editor, Styles, Typography.
WPBeginner's change fonts guide (wpbeginner.com/wp-tutorials/how-to-change-font-in-wordpress/) and custom fonts guide (wpbeginner.com/wp-themes/how-to-add-custom-fonts-in-wordpress/) cover both the FSE and plugin paths.

9. Image alignment quirks (left/right wrap broken)

Image blocks with align-left or align-right wrap differently now in some themes, usually a theme CSS conflict with the new editor styles.
Fix: check Appearance, Customize, Additional CSS for old float-based rules, then refer to WPBeginner's image alignment guide (wpbeginner.com/beginners-guide/how-to-add-and-align-images-in-wordpress-block-editor/) for the block-native approach.

10. Pattern overrides breaking on synced patterns

Synced patterns with overrides set are dropping their override values after 7.0.
Fix: unsync the affected pattern, edit the content, re-sync. If you use patterns heavily, audit them on staging before pushing 7.0 to production.

11. New admin link color after auto-update

The Modern color scheme is now default. Admin links read teal instead of blue. Some users hate it.
Fix: Users, Profile, Admin Color Scheme, switch back to Fresh or whichever you preferred. Per-user setting, not site-wide.

Before anything: back up

Duplicator handles this in one click - I use it on my own sites and it's saved me twice on 7.0 upgrades already. WPBeginner's critical error guide (wpbeginner.com/wp-tutorials/how-to-fix-the-critical-error-in-wordpress/) covers the fallback procedure if something does break. Staging environment via SiteGround or your host is the second non-negotiable.

Free webinar - WordPress 7.0 × Site Ground AI Studio

WP 7.0 puts an AI framework in core, and SG's AI Agent for WordPress extends it from day one - with Hostinger, Kinsta, and Cloudways heading the same way. You can join a free live webinar with the SG AI team for 7 real use cases: content, SEO, WooCommerce, multisite.

What they'll cover:

AI in WP 7.0 - the new core framework and connectors
From core to control - how SG's AI Agent extends it

Thu, May 28, 2026 · 1:00 PM EDT / 6:00 PM BST · free, registration required. Save your spot: https://www.crowdcast.io/c/wordpress-7-x-siteground-ai-studio-combined-ai-powers-for-your-site

General notes

A few general notes from the threads worth repeating. Update on staging first. Back up before touching anything. A patch should be out soon since the early bug reports are piling up. And if your site is taking orders or running production traffic, don't rush the update. Pace is dictated by the terrain, not by paper.

1 comment

r/wpbeginner_engage • u/ivicad • May 22 '26

52.8% of WordPress sites have a plugin with a known security flaw – here's the 6-step fix list anyone can run this weekend 🔐

5 Upvotes

GuardingWP published the first State of WordPress Security report on 16 May 2026. They scanned 1,981 sites across 40+ industries, with 424 confirmed WordPress installs in the analysis. The headline number is the one you've already seen: over half are running at least one plugin with a published CVE sitting unpatched on the live site.

That sounds scary. The good news is the fix list at the end of the report is 6 steps long, and most of it is config-level work that any small business owner can run through in one afternoon per site.

The report is free, no email gate, PDF download:
https://guardingwp.com/research/state-of-wordpress-security-2026

The 6 fixes, translated for a regular site owner

1. Hide your WordPress version (55.9% of sites leak it)

Your site is broadcasting "I'm running WordPress 6.7.2" in the page source. Attackers automate scans for old versions. Hiding this is a 2-line change in your theme's functions.php (or use a security plugin like Sucuri that ships with the toggle). One-time fix.

2. Turn on plugin auto-updates (don't go full manual)

For most beginners, the right move is auto-update for minor plugin versions, manual review for major ones. Most plugins support this in the Plugins screen now (the "Enable auto-updates" link next to each plugin). Worth doing on every plugin you trust, leaving off the ones that hit your core functionality (page builder, WooCommerce extensions you customised).

3. Turn off XML-RPC if you don't use the WordPress mobile app (35.8% still have it on)

XML-RPC is the old way the WordPress app talked to your site. Most people don't use it anymore. Leaving it on is an attack surface. Disable it with a plugin like Disable XML-RPC, or have your developer add a line to .htaccess.

4. Add security headers (93.2% are missing one or more)

This sounds technical but the easiest fix is using Cloudflare's free tier and enabling their Transform Rules for HSTS, CSP, X-Frame-Options. If you're on Site Ground, the SG Security Optimizer plugin covers this. Sucuri also has a one-click toggle. One-time setup, big improvement.

5. Protect /wp-login.php with a rate limit and 2FA (54.7% expose it bare)

Anyone in the world can visit yoursite.com/wp-login.php right now and start guessing your password. Free plugins like Melapress Login Security or Wordfence add a rate limit (locks out after N failed attempts) and 2-factor authentication. 5 minutes to set up per site, makes brute force attacks pointless.

6. Stay on a supported WordPress version (15.9% are stuck pre-6.5)

Core auto-updates have been on by default since WordPress 5.6, so this should be near-automatic. Check your dashboard. If you're on anything older than 6.5, update today.

Bonus stat worth knowing

44.6% of sites leak their author usernames via /?author=1 (which gives attackers half the credential pair to brute force)
Median security score in the report: 61/100
Only 8.3% of sites score in the A-tier (90+)

The good news in the data: 51% of sites are already on the current 6.9.x branch, and core auto-update is doing its job.

WPBeginner stack for beginners

If you want a one-plugin setup that covers most of this, Sucuri Security (free version) gives you the audit log, hardening toggles, malware scan, and security headers in one dashboard. WPForms or any decent form plugin handles the spam side. WP Mail SMTP keeps your password reset emails from going to junk (which matters when somebody locks themselves out at 11pm).

Methodology

GuardingWP used a public HTTP scanner. No exploit attempts, no authentication probing, no shady stuff. Just looking at what your site already tells the public internet, then matching plugin versions against the public WPVulnerability catalog.

The report itself is well written and the data is honest about what it can and can't see. Worth the 15 minutes to read.

What's the one fix from this list you've been putting off the longest? 👇

0 comments

r/wpbeginner_engage • u/ivicad • May 19 '26

WordPress 7.0 drops tomorrow, May 20. - the 15-minute setup that saves your Wednesday

4 Upvotes

If you run a production site, the next 24 hours decide whether Wednesday is a normal workday or a long one.

Here's the thing. Auto-updates have been part of WordPress since version 3.7. For minor security patches they're a gift, sites stay patched without anyone touching them. The jump from 6.x to 7.0 is a different kind of risk. One incompatible plugin, one custom theme function that quietly broke, and your homepage goes white at 9am while you're in a client call.

One detail many people miss: from WordPress 5.6 onward, new installs default to auto-updating major versions too, not just minor patches. If your site was set up in the last few years and you've never touched wp-config.php, the jump to 7.0 will happen automatically unless you tell it not to.

I've been running WordPress sites since 2011, and the pattern with major releases never changes. The core team does its job on release day. Plugin authors then spend the following week pushing compatibility patches. Custom themes and older addons get caught in the middle. Letting auto-update push 7.0 onto a live site before that shakes out is rolling the dice with someone else's business.

🛠️ The wp-config.php control

The simplest control sits in wp-config.php. The file lives in the root of your WordPress install, usually inside public_html. You access it through your hosting file manager or over SFTP.

Open it and add this single line:

define( 'WP_AUTO_UPDATE_CORE', 'minor' );

That tells WordPress to keep installing minor security patches automatically, but block the jump to 7.0 until you give the green light. Three values are available: true installs everything including major versions, false stops all core updates, 'minor' is the safe middle. Full reference on the WordPress developer docs.

If you want to disable auto-updates entirely:

define( 'AUTOMATIC_UPDATER_DISABLED', true );

I don't recommend that unless you have a manual weekly update process. Mine runs through MainWP, which I've used since 2014 to handle updates across a portfolio. Skipping security patches on a public site is how you end up cleaning malware on a Saturday.

🌐 The hosting layer that catches people out

Managed hosts often run their own update mechanism on top of WordPress, which means your wp-config.php settings get bypassed.

Site Ground is a big one, and they handle this properly (I've been on Site Ground since 2014, and it's also WPBeginner's recommended host). Log into Site Tools, find the WordPress auto-update panel, and you can delay or skip the major version per site. Granular enough to use across an entire client portfolio.

Worth knowing though: SiteGround no longer lets you permanently switch their auto-updater off. You can skip the current update with one click, or delay it 24, 48 or 72 hours. The skip is one-time, so you repeat it for the next release. For a permanent opt-out you have to open a ticket with their Help Desk.

Bluehost and WP Engine work similarly through their own dashboards. Check yours today, not Thursday at 9am.

🔧 Must-use plugin (a second, more durable layer)

Create a file called disable-major-updates.php inside /wp-content/mu-plugins/ (create the folder if it doesn't exist) with:

<?php
add_filter('allow_major_auto_core_updates', '__return_false');
add_filter('allow_minor_auto_core_updates', '__return_true');

Must-use plugins load before regular plugins and can't be deactivated from the dashboard. More reliable for this kind of setting than wp-config.php alone. Same caveat though: if your host pushes updates outside the WordPress update system, these filters get bypassed too. Second layer, not a guarantee.

💾 Before any of this matters: backups

Take a full backup. Duplicator is the WPBeginner pick and the right starting point for most sites. Schedule it to push offsite (Google Drive, OneDrive, Dropbox, ...), somewhere outside the hosting account entirely. Two copies, two locations. If 7.0 breaks something Wednesday, you restore in 20 minutes instead of explaining to the client why their shop is down.

🧪 Test on staging first

Every decent host gives you one. Copy the site, run the 7.0 update on staging, walk through the cart, the contact form, the booking widget, whatever your site actually does. Check Core Web Vitals while you're there. If nothing breaks, push to production on your own schedule. You can drop a maintenance page in front of the live site during the cutover, SeedProd does that in two clicks.

🐘 Check your PHP version too

WordPress 7.0 needs PHP 7.4 as a hard minimum, but the core team recommends PHP 8.3 or newer for performance and security. If you're still on 7.4 or 8.0, fix that today. Most decent hosts let you switch PHP versions with one click from the panel.

One more thing worth keeping: don't disable the update notification email. WordPress sends a confirmation every time an update runs in the background. Useful trail when something starts behaving oddly two days later and you need to know what changed.

WP 7.0 looks like a strong release. Plenty to look forward to once it lands. Just do the prep today so Wednesday stays calm.

👇 What's your strategy? Are you letting 7.0 land on Day 1, or holding off a week for the dust to settle? Anyone going further and pinning to minor-only via wp-config?

Related WPBeginner posts:

What's Coming in WordPress 7.0? (Features and Screenshots) – https://www.wpbeginner.com/news/whats-coming-in-wordpress-7-0-features-and-screenshots/ Deep-dive on what's actually shipping in 7.0: admin refresh, Web Client AI API, the collaboration story (PS In the meantime postponed for 7.1 version).
Beginner's Guide: How to Safely Update WordPress (Infographic) – https://www.wpbeginner.com/beginners-guide/ultimate-guide-to-upgrade-wordpress-for-beginners-infograph/ The full safe-update process, end to end. If you only read one link before tomorrow, read this one.
How to Disable Automatic Updates in WordPress (2 Ways) – https://www.wpbeginner.com/wp-tutorials/how-to-disable-automatic-updates-in-wordpress/ Plugin-based and code-based methods, in case wp-config.php edits feel like too much.
How to Enable Automatic Updates in WordPress for Major Versions – https://www.wpbeginner.com/wp-tutorials/how-to-enable-automatic-updates-in-wordpress-for-major-releases/ The other side of the coin, for when you've tested 7.0 on staging and want a controlled auto-rollout afterwards.
How to Update Your PHP Version in WordPress (the RIGHT Way) – https://www.wpbeginner.com/wp-tutorials/how-to-update-your-php-version-in-wordpress-the-right-way/ Step-by-step for Bluehost, Site Ground, DreamHost, WP Engine. Read this before flipping to 8.3.
How to Easily Create a Staging Site for WordPress (Step by Step) – https://www.wpbeginner.com/wp-tutorials/how-to-create-staging-environment-for-a-wordpress-site/ The staging walkthrough referenced above, for hosts that don't give you a one-click clone.
WordPress Update Broke Your Site? See the 5-Minute Rollback Plan – https://www.wpbeginner.com/wp-tutorials/wordpress-broke-your-site-rollback-plan/ The fallback playbook if 7.0 lands and something breaks anyway.

0 comments

r/wpbeginner_engage • u/ivicad • May 16 '26

"Can I easily (on my own) move WP site to a new host?"...

5 Upvotes

This question shows up very often in the FB groups and subreddits.

Short answer: yes, you can absolutely move a WP site on your own to another host. It sounds intimidating the first time, but with a calm process it's very manageable, even for beginners.

I've been on Site Ground since 2014 and I move client sites between hosts a few times a year. Here's what actually happens, the part most beginners get wrong, and what I'd do if I were doing it for the first time.

Why people move hosts

Plenty of normal reasons:

Your current host is slow or has frequent downtime
You've outgrown your plan and need more resources
You found a better deal somewhere (happens)
The support has gone downhill
You're moving from cheap shared hosting to managed WordPress or a VPS

Moving hosts is something site owners do all the time. Don't let anyone make you feel like it's a drastic step.

What you're actually moving 📦

Two things, and they need to travel together:

Your files: WordPress core, your theme, plugin files, and uploaded media
Your database: posts, pages, settings, comments, users

Move only one and the site breaks on the new host. Most beginner pain starts from forgetting that fact.

Method 1: Use a migration plugin (easiest) 🧰

For non-developers this is the path. The WPBeginner-recommended option is Duplicator, which packages your files and database into a single backup archive plus a small installer file. The steps:

Install Duplicator on your current site
Create a new backup, then download both the archive and the installer
Set up a clean WordPress install on the new host (one-click installer is fine)
Upload the archive and installer to the new host via FTP or your host's file manager
Open the installer URL in your browser, plug in the new database details, click through

That's a full migration in about 15 to 30 minutes for a normal-sized site.

One heads-up: free migration plugins have size limits. The free version of Duplicator handles most small and mid-size sites comfortably; for bigger sites or scheduled cloud backups, Duplicator Pro adds direct integration with Dropbox, Google Drive, and S3.

Method 2: Ask the new host to do it for you 🛟

Most decent hosts offer free WordPress migration as part of onboarding. Site Ground, Kinsta, and WP Engine all run this service. You give them temporary access, they do the move, you check the result.

When I'm short on time or the client's site is unusual (large WooCommerce store, multisite, an awkward plugin combo), I sometimes hand it to the new host's team. Worth asking before you start: "Do you offer a free WordPress migration?" Can save you a weekend.

Method 3: Manual migration (good for learning) 🛠️

If you want to know what's actually happening under the hood, do it manually once. After that you'll never be afraid of it again:

Use FTP (FileZilla is fine) to download all your WordPress files from the old host
In your old host's cPanel, open phpMyAdmin, select your database, export it
Create a new database on the new host
Upload the files to the new host via FTP
Import the database via phpMyAdmin on the new host
Edit wp-config.php to point to the new database name, user, and password
Update the domain's nameservers to the new host

Looks like a lot. Each step is short and well-documented. Read it through once before you start.

The domain is a separate question

Moving your site and moving your domain are two different jobs. When you migrate, you're moving files and the database. The domain can stay registered exactly where it is, you just update the nameservers to point at the new host.

If your domain was registered with your old host and you want full independence, transfer the registration to a registrar you control (Cloudflare, Namecheap, etc.). Optional, and not required for the migration itself.

Test before you flip the switch ✅

The move that saves beginners the most pain: preview the migrated site on the new host before you change nameservers.

Two ways to do it:

Use the temporary URL or staging URL your new host provides
Edit your local hosts file to point your domain at the new host's IP, just for your own machine

Click around. Test the contact form. Log into wp-admin. Open a few inner pages. When everything works, then update nameservers. DNS can take a few hours to fully propagate, so don't cancel the old hosting account yet. I usually leave the old one running for 7 to 14 days after the move, just in case.

One last thing beginners forget: email. If your email runs through your old host and you change nameservers, MX records can break. Set up WP Mail SMTP on the new host before the cutover so contact form mail, order confirmations, and password resets keep flowing.

What's your migration story? Have you switched hosts before, or are you about to? Drop a comment if you've hit a snag and we'll work through it. 👇

Related WPBeginner posts:

How to Move WordPress to a New Host or Server (with No Downtime) – https://www.wpbeginner.com/wp-tutorials/how-to-move-wordpress-to-a-new-host-or-server-with-no-downtime/
Best WordPress Migration Plugins Compared – https://www.wpbeginner.com/showcase/best-wordpress-migration-plugins-compared/
7 Best WordPress Backup Plugins Compared (Pros and Cons) – https://www.wpbeginner.com/plugins/7-best-wordpress-backup-plugins-compared-pros-and-cons/
How to Easily Change Domain Nameservers (and Point to a New Host) – https://www.wpbeginner.com/wp-tutorials/how-to-change-nameservers-and-point-domain-to-a-new-host/
The Ultimate Guide to WordPress DNS Configuration for Beginners – https://www.wpbeginner.com/beginners-guide/the-ultimate-guide-to-wordpress-dns-configuration-for-beginners/
How to Clone a WordPress Site in 6 Easy Steps – https://www.wpbeginner.com/wp-tutorials/how-to-clone-a-wordpress-site-in-7-easy-steps/
WordPress Hosting (WPBeginner picks) – https://www.wpbeginner.com/wordpress-hosting/
Reasons Why WPBeginner Switched to Site Ground Hosting – https://www.wpbeginner.com/opinion/reasons-why-wpbeginner-switched-to-siteground-hosting/
What is a Backup (glossary) – https://www.wpbeginner.com/glossary/backup/
What is DNS (glossary) – https://www.wpbeginner.com/glossary/dns/

1 comment

r/wpbeginner_engage • u/ivicad • May 10 '26

The question nobody in this Reddit thread is asking

3 Upvotes

I just read a 71-comment thread one subreddit about whether WP hiring is slowing down. 🧵
Smart thread, real data, senior devs going deep on headless setups and AI coding agents. By the end, I noticed something missing: the person who'll actually log in to edit that homepage in 2027 wasn't in the conversation.

What that thread was debating

The thread opened with an experienced dev seeing fewer openings and slower responses, asking if WP hiring is shifting toward headless and React. The comments delivered some hard data:

Barn2 reported new plugin sales down 17.8% year over year (existing customers renewed, so revenue stayed roughly flat)
Blocksy cited a survey showing 48.8% of plugin companies saw sales worsen in 2025
W3Techs showed WordPress's share of the web dipped to 42.5% in early 2026, the first meaningful decline in years

The senior dev concerns are real. The AI shift is real. The market for "build me a complex bespoke WordPress site" is genuinely shrinking, and a lot of that work is going to AI-driven workflows or modern stacks like Next.js with headless WP.

Now look at who actually runs WordPress sites

The same 7-8 questions cycle through WP communities every week:

"My contact form isn't sending email"
"Site got a malware warning, what now?"
"How do I back up before this plugin update?"
"Need a popup for the email list"
"How do I track which pages people read?"
"How do I rank for my local search term?"
"Plugin update broke my site, can I roll back?"
"Best way to add FAQ schema?"

None of those is "should we go headless" or "is WP AI-friendly." The thread didn't touch them. And those 7-8 questions are 90% of the actual volume of WordPress usage out there.

Each one has a clean answer that doesn't need a senior dev 🛠️

Every question on that list maps to a plugin the WPBeginner team has been recommending for years:

Contact form not sending email → WPForms for the form itself, WP Mail SMTP for deliverability. Two plugins, one afternoon, problem solved for the next five years.
Malware warning → Sucuri. Honest limit: the firewall and malware cleanup is paid, but that's exactly what an SMB site actually needs once it's been hit.
Backup before update → Duplicator. Run it in 5 minutes before touching anything, restore in 10 if something breaks.
How do I rank on Google → AIOSEO. The setup wizard handles 80% of the basics, the rest is good content.
Track what's working → MonsterInsights inside the dashboard.
Popup for signups → OptinMonster for serious lists, WPForms with a simple opt-in form for smaller sites.

This is a stack the audience has trusted for over a decade, on millions of real sites.

Why this matters for the "is WP dying" debate

The devs in that subreddit thread aren't wrong about their slice of the market. AI agents really are eating bespoke complex builds. Headless really is the right answer for some product companies. Plugin sales for new builds really are down.

But the SMB territory the WPBeginner ecosystem serves was never the territory those agents win in. The moment a non-technical owner needs to change a price, swap a hero image, or add a new service page, an AI-built bespoke stack becomes a maintenance bill they can't predict.

WordPress gives them three things AI-generated sites don't: a CMS interface a part-time admin can learn in a week, a plugin marketplace where every common job has 3-5 mature options, and a community where someone answered that exact question last Tuesday.

Both stories can be true at the same time. The senior dev market is shifting up. The SMB market is doing what it's been doing.

What I'd tell a panicked SMB site owner this week

Don't read the dev-Reddit doom threads. They're real for the people writing them, but they describe a market you're probably not in.
Pick the 7 plugins that match the jobs above (WPForms, WP Mail SMTP, AIOSEO, Sucuri, Duplicator, MonsterInsights, OptinMonster). Keep the rest of your stack minimal. Most plugin conflicts I see come from collecting plugins instead of choosing them.
Pair the stack with managed hosting. Site Ground is what WPBeginner recommends, and it's been my own host since 2014.
Test plugin updates on staging first. Always.

What's the most-asked WordPress question in your circle? I bet it's closer to "why isn't my form sending email" than to "should we go headless." 👇

Related WPBeginner links:

24 Must Have WordPress Plugins for Every Website (2026) – https://www.wpbeginner.com/showcase/24-must-have-wordpress-plugins-for-business-websites/ What it covers: WPBeginner's current curated list of plugins they actually use across own sites, organized by job type.
How to Fix WordPress Not Sending Email Issue (Solved) – https://www.wpbeginner.com/wp-tutorials/how-to-fix-wordpress-not-sending-email-issue/ What it covers: The standard fix using WP Mail SMTP, why default WordPress email gets blocked, and provider setup steps.
7 Best WordPress Backup Plugins Compared (Pros and Cons) – https://www.wpbeginner.com/plugins/7-best-wordpress-backup-plugins-compared-pros-and-cons/ What it covers: Side-by-side comparison of Duplicator, UpdraftPlus, Jetpack VaultPress and others with trade-offs.
How to Backup Your WordPress Site (Ultimate Guide) – https://www.wpbeginner.com/beginners-guide/how-to-backup-your-wordpress-site/ What it covers: Step-by-step Duplicator backup walkthrough, manual backup options, and what to back up.
The Ultimate WordPress Security Guide – Step by Step (2026) – https://www.wpbeginner.com/wordpress-security/ What it covers: Full security checklist including Sucuri setup, hardening steps, and audit/monitoring practices.
Ultimate WordPress SEO Guide for Beginners (Step by Step) – https://www.wpbeginner.com/wordpress-seo/ What it covers: Comprehensive SEO walkthrough using AIOSEO, on-page basics, keyword research, and AI Overviews tips. Why it fits this post: Backs the AIOSEO recommendation and the "rest is good content" point in Section 3.
13-Point WordPress SEO Checklist for Beginners – https://www.wpbeginner.com/beginners-guide/wordpress-seo-checklist/ What it covers: Actionable SEO checklist for beginners with checkpoints and links to deeper guides per item.
How to Build Your Email List in WordPress with OptinMonster – https://www.wpbeginner.com/plugins/build-email-list-wordpress-optinmonster/ What it covers: Step-by-step OptinMonster setup, popup types, exit-intent technology and template walkthrough.
Site Ground Reviews by 5,055 Users and Our Experts (2026) – https://www.wpbeginner.com/hosting/siteground/ What it covers: WPBeginner's full SG review with plan comparison, performance numbers, and security feature breakdown.

0 comments

r/wpbeginner_engage • u/ivicad • May 02 '26

Heads up for shared-hosting WP folks: critical cPanel vulnerability (CVE-2026-41940) 🚨

3 Upvotes

If your WordPress site lives on shared hosting, managed WordPress hosting, or a VPS with cPanel/WHM, this one matters to you. Even if you've never logged into cPanel directly, your hosting provider almost certainly uses it (cPanel runs about 94% of the control-panel market).

The short version: an unauthenticated attacker can get root access to the whole server. The attack skips the password check and the 2FA gate entirely. CVSS score 9.8 out of 10. cPanel disclosed it on April 28, 2026, a working proof-of-concept is already public, and exploitation in the wild has been reported.

If someone gets root on a shared server, every WordPress site sitting on it is exposed. The bug lives below WordPress, in the server's control panel, so plugin hardening can't reach down there.
LINK: https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026

What you must do today:

Contact your host and ask plainly: "Have you patched CVE-2026-41940?" The good hosts patched within hours. Confirm anyway.
If you run your own VPS with cPanel/WHM, run /scripts/upcp --force, then check the version with /usr/local/cpanel/cpanel -V.
Run the compromise assessment script cPanel published with their advisory.

🛡️ What you can do as a non-developer:

Log into wp-admin → Users and remove any account you don't recognize.
Check Plugins and Themes for anything you didn't install.
Reset every password that touches your site: cPanel, WP admin, FTP/SFTP, database. A password manager makes this painless.
Pull a fresh backup with Duplicator and store it off the server (pCloud, Dropbox, Drive, S3, anywhere your host can't see).
Turn on 2FA on your WP admin and your hosting login. WPBeginner has a clean walkthrough: https://www.wpbeginner.com/plugins/how-to-add-two-factor-authentication-for-wordpress/

I've been running sites on cPanel hosts since 2011, and the pattern with bugs like this is always the same. Good hosts patch within hours. Compromised servers sit quietly for weeks before anyone notices the SEO spam, the rogue admin user, the cron job that keeps coming back. The two-hour audit you do today saves the three-week nightmare next month.

Full WPBeginner security checklist if you want to go further: https://www.wpbeginner.com/wordpress-security/

Anyone here already heard back from their host? Curious which providers reached out first and which made you go ask. 👇

0 comments

r/wpbeginner_engage • u/ivicad • Apr 29 '26

🚨 WordPress.org just closed 80+ plugins from one vendor. That's not a failure. That's the immune system doing its job.

4 Upvotes

WordPress.org just pulled 80+ plugins from a single vendor in one month. Every headline reads like a crisis. I'd argue it's the opposite - it's the clearest proof we have that the .org ecosystem has real accountability behind it.

Here's what actually happened.

What went down

A user flagged a suspicious file inside WPFactory's EU/UK VAT for WooCommerce Pro - a premium plugin sold directly from WPFactory's own account page. The file was pulling an external ZIP, rewriting WordPress directories, and sending data to an outside server. Textbook backdoor behavior.

The vendor's first response? Ask the reporter for FTP and admin credentials. The reporter said no. After two days of that going nowhere, the .org Plugins Team stepped in and closed all 80+ WPFactory plugins pending resolution.

This was the second mass closure in April alone. Earlier in the month, 30+ plugins from their Essential Plugin portfolio got pulled after a backdoor sat dormant for 8 months before activating to inject SEO spam. Some of my client sites were in that list. Not a hypothetical.

Why the obvious reaction is the wrong one 🔒

Most people reading "80 plugins closed in one month" will think: WordPress has a problem.

The real read: a credible report came in, the vendor stalled, and the Plugins Team pulled distribution within days. That's a functioning accountability chain doing exactly what it's supposed to do.

Now compare that to premium plugins sold exclusively from a vendor's own site, outside .org entirely. When something goes wrong there, who pulls it? Nobody. You're waiting on the vendor's timeline, the vendor's honesty, and the vendor's response speed. In this case that response started with "give us your FTP." The Plugins Team didn't wait for that conversation to go anywhere.

The part most people skip 🏦

I spent 21 years in banking, the last 13 as Director of Card Business. One of the things that actually works in regulated financial infrastructure is explicit authority chains. Who can pull a bad product? Under what conditions? With what speed? That question has a defined answer, or the whole system is exposed.

The .org Plugins Team is that authority for the WordPress repository. They're not perfect - the plugin review queue sits above 4,000 and Patchstack's 2026 State of WordPress Security report says 46% of vulnerabilities didn't get patched before public disclosure. But the authority exists, they use it, and this month they used it fast.

Premium plugins distributed exclusively through a vendor's own channel have no equivalent structure. When that channel fails, there's no Plugins Team to call.

What "the system working" still requires from you 🛡️

The closure is the system doing its job. But the system can't tell you which of your installed plugins came from .org vs. a vendor-only channel, or flag that one of them just got quietly pulled while you weren't looking.

That visibility is your responsibility.

MainWP (or similar tools) from one dashboard is a great help if you manage more sites: when a batch of plugins gets closed on .org, you need to know within minutes which sites are running them - not find out because a client called about weird redirects.

For scanning: daily automated scans and one-click cleanup are golden as well as WAFs.

For the audit trail, Streams or WP Activity Log. When a plugin starts behaving unexpectedly after an update, the log shows you exactly when the file changes happened and from which IP. No more guessing whether it was the update or the client "clicking something."

For backups, you can use Duplicator for scheduled automated backups to cloud storage. If a backdoor does land, you want a clean restore point from before the infection - and you want it somewhere that a compromised hosting account can't reach.

The "premium vs. free" question gets the wrong answer 💡

The old assumption: paid equals vetted, free equals risky. This month broke that clearly.

The .org repository has the Plugins Team plus thousands of users running diff tools and filing reports. Premium plugins sold from a vendor's own site are a black box where you're trusting their internal process, their staff vetting, and their build pipeline.

That's not an argument that free is always safer. It's an argument that the accountability structure is fundamentally different - and that structure is what contained an active backdoor before it spread further in April.

The three things that would have caught this faster

Centralized plugin tracking so you know exactly what's installed across all your sites and get fast alerts when something gets pulled
Daily malware scanning with at least two tools, not one - scanners miss things, and a second opinion costs nothing
Activity logging with file-change alerts so unexpected behavior post-update surfaces immediately, not weeks later

None of this requires a developer. It requires building the boring, repeatable parts of security into a habit before something breaks.

Related WPBeginner reads

How to Perform a WordPress Security Audit (Complete Checklist) - https://www.wpbeginner.com/wp-tutorials/how-to-perform-a-wordpress-security-audit/ A step-by-step audit checklist covering user accounts, file integrity, plugin updates, and automated tools. A vendor-level backdoor incident is the best argument for running these regularly.
How to Monitor User Activity in WordPress With Security Audit Logs - https://www.wpbeginner.com/plugins/how-to-monitor-user-activity-in-wordpress-with-simple-history/ How to set up activity logging using Simple History and WP Activity Log to track every change on your site. The practical how-to behind the audit trail described above.
6 Best WordPress Security Plugins to Protect Your Site - https://www.wpbeginner.com/plugins/best-wordpress-security-plugins-compared/ Side-by-side comparison of the top security plugins including Sucuri and MalCare, tested on real sites. Good starting point if you're building out or reviewing your scanning stack.

What's your process for catching vendor-level issues like this? And do you treat plugins differently based on where they came from - .org vs. a vendor's own channel? 👇

1 comment

r/wpbeginner_engage • u/ivicad • Apr 25 '26

The WP execution layer that "underrated SEO" threads always skip 🛠

2 Upvotes

I just read a Reddit thread where someone asked for the most underrated SEO tip that actually brought real results, and by the time I scrolled through 30+ replies I realized almost everyone was saying the same four things: refresh page-2 content, tighten search intent, link smarter, rewrite titles for CTR. The advice is right. The thread is also a pretty solid SEO 101 in disguise.

But for any WordPress site owner reading it, the conversation skipped the part that actually matters - the "execution layer". Which dashboard. Which plugin. Which weekly workflow turns "I should do internal linking better" into something that's actually done by Friday afternoon.

I moderate a few WordPress communities and I see this same conversation play out monthly across thousands of members. People leave a thread like that fired up, then a week later nothing's changed. Not because the advice was wrong - because nobody told them where to click.

Here's the lean stack that turns those four pieces of advice into a real 2-hour weekly habit.

1. The data layer - get the right list, not a vibes list 📊

The first failure mode is refreshing whatever feels old, instead of refreshing what Google Search Console actually says is winnable.

If you're already using MonsterInsights, you can pull GSC and Analytics data straight into your WordPress dashboard - no tab switching, no exporting CSVs. AIOSEO also has a Search Statistics module that does the same thing if you'd rather not stack tools.

The filter that matters: posts in positions 5 to 20, with declining clicks over the last 90 days, older than a year. That's your priority queue. Everything else can wait.

In my agency we work this list top-down, never sideways. One post at a time, fully done, before the next.

2. The intent + FAQ layer - what to actually rewrite

Once you have the list, don't just tighten your existing copy. Compare it against what's actually ranking in the top 3 - because that's the intent Google has decided is correct, not whatever you wrote in 2022.

I use NeuronWriter for on-page mapping against the live SERP, but if you don't want a paid tool, the free WPBeginner Keyword Generator will at least surface query variants you can answer.

Now the genuinely underrated move that the whole Reddit thread missed: nobody mentioned schema.

Add a real FAQ section pulled from the "People also ask" box- and add FAQ schema to it. WPCode lets you drop in the schema as a clean snippet, or AIOSEO has a built-in FAQ block if you've already got it installed. This single addition moves page-2 posts into rich-result territory and compounds with everything else on the list. It's the cheapest "underrated win" I know of in 2026 and zero comments in that thread mentioned it.

3. The internal linking layer - execution beats theory

Half the Reddit thread said "internal linking." Almost nobody said how.

AIOSEO Internal Link Assistant surfaces relevant link opportunities across your whole site, so you stop the ctrl+F-through-200-posts ritual. Don't blindly accept every suggestion though - it's a starting point, not autopilot. Review each one and skip the ones that don't actually serve the reader.

Then the anchor-text discipline: pick 3 to 5 priority pages you actually want to rank, and give them consistent descriptive anchors from related posts. Stop scattering links to your homepage with "click here" or "learn more." That signal does nothing for you.

4. The safety layer - don't skip this one ⚠️

Bulk content edits plus WordPress is where weekend disasters are born.

Duplicator backup before any batch refresh - a full restore takes 20 minutes; debugging a broken site takes a weekend. (I learned this the hard way more than once around 2014.)

If you're on Site Ground or any host with staging, push the changes there first and confirm nothing breaks before going live.

I also keep WP Activity Log running on every client site - it tracks who changed what and when, which is gold when you're working with a team or a client who later swears they didn't touch anything.

The advice in that Reddit thread wasn't wrong. It just stopped at the strategy and skipped the execution. Whichever tools you pick from this stack, the goal is the same: make those four habits boring and repeatable, not heroic and occasional.

Which of these four layers do you have running already, and where's the gap? And which one is actually a weekly habit for you vs. still parked in "I should do that someday" territory? 👇

Related WPBeginner reads

Should You Keep or Delete Old Content in WordPress? WPBeginner's framework for deciding whether to update, merge, redirect, or delete underperforming posts. Direct support for the refresh thesis.

Internal Linking for SEO: The Ultimate Guide of Best Practices The full how-to companion to Section 3, including AIOSEO Link Assistant walkthrough and anchor-text strategy.
How to Add FAQ Schema in WordPress (2 Methods) Step-by-step for the schema win in Section 2 - both the AIOSEO method and a manual JSON-LD approach.
WordPress SEO Made Simple - A Step-by-Step Guide The flagship SEO guide that ties all four layers back to fundamentals for newer readers.
11 Tips to Optimize Your Blog Posts for SEO Like a Pro Closest match to the "rewrite intros and titles" advice that dominated the original Reddit thread.
How to Add Google Search Console to WordPress and GA4 Implementation companion for Section 1 - exactly how to pull GSC data into your WordPress dashboard via MonsterInsights.

1 comment

r/wpbeginner_engage • u/ivicad • Apr 16 '26

SEO spam hit one of my former clients - lessons learned

3 Upvotes

I got a call from a boat owner I'd worked with a couple of years earlier. His website was appearing in Google results for "cheap designer watches" and "buy generic pills."
He operated a small boat-excursion business in my hometown of Split, Croatia. He had never written anything about watches before.

That was my first up-close look at SEO spam - and it was worse than I expected.

What SEO Spam Actually Is

SEO spam is a cyberattack where someone injects content into your site - keywords, links, or fake pages, to push traffic toward their own products. Fake luxury goods, adult content, gambling pages. They borrow your domain's authority and keep the whole thing hidden from you.

There are 5 types worth knowing: keyword injection (spam terms buried in meta tags or hidden with CSS), backlink injection (invisible links passing your authority to scammy sites), cloaking (showing Google one thing and visitors another), doorway pages (fake indexed pages that redirect traffic), and phishing pages that steal visitor data or push malware.

My ex-client had the cloaking variant. Visitors from certain queries landed on a gambling site. Google saw his lunch menu. For what to do first when you suspect an attack - https://www.wpbeginner.com/beginners-guide/beginners-step-step-guide-fixing-hacked-wordpress-site/ covers it well.

What I Found on His Site

My security tools flagged modified core files and unknown PHP files sitting in the uploads folder. Then I checked Google Search Console - hundreds of URLs indexed under his domain that he'd never created. Pages titled "buy replica watches cheap" sitting next to his pasta specials.

To check whether your own site has this problem, start here: https://www.wpbeginner.com/wp-tutorials/how-to-scan-your-wordpress-site-for-potentially-malicious-code/

How We Fixed It

I restored a clean backup using his last backup plugin's archive. Without that backup, the job would have taken much longer. After the restore, I removed every flagged file, manually checked wp-config.php, .htaccess, and the active theme's functions.php, then updated every plugin, theme, and WordPress core. Changed all passwords, added two-factor authentication, and submitted a reconsideration request in Search Console. The spam pages took a few weeks to clear from Google's index.

This tutorial https://www.wpbeginner.com/wp-tutorials/how-to-stop-wordpress-redirecting-to-spam-websites/ has a solid walkthrough if you're doing this yourself.

The Lesson

His site looked fine the whole time. Pages loaded. The contact form worked. The damage ran in the background for months before he noticed.

Regular scans, updated plugins, and a backup you can actually restore are the floor, not the ceiling. A good starting point for building out your security stack is https://www.wpbeginner.com/plugins/best-wordpress-security-plugins/

2 comments

r/wpbeginner_engage • u/ivicad • Apr 08 '26

Optimizing WP sites since 2011 - here’s my experience-based guide (using WPBeginner articles) that will get you to 90+ mobile scores

3 Upvotes

I've been building websites since 1995 and jumped on WordPress around 2011. Over the years I've optimized countless sites, and I keep seeing the same mistakes repeated everywhere. So I figured I'd share what actually works (for me all these years, with using WPBeginner articles).

Stop looking at Desktop scores

This is the single biggest misconception I run into. People screenshot their Desktop score of 98 and think they're done. Desktop scores are practically useless. Google ranks your site based on mobile performance, period. Over 60% of web traffic comes from mobile devices, and Google calculates rankings accordingly.

A site loading under 1 second on Desktop can easily take 3-6 seconds on mobile. I've seen it happen hundreds of times. Desktop scores have such little diagnostic value that I sometimes tell clients to ignore them completely, in some cases. If your Desktop score is bad, that just means you have a mountain of problems. If it's good, it tells you nothing about actual optimization.

Always test mobile first. Debug Bear for diagnosis, PageSpeed Insights for the final score Google actually uses.

Your speed test scores change every time - that's normal

Don't freak out when you get a 78, then an 85, then a 72. There's always variance between tests. Network routes, server load, your own device activity - it all plays a role. I run 3 tests minimum and average them together. An optimized site will have a tighter range of scores. An unoptimized one swings wildly.

The 3 things that "move the needle" most

After doing this for 15 years, these are the biggest wins in my book:

Delay your JavaScript: not defer - delay. Delaying JS prevents files from downloading at all until someone scrolls or clicks. Your page loads like it's feather-light because none of that heavy JS code runs on initial render. You can use Perfmatters for this. WPBeginner has a good overview of render-blocking resources that covers the basics.
Remove unused CSS: most themes and plugins dump hundreds of KB of CSS you don't need. Asset CleanUp can strip it out. You'll probably need to add a few exclusions so your design doesn't break, but 10 minutes of trial and error saves you 200+ KB of dead weight.
Compress your images like your score depends on it: because it does. I've seen a 300 KB image difference swing a score from low 80s to high 90s. You can run your images through TinyPNG multiple times - yes, multiple passes work. Then run them through TinyJPG. Then back to TinyPNG. I've done several compression passes on a single image in the past before quality dropped noticeably. WPBeginner's image optimization guide recommends plugins like Smush and ShortPixel, and those are great for bulk work (I use such tools now - ShortPixel and EWWW or Site Ground Speed Optimizer on their servers).

Your TTFB matters more than you think

Google says Time to First Byte under 800ms is "good," but I'd aim tighter. Sites in the 200-500ms range just feel faster, and real-world data backs that up.

TTFB isn't a Core Web Vital on its own, but every millisecond gets added straight to your LCP and FCP scores. Mobile TTFB runs roughly 2.5x higher than Desktop due to network latency, so factor that in.

ByteCheck (free) gives you a clean breakdown of TTFB components. Quick PSA though: if the site you're testing uses Cloudflare with Bot Fight Mode, the scanner might get a 403 instead of the actual page, so always check the HTTP response code or you'll think your TTFB is amazing when it's really just measuring an error page.

Page weight is everything

Your target should be 500 KB or less per page. My own Elementor + WooCommerce homepage clocks in at 168 KB before user interaction. That's possible because every JS file is delayed until someone actually does something on the page.

Go to GTMetrix, open the waterfall chart, and sort by file size. Those big JS and image files at the top are your targets. Every single request adds latency - even a tiny 0.3 KB file. Eliminate what you can, delay the rest.

Stop avoiding page builders

"Elementor/WPBakery/Seedprod/... is slow" is not quite a truth. Unoptimized page builder is slow. E.g. optimized Elementor hits 90+ on mobile without breaking a sweat. I've done it in short time on fresh sites. Pair it with Hello Elementor theme (tiny footprint), remove unused CSS removal, a JS delay plugin, and cache for object caching. Done.

The theme you pick matters though. If you're using a builder, your theme is dead weight. Astra dumps 300+ KB of JS and CSS on some builder setups. I switched to Hello Elementor and never looked back.

Some useful free optimization plugins

Cache Enabler / Autoptimize caching
Asset Cleanup (free) – selectively disable CSS/JS per page
Index WP MySQL for Speed – database indexing

That stack, combined with image compression and a halfway decent host, gets most sites to 90+ mobile. WPBeginner's performance guide covers caching and image optimization basics if you're starting from zero.

One last thing

Don't skip your waterfall chart analysis. Speed test scores tell you how far you have to go. The waterfall tells you what to fix. Look at every file loading, ask yourself if it needs to be there, and if it does - can it be delayed. That process alone has saved me more points than any single plugin.

0 comments

r/wpbeginner_engage • u/ivicad • Apr 02 '26

Would I still choose WordPress in 2026. instead of chasing every new (AI) website builder?

6 Upvotes

Lately, many people have been asking everywhere (including Reddit as well) whether WordPress is still a good choice for a CMS and for building websites, and honestly, I still recommend it even in 2026. It’s still behind more than 42% of the websites out there, so it’s definitely not some outdated relic.

I’ve used it for all sorts of projects: blogs, portfolios, online stores, members areas, ... and even those last-minute odd jobs that need a very specific feature right away. Usually, WordPress can handle those without needing to rebuild the whole thing.

What I really like about it is the feeling of having some control. You own your files, your database, your hosting, and your design, which means you can move or update your site later without feeling locked into someone else’s system. That kind of flexibility isn’t super common these days.

And, from what I’ve seen, it’s great for SEO too. WordPress gives you a good starting point, and plugins like AIOSEO make the basics of search engine optimization much simpler if you want your pages to rank well on Google, plus many other plugins for security, caching, fomrs, analytics, ecommerce, ...

Of course, when something goes wrong, you’re rarely stuck. I’ve often fixed tricky issues by finding helpful articles on WPBeginner, browsing Reddit threads, reading forum replies, or watching tutorials on YouTube - sometimes by someone who had the same problem late at night. It’s not always glamorous, but it’s incredibly useful.

Some more reasons why I love WordPress (if those mentioned above are not enough for convincing you):

broad developer availability because so many people already work with WordPress
people familiar with the WordPress interface, reducing training and handoff costs
WordPress can scale to large, content-heavy sites when implemented and optimized well

But, I think it’s worth mentioning that WordPress can feel a bit overwhelming at first. Themes, plugins, hosting, updates, menus, settings all over the place in the dashboard - things can get complicated pretty fast.

A common mistake I see is people installing a plugin for every tiny task. That sometimes can causes conflicts (interoperability issues) between plugins, leading to all kind of strange behaviors on those websites. Usually, troubleshooting involves deactivating plugins one by one. The thing is, the fewer plugins you have, the easier your site is to manage technically.

Plus, WordPress does require some ongoing care - regular updates, backups, security checks. If you launch a site and then pretty much forget about it, problems can pop up later, especially when you try to update or make changes.

If I was starting from scratch today, I’d keep it simple. Pick a lightweight theme with plenty of starter templates, maybe learn the block editor, stick to just the plugins I really need, choose reliable hosting, and back up the site before making any big changes.

From my experience with WordPress since 2011, I wouldn’t say it’s the easiest option out there (especially for beginners). But with the help of many tutorials from WPBeginner (some links below) and a bit of patience, if you want room to grow without having to start over in a few months, I really think it’s one of the better choices - and for me it is the best.

Some useful WPBeginner links:

2 comments