Hello author here!

What is DruBOM: a Drupal module that lists every component a site uses, checks for known vulnerabilities and exports an SPDX 3.0.1 SBOM, requiring no third party libraries installation.

In this post I outline what the module does, how it has improved and how it was built; I hope you enjoy the post and the module, and feedback is welcome.

https://www.paolomainardi.com/posts/drubom-next-gen-drupal-supply-chain-security/

I’m looking for someone who can assist me with WooCommerce and WordPress. I need help fixing a font-size issue with my KOT (Kitchen Order Ticket) receipts.

The issue: The KOT print sample displays the correct font size and style, but when I print the actual receipt, the font is much smaller than it appears in the sample.

I’ve already tried increasing the font size in the settings, saving the changes, but the issue persists. The actual printed receipt still has very small text.

If you have experience with WooCommerce POS and can identify and fix this issue, please DM me.

Thank You.

I know in the age of AI & Short video content,
Blogs are no longer irrelevant but after deleting Instagram, my dopamine got stabilised and im enjoying my old hobbies again. I like writing and wish to restart blogging. I have articles written and saved as draft. What are the tips I should be aware of in 2026?

Its a gaming blog with my own domain. I dont plan to be a full time writer and exoect millions of views and alot of money. I just wanna put my thoughts online without clickbaits or AI slop

How do I do all these SEO stuff and ensure my blog comes up in the search list? Any articles or videos you recommend?

Sort of a basic request (I’m very new to this). I’ve started a blog and wanted to have a continuous white text box that separates my writing from the background. Any idea how to get the white box to stay between line breaks using the blocksy plugin? Many thanks

Edit: Don’t panic guys I figured it out

Greetings!

I have built sites (for personal projects or for family members’ small businesses) using Weebly (RIP), Wix, and Google Sites. All ran well and did what they needed to do.

Now I’m volunteering for a small nonprofit organization, and they want me to re-do their website, currently hosted with Dreamhost. They are tired of having to email the webmaster for every small edit they need to do, plus waiting about a week to see each edit done (as you can imagine, this is not high in the priority list of the webmaster).

At first, I thought Google Sites was a no-brainer, because it will be easy for them, and free (with their Google for Nonprofit Workspace, they have a huge space in Drive to house all their PDF archives that are currently in Dreamhost…).

So, here’s the thing: they have decades (going back to the 1950s) of PDF magazines that they make available to their membership. Right now, they’re hosted in Dreamhost, and are links on the website. I’m tempted to try WP for this project, using Elementor and Document Library Pro for the archive… but the few tutorials I watched for WP and the latest posts I saw in this community all made me second guess this because of security concerns… What do you say?

TIA

I was hit with a malware attack over the summer, around July. My sites are on Hostgator's share servers (paid). I see in the error logs, where their security where fighting the infected files, by removing them and the file would re-populate and eventaly over powered them. Looks like attack came from some plugins.

Htaccess files were placed on EVERY file to lock the user out. I contacted Hostgator support, they want over $300 to fix and restore. I already have a back up so I wanted to do it myself. Every folder had the htaccess and php files deep in the directory tree. Some could just be deleted, others had to be change permissions and then deleted. It took hours over a couple days. (I understand why Hostgator charges so much).

Anyway, in short, after deleting and changing permissions, those file 're-populated' themselves. Back a square one. Hostgator say those files have to be deleted before 'restored' files can override the corrupted ones. I plan to use Filezilla to restore files.

Is there a way to add a malware removal tool to scan, quarantine and eliminate infected files? I would delete the whole directory and restore it but some folder wont delete without changing permissions five levels deep.

If you been through this how did you rectify the problem?

Thanks.

It's my first time building a website and I just gotta know about elementor plugin.

Guide this newbie, guyss

Ive gotten really good at Elementor Pro and can pretty much build any design in it … however I do not want to do a subscription.

I’m looking for a builder that is similar to Elementor BUT has a lifetime license.

I just purchased Divi, but I am not liking it at all — so I will be doing a refund on it, unfortunately. I don’t really want to keep randomly spending money to find what I’m looking for. Is there any builder that has similar structure and feel as Elementor that has a lifetime license that you guys are aware of ? Thanks so much for for your time.

What’s the best way to protect wp login and wp admin with Cloudflare now days. I’ve done this in the past with page rules but recently read something about them being retired.

I have the content:

 Columns └─ Column └─ Group └─ Accordion 

But I dont need the columns. The admin of my site made a two column page the default format, but the second column has just been useless for my case. Is there a way to remove the column section and just keep the group? I've tried copy and paste methods, but nothing seems to get what I want. I'm still new to WordPress, so it may be easy but I'm screwing it up. TIA.

If your site uses Field UI in drupal/core, this week's advisories include a remote code execution vulnerability in that module. It isn't directly exploitable with core alone, but I'd still check your installed version.

The fixes are in 10.6.19 / 11.3.19 / 11.4.10 / 12.0.0-beta2, depending on your branch. Those releases address all three core advisories:

• drupal/core, Field UI: remote code execution, with the core-alone limitation noted above.
• drupal/core, Link: insufficient sanitization of certain markup.
• drupal/core, Navigation: insufficient attribute sanitization that can lead to cross-site scripting (XSS).

I read the new Composer advisories each week. For the week of 12 October 2026, these are the ones I'd check first on Drupal sites.

Full list with advisory links: https://patchclock.com/security-digest/2026-w42?utm_source=reddit

Disclosure: I build PatchClock, a CRA compliance tool for PHP vendors. The weekly list itself is free.

Hi y'all. I'm looking for advice as I transition from Webflow to WordPress (please challenge any of my thinking if you disagree with any of my below decisions). I have a background as a front-end designer/developer. My PHP knowledge is…nonexistent (thank goodness for Claude Code), but otherwise I'm fairly savvy and know just enough to be dangerous.

My plan is to use Bricks as the builder and I've figured out my monthly hosting. I think the biggest concern I have is managing updates/security — Webflow was all-in-one and WordPress is 100% not. We're going to have about 10 sites hosted simultaneously to start with, and probably 15 in the next 6 months, all with the same basic bones (all are for local small businesses with one woo commerce site):

1. ACF
2. Bricks for visual builder and forms
3. Complianz for GDPR

Here are my three questions:

1. What other plugins/workflows do I need to consider?
2. At the scale I'm working in (10 sites), is it worth doing something like WPUmbrella or ManageWP (or your best recommendation)? It seems like a lot of this is covered in my unlimited hosting plan, but I think that that requires me to still do many things one-site-at-a-time, whereas these tools enable me to 1-click across a whole fleet of sites that have the same basic functionality?
3. Is Google Site Kit worth it for easy client visibility, or should I simply manage that stuff through Google dashboards?

FYI, I have managed WordPress sites for my day job, so I'm familiar with the process and needs. But this is for my husband's company, and I only really have capacity to meaningfully update sites once a month with spot-checking/testing since it's effectively a side hustle.

Hey all. WP WAF Manager is my plugin for managing Cloudflare from inside WordPress. Until now it covered WAF rules, DNS, zone analytics, zone controls, IP access rules, security events and email routing.

Version 1.0.24.1 is out and it's the biggest update so far. It's grown from 8 modules to 14, and I rebuilt the website to show it all and the github link is: https://github.com/jaimealnassim/wpwafmanager

What's new

- Clients & Reports: link clients to their sites and email them a monthly report under your own agency name, logo and colors. It covers visitors, page views, threats stopped, cache speed, top pages and what Cloudflare blocked, in plain language. The plugin is never mentioned. You can send automatically on a chosen day and hour, or send by hand after a preview and a test.

- Zone analytics detail view: click any site for traffic charts, top pages, countries, status codes, devices and security events by action, path, IP and country, compared with the previous period. Table view and CSV export.

- Bot Control: set AI crawler policy (search, assistants, training), managed robots.txt and Bot Fight Mode across many zones at once.

- SSL & Insights: scan every zone for expiring certificates, Flexible SSL and old TLS versions, with one-click fixes for the safe settings, plus Cloudflare Security Insights.

- Alerts & Health: Cloudflare alerts for DDoS, SSL and origin health, sent by email, Slack or Teams, plus Health Checks on Pro zones.

- Turnstile: create widgets, rotate secrets and copy keys for every client site. Secrets are never stored.

- Page Rules migration: Cloudflare is retiring Page Rules. The plugin finds them on every zone and moves redirects and cache rules to their replacements in one click. Nothing is deleted.

- Zones and tags: tag sites as WooCommerce, Staging, Client and more, and pick them by tag when you deploy.

- Zone Controls upgrades: purge by hostname, prefix or cache tag, Smart Tiered Cache, security headers, and Under Attack Mode on every site in one click.

Still the same: everything is in the free version (GPLv2 on GitHub), it works on Cloudflare Free for nearly everything, and nothing loads on the front end. Pro is a one-time purchase that adds automatic updates and priority support.

A few notes:

- Security Events, Health Checks and Super Bot Fight Mode need a Cloudflare Pro zone. Blocking a whole country needs Enterprise.

- Deploying the WAF rules replaces the custom rules already on that zone, so check the Zone Rules tab first if you have your own.

GitHub: https://github.com/jaimealnassim/wpwafmanager